# Ads servers: Google Ads, Meta Ads and Google Tag Manager Also covers ad platforms without vendor servers and reporting bridges. Checked on 2026-11-01, Google Ads again on 2026-11-06. Write-tool lists are partial and dated; the live tool list wins. ## Google Ads Server and status - `googleads/google-ads-mcp`, version 0.0.6 (2026-11-02). Not read-only by default: the bundled tools config turns on every tool. Read: `customers_list_accessible_customers`, `search_search` (GAQL) and `metadata_get_resource_metadata`. Write: `assets_create_asset`, `assets_upload_video_asset`, `labels_manage_labels` and `labels_manage_label_associations`. - The README lists the tools without their category prefix: take exact names from the client's tool list. Google's developer page (updated 2026-10-30) still says strictly read-only and lists three tools, so trust the README and T2. - Local: `pipx run --spec "google-ads-mcp==" google-ads-mcp`, or a reviewed commit (`git+https://github.com/googleads/google-ads-mcp.git@`). It needs Python 3.10 or later; scanner S05 flags the unpinned forms. - Self-hosting on Cloud Run takes `GOOGLE_ADS_MCP_OAUTH_CLIENT_ID`, `GOOGLE_ADS_MCP_OAUTH_CLIENT_SECRET`, `GOOGLE_ADS_MCP_BASE_URL` and `FASTMCP_HOST`. Claude and ChatGPT then connect as custom connectors with OAuth on the `/mcp` path; clients without OAuth get a 401 and use local stdio. Google says never to omit the two OAuth client variables (see Traps). A Google-hosted endpoint is an allowlisted pilot. Auth and who can connect - An OAuth client or application default credentials plus a Google Cloud project; scope `https://www.googleapis.com/auth/adwords`. A team-owned OAuth client needs an Internal or published consent screen: External in Testing status issues refresh tokens that expire after 7 days (failure F15). - Env: `GOOGLE_PROJECT_ID`, `GOOGLE_APPLICATION_CREDENTIALS`, and optionally `GOOGLE_ADS_LOGIN_CUSTOMER_ID` (the manager account, digits only). - Developer tokens were sunset on 2026-09-09; access levels belong to the Cloud project now. Google's own google-ads-api-mcp-setup skill (checked 2026-11-06) still lists `GOOGLE_ADS_DEVELOPER_TOKEN` and places the client secret and refresh token in client config files: skip both steps and follow Google's MCP page. Read-only layer - Turn the write tools off with a tools config, saved outside the repository: ```yaml namespaces: customers: true search: true metadata: true labels: false assets: false ``` - Set `GOOGLE_ADS_MCP_TOOLS_CONFIG` to that file's absolute path. A named file that is missing stops the server, which is the failure you want. A `tools_config.yaml` in the working directory also loads, but a client that starts the server elsewhere then gets the bundled default with every tool on. Scanner S06 fails an entry without the variable; it does not open the file, so T2 is the proof. - The write tools validate first and return a checksum for a second call. The checksum comes back to the agent, so this is a workflow step, not a read-only layer. - The `adwords` credential stays write-capable whatever the server lists: it can write through any other client or script. - For a dedicated or unattended identity, use Read-only access on the account: Google's access levels table (checked 2026-11-06) gives that level no campaign edits, so the token cannot change that account. Otherwise store the credential as write-capable and never reuse it in scripts. T1 and T3 - T1: `customers_list_accessible_customers` shows the customer ID in digits only (1234567890). - T3: GAQL for a closed week, `cost_micros` divided by 1,000,000, clicks and impressions, against the UI in the account time zone and currency. Traps - A query with LIMIT returns the top N, not a total (failure F11). - A Cloud Run deployment with `--allow-unauthenticated` and no OAuth client variables falls back to application default credentials and answers anyone who has the URL, using the container's service account (failure F20). Detect: an unauthenticated POST of `tools/list` to `/mcp` must return 401; any other result is FAIL. Fix: set both OAuth variables, redeploy, and rotate the service account's access. - Third-party Google Ads servers that can write also exist. They are community servers (scanner S01 flags any package or host named after Google Ads that is not Google's). Any