Google Ads MCP: Official Server, Setup and Write Access

A Google Ads MCP is a server that lets an AI assistant such as Claude query your Google Ads account in plain language through the Model Context Protocol. Google’s official server, open-sourced in October 2025, exposes three read tools: a GAQL search, resource metadata and an account list. It is strictly read-only. It cannot pause campaigns, change bids or add negative keywords. Changes need another server or the API.

Most people who search for this want to manage their account by chat: ask which campaigns are over target CPA this week, then add ten negatives in the same window. The first half works with the official server. The second half is where live ad spend comes into play, and where a human has to approve every change. This guide covers what the official server does, how to set it up (including a recent change to developer tokens), what the alternatives offer, and the approval flow we use for writes. Facts about the official server were checked against Google’s documentation and the GitHub repository on 04.10.2026.

What Is a Google Ads MCP Server?

MCP stands for Model Context Protocol, an open standard that lets large language models call external tools. Instead of every application inventing its own AI interface, an MCP server describes its tools in a shared format, and the client (Claude Desktop, Claude Code, Cursor and others) can use them.

A Google Ads MCP server sits between the model and the Google Ads API. You describe what you want in plain English, the model picks a tool, the server runs the query against the API, and the result returns to the chat. Google’s documentation describes this as a standardized bridge that lets AI agents analyze and retrieve campaign data using natural language. If you want the deeper mental model of how a model chains tool calls, we explain how AI agents work in a separate guide.

Can the Official Google Ads MCP Server Change Campaigns?

The official Google Ads MCP server ships exactly three retrieval tools and no mutate operation.

No. Google’s documentation states: “This implementation is strictly read-only. It cannot modify bids, pause campaigns, or create new assets.” Google’s announcement on the Ads Developer Blog (7 October 2025) calls the initial release read-only as well, and as of 04.10.2026 the repository contains no write tool.

Two details from the README matter for privacy. The server exposes your account data to whichever agent or LLM you connect to it. And Google adds an extra header to your API calls to collect usage data.

The server also lets you switch tools off. A tools_config.yaml can enable or disable individual tools or tool groups, which fits the least-privilege idea we come back to below.

Why did Google ship it this way? A wrong read query wastes your time. A wrong write can pause the wrong campaign or add the wrong negatives and cost budget, sometimes without anyone noticing. Google released the safe half first. Knowing exactly where that boundary sits tells you where the risk starts when you look for write access elsewhere.

How Do You Set Up the Google Ads MCP With Claude?

The setup has five steps. Check Google’s guide for the exact current commands, because they change between versions.

1. Create or pick a Google Cloud project and enable the Google Ads API in it.
2. Check the API access level of that project. A new project only has Test access, which works with test accounts. For live accounts you need Explorer, Basic or Standard access, which you apply for on the Google Ads API Overview page in the Cloud console.
3. Create OAuth credentials (client ID and secret), or set up Application Default Credentials with the https://www.googleapis.com/auth/adwords scope. If you reach the account through a manager account, also set GOOGLE_ADS_LOGIN_CUSTOMER_ID.
4. Add the server to your MCP client. In Google’s example the entry runs the server with pipx straight from the GitHub repository and passes GOOGLE_PROJECT_ID and GOOGLE_APPLICATION_CREDENTIALS as environment variables. In Claude Desktop or Claude Code this is a JSON entry in the MCP configuration. If you prefer a web service shared across agents, Google documents deployment on Cloud Run.
5. Test with a read question. Ask “What customers do I have access to?” If account IDs come back, the connection works.

What changed with developer tokens. Older guides, including earlier versions of this article, list a developer token as a prerequisite. According to Google’s developer token page, developer tokens were sunset on 9 September 2026. API access levels now belong to the Cloud project that owns your OAuth client or service account. Sending a token in the header is still allowed but optional and ignored by the API servers. Google’s MCP guide says the token is no longer required in the latest version of the server, while the GitHub README still lists a “Configure Developer Token (Optional)” step. If you run an older version, you may still need one.

Access levels decide what you can query. Explorer access allows 2,880 operations per day against production accounts, Basic allows 15,000, Standard is unlimited. Explorer also blocks some services, among them the keyword planning services. If you want keyword ideas through the API, you need Basic or Standard.