write, through Google's server included, goes through agent-write-safety or an Editor import. Revocation - Remove the server, revoke the OAuth grant in the Google account (verify the path at run time) and delete local tokens. ## Meta Ads Server and status - Remote `https://mcp.facebook.com/ads`. Owning a Meta app is not required; with your own app, add the "Create & manage ads with ads MCP server" use case. - Reporting tools: `ads_get_ad_entities`, `ads_get_opportunity_score` and the `ads_insights_*` tools. Write tools include `ads_update_entity` and `ads_activate_entity`. Clients - Claude Code: `claude mcp add --transport http --client-id meta-ads https://mcp.facebook.com/ads`. - ChatGPT: OAuth with your Meta app ID as the client ID under the advanced OAuth settings. - Programmatic clients: an `Authorization: Bearer` header. Auth and who can connect - Minimum permissions: `ads_mcp_management` plus `ads_read` or `ads_management`. `ads_management`, `catalog_management`, `business_management`, `pages_show_list` and `instagram_basic` each add more tools, so each widens what the connection can change or read. - Only Employee-role system user tokens work; Admin-role system user tokens cannot access the server. - Agencies whose app serves other businesses need app review and Advanced Access for `ads_mcp_management` (Meta announcement 2026-07-16, article research). Read-only layer - Grant `ads_mcp_management` plus `ads_read` only, never `ads_management`, and block write tools in the client. For a dedicated identity, also give it a reporting-only ad account role; confirm the role names on Meta's ad account roles page at run time. - No read-only mode, undo or drafts are documented on the overview. Rules (limited availability) can deny actions per ad account or catalog and cap budget increases or ceilings. They are called on `ads-api.facebook.com` v25.0, not `graph.facebook.com`; active means enforced and paused means not; there is no batch endpoint; non-enrolled businesses get error code 10 or HTTP 403. T1 and T3 - T1: ask for the ad accounts the grant reaches (tool names vary; check the live list), then confirm the `act_` ID, currency and time zone in Ads Manager. - T3: spend, impressions and clicks for a closed week with the same attribution setting. Traps - A grant that quietly includes `ads_management` (failure F04): read the granted permissions, not the requested ones. - Community servers such as Pipeboard are community routes, not Meta's. Revocation - Log out of and remove the server; the business admin removes the app's business integration (verify the path at run time). ## Google Tag Manager Server and status - No Google server (Google Cloud supported-products page, 2026-10-30; Google's MCP catalog). - Stape (third party, Apache-2.0): hosted `https://gtm-mcp.stape.io/mcp` with Google OAuth, or the local CLI `npx -y google-tag-manager-mcp-server` with a service account key, refresh token or access token. Both expose the same 20 tools, and `gtm_auth_status` reports scopes without revealing the token. Read-only layer - Prefer the container export: no credentials reach the agent. - The hosted endpoint requests all seven Tag Manager scopes (gtm-container-audit, 2026-10-17): use it only with an identity that has Read permission on the one container. - The local CLI with a Read-permission service account and `GTM_SCOPES=https://www.googleapis.com/auth/tagmanager.readonly`. A refresh token keeps the scopes it was minted with. - Stape's tools multiplex reads and writes under one tool name (for example `gtm_version` covers live and publish), so a per-tool client block cannot separate them; the scope and the container permission are the layers. Hand-off - Reading and auditing the container: gtm-container-audit. Any change: agent-write-safety. ## Platforms without vendor servers - LinkedIn Ads and TikTok Ads had no vendor MCP server in the October 2026 research. Use exports, a licensed bridge, or a community server that passes the publisher review in [choosing-servers.md](choosing-servers.md). ## Reporting bridges - Funnel is read-only. Supermetrics and Windsor.ai can change campaigns: keep their write tools off for reporting, and remember that hiding actions from discovery is not revocation. Details in [choosing-servers.md](choosing-servers.md).