Keep credentials on the server side. The model sees tool inputs and outputs, never the raw keys. For a first run, use a test account. Do not store credential files in a Git repository.

For the broader picture of MCP clients and servers, see our overview of MCP servers and the guide to the Claude Agent SDK. Claude Code itself is covered in best AI coding tools. The same read-then-approve pattern works for SEO data: see my guide to the Google Search Console MCP.

What Can You Do With a Read-Only Google Ads MCP?

Reading covers a large share of daily account work, because you need to know what is going on before you change anything. Typical prompts:

• “How many active campaigns do I have?” (one of Google’s own sample prompts)
• “Which campaigns are over target CPA this week, ranked by spend?”
• “Show search terms with spend but no conversions in the last 14 days.”
• “Give me a report of the top spending campaigns split by device category over the last 7 days for account 1234567890.” (also from Google’s documentation)
• “Which broad-match keywords have spent the most without a conversion?”

The search tool takes GAQL. You can describe what you want and let the model write the query, or hand it a precise GAQL statement and get a clean table back. The get_resource_metadata tool tells the model which fields exist for a resource such as campaign, so it writes valid queries more often.

Read-only gives you fast diagnosis with zero risk to spend. It cannot fix what it finds, and that is the next question.

How Do You Let Claude Change a Live Account Safely?

The workable answer is a pattern called preview-then-execute. The agent proposes a change and shows a preview, you confirm, and only then does the server run the mutation. Nothing touches the account before an explicit “yes” from a human.

A useful preview contains:

• The exact entities affected: which ad groups, lists or campaigns
• Before and after values: current and proposed state side by side
• A count: how many items change, so a request that touches 400 objects instead of 4 is visible at a glance

A pause request, for example, reads like a plain diff: campaign "Brand - Exact" with status: ENABLED -> PAUSED, and nothing else moves until you confirm. A negatives preview lists each proposed term against the ad group or shared list it will join, with its match type.

The approval gate between preview and mutation is what separates assisted management from a runaway agent. The flow is always the same: propose, show the diff, wait for the confirm, execute, then verify.

Which Jobs Work Well With Preview-Then-Execute?

Bulk negative keywords. You describe the list: “Add these 30 terms as negatives to the shared list of my Search campaigns.” The preview shows which negatives land where and how many. You scan it for close-variant terms that would block valuable traffic, confirm, and the server executes.

Conversion-goal cleanup. A common mess is GA4-imported goals that pull smart bidding toward soft signals. The job is to set those to non-biddable and keep lead-form submissions, bookings and calls. The preview lists every goal with its proposed biddable state, and you confirm before bidding inputs change.

Conversion values. Without values, smart bidding optimizes for volume. Assigning a higher value to a booking than to a newsletter signup lets the algorithm aim at business outcomes. Describe the values, preview the mapping, confirm, execute.

Why Read the Object Back After Every Write?

After every write, the server should read the object back and return the persisted state, not the payload you sent. A money-touching API can accept fields it does not understand, return a success code and apply nothing. Every tool call then comes back green while the account stays unchanged. A read-after-write check catches that: the model sees the diff, notices the change did not stick and tells you. It costs one extra call and saves hours of debugging a “successful” write that did nothing.

The chat window between you and your budget can feel uneasy at first. The preview step is usually what builds trust. It can surface a proposed negative that would block a converting brand term, so you reject it at the confirm step, and it replaces the manual hunt through the search terms report. The operator still owns every “yes”.

Which Alternatives Exist to the Official Server?

If you need writes, you have four routes. The table reflects public repositories and documentation as of 04.10.2026.

Some vendor pages advertise “draft-first” campaign management as the fix for Google’s read-only limit. Judge those by what they show: real prompts, real payloads and real before-and-after account states. A page that only asserts safety has not earned your credentials.

Is It Safe to Give an LLM Access to Live Ad Spend?

Only with a safety playbook. Giving an agent write access means giving a language model the ability to spend your money.

Least privilege. Scope access to a single account. Validate new flows on a test account. Expose only the mutate operations you need. An agent cannot pause a campaign it has no tool to pause.

The failure modes that actually cost money:

• Misread metrics. The model confuses CPA and ROAS, decides a strong campaign is failing and proposes pausing it. The numbers looked authoritative and were the wrong ones.
• Junk negatives. Close-variant and low-quality terms get added as negatives and block valuable traffic. You never see the lost impressions, only a slow decline in volume.
• Destructive mutation with no undo. The agent pauses the wrong campaign, and by the time you notice, the day’s traffic is gone.
• Injected instructions. Search terms and ad text come from third parties and end up in the model’s context. Treat account data as data, never as commands.

The mitigations map onto these risks: a mandatory preview, a human confirm as the hard gate, read-after-write checks, change caps so no single command touches hundreds of entities, and an audit trail that records what the agent did and when. With real spend involved, none of them is optional.

Google Ads MCP vs Google Ads Scripts vs the Raw API

MCP is one of three ways to work against Google Ads, and each solves a different problem.

Use MCP when a human stays in the loop. Use Scripts for repeatable automation, such as pausing any keyword over a CPA limit every morning. Use the API when you build a product on top of Google Ads or need bulk changes in one pass, and accept that you own authentication, retries and error handling. For most teams running their own campaigns, MCP with a human confirm covers the highest-value work.

What Are the Limits of a Google Ads MCP?

Agents make mistakes with money, and that is the reason human approval belongs in front of anything that changes a live account.

MCP speeds up execution and leaves judgment where it was. The model can pull your search-term report in seconds. Whether a rising CPA comes from a bad keyword or from seasonality is still your call. The realistic 2026 setup is assisted management: the model analyzes and proposes, you approve, the system verifies. Autonomous account control is a poor idea for any account with real budget.

If you want a flow like this built for your own or your clients’ accounts, with scoped permissions, dry runs and an audit log, that is a typical project for our AI automation work.

FAQ

Can the official Google Ads MCP server change my campaigns?

No. Google’s documentation describes the server as strictly read-only. It runs GAQL queries, fetches resource metadata and lists accessible accounts. It cannot add negatives, pause campaigns, change bids or create assets. For writes you need a different server with a confirmation flow, or the Google Ads API with your own scripts.

Do I still need a developer token for the Google Ads MCP?

Probably not. Google’s developer token page says developer tokens were sunset on 9 September 2026 and that API access levels now belong to your Cloud project. Google’s MCP guide says the token is no longer required in the latest server version. The README still lists it as optional, so older installs may differ.

What do I need to set up a Google Ads MCP with Claude?

A Google Cloud project with the Google Ads API enabled and an approved access level for live accounts, OAuth credentials or Application Default Credentials, and a server entry in your Claude Desktop or Claude Code configuration. Manager-account users also set a login customer ID. Follow Google’s guide for the current commands.

Is it safe to give an AI agent write access to live ad spend?

Only with guardrails. Use least-privilege access, validate on a test account first, and require a preview-then-execute flow in which a human confirms every change. Add read-after-write checks, change caps and an audit trail. Never let an agent change a live account in one step without approval.

How do I let Claude add negative keywords in bulk safely?

Describe the list, then review a preview that shows which negatives land in which ad groups or lists, with match types and a total count. Confirm, let the server execute, and have it read the result back. The confirm step is what keeps close-variant terms from silently blocking valuable traffic.

What can Claude do with the official server in practice?

Claude can answer any question that a GAQL query can answer: campaign performance, search terms without conversions, spend by device, keyword and match-type audits, budget pacing. It writes the query from your description and returns a table. It cannot act on what it finds, so changes still happen in the interface or through a separate write-capable setup.

What is the difference between Google Ads MCP and the Google Ads API?

The API is the full programmatic interface, including every write operation. The official MCP server is a thin read-only layer on top of it that exposes three tools to an AI client. MCP saves you the glue code for authentication and queries. The API gives you control over mutations and bulk work, with correspondingly more engineering and responsibility.

When should I use Google Ads Scripts instead of an MCP?

Use Scripts for scheduled, deterministic jobs that run without a human, such as a daily rule-based check. Use an MCP for conversational analysis and human-approved changes. Use the raw API when you build custom software and need full control over reads, writes and error handling.