Google Ads MCP: what Claude can read, and where it stops

What the Google Ads MCP is good for

Google's server (googleads/google-ads-mcp, version 0.0.5 of 9 October 2026, Apache 2.0) gives an assistant three tools: list your accounts, run a Google Ads Query Language (GAQL) query, and look up which fields exist (Google's guide). Requests that filter in the query work best:

• “Group last month's search terms in the Generic campaign by intent: competitors, job seekers, free and DIY, wrong product. Draft negatives. Don't apply anything.”
• “Which search terms spent over €150 in the last 30 days with no conversions?”
• “List every conversion action, whether it is primary, and its attribution model. Then write a one-page audit.”

Where the Google Ads MCP stops

1. An alert that isn't on point stops being read

Google can spend up to twice a campaign's average daily budget in a day (Google Ads Help; see how overspend works), and the server answers only when someone asks. You can schedule it. Claude Code's local Desktop tasks run while the app is open and the computer awake, and cloud tasks run at most hourly. A cloud run's status still shows “how the session ended, not whether Claude completed the work your prompt describes”, in Anthropic's words. Your own security policy can stop it too: in Google Workspace organisations that enforce session control, the local server's sign-in expires on a fixed cycle (commonly every 16 hours), after which every call fails until someone logs in again in a browser (issue 100, open).

Getting alerts right is hard even on simple campaigns, and very hard across channels, products and markets: each market needs its own baseline and season, and each alert needs the likely cause attached. An alert that misses often enough stops being read. Threshold alerts are simple to build; alerts a team keeps acting on are a different job.

A chat assistant also isn't deterministic. Five LLMs tested in 2024 at “deterministic” settings varied by up to 15% in accuracy over ten runs (Atil et al.). A performance marketer works through the causes in a fixed order, starting with tracking. You can write that order into a prompt or a skill, but nothing enforces it, so the assistant can stop at the first plausible cause and present it as the answer.

2. To act on Google Ads, you need a different tool with write access

Google calls the server “strictly read-only”: it “cannot modify bids, pause campaigns, or create new assets”, though a maintainer said in June 2026 that write tools are planned. Until then, acting on what the assistant finds means another tool with write access. Two are built for it:

• A third-party MCP server with a write token for your account. Connector vendors such as Supermetrics (in early access, with approval settings and revert) and Windsor.ai can pause campaigns and change budgets. What limits that token, and who approves each change, then decides your risk.
• Google's Ask Advisor (beta), inside Google Ads, which “will seek your approval before completing actions or making changes to your account” (Google). It works on Google's products only, and Google's help says it isn't available in manager (MCC) accounts.

In Claude, approval is set per tool: always allow, needs approval or blocked (Claude Help Centre). There is no way to say “budget edits up to +15% go through, larger ones wait”; Nupact sets guardrails per campaign and per action type instead, such as a maximum daily budget change.

Read-only also lives in the tool list alone. Google Ads has one OAuth scope, adwords, for reading and writing, and the server's source code says so: “Google Ads does not publish a separate read-only scope.” Any program running under your user account can use those credentials to edit the account, including a script the assistant writes in Claude Code. Only a Read-only Google Ads user behind the token prevents that, because the API “follows the same user roles that Google Ads supports” (Google for Developers).

3. At eBay, a test measured −63% where observational data showed +1,400%

The server returns Google's attributed conversions, which aren't the same as what the ads caused. In March 2012 eBay stopped its brand-keyword ads on Yahoo and Microsoft, keeping Google as the control. Almost all the lost clicks and attributed sales came back through natural search, and brand-keyword tests on Google confirmed it (Blake, Nosko and Tadelis, Econometrica 2015). On non-brand keywords, a geographic test on Google measured a short-term return of −63%, against over 1,400% from a regression on observational data with time and geographic controls. That is one well-known brand, measured over the short term. The error can also run the other way: on Meta, Haus found 7-day-click attribution under-crediting Meta. Any tool that reads platform-reported numbers inherits that gap. Nupact shows them next to numbers reconciled against your own attributed data or, where you’ve run them, incrementality test results.

Data-driven attribution is the default for most conversion actions (Google Ads Help). Switching an action to it, or changing which actions count as primary, moves credit between campaigns while orders stay the same. In a chat that looks like performance changing, and nothing catches it unless you compare with data Google doesn't control: your shop's orders first, then GA4 (why Google Ads and GA4 conversions differ). Smart Bidding bids on the same numbers (what you can still steer).

4. A drop on Google may not be Google's problem

The server sees Google Ads only. When Google, Meta and email all drop the same morning, the cause is usually shared: the site, checkout, tracking or demand. A drop on Google alone points to Google Ads first, conversion tags included. Your promotion calendar, stock plans and margins mostly live in your shop and ERP, outside Google Ads; Google sees product prices and availability only through Merchant Center. You can paste the rest into a chat, but that context is per chat and per person, and it goes stale.

5. Busy accounts outgrow the chat

The search tool returns every row a query matches, with no paging (source). Claude Code caps tool output at 25,000 tokens by default and saves text results over 50,000 characters to a file (Claude Code docs). By our calculation from the server's output format, a search-terms row with nine fields is about 300 to 350 characters, so past roughly 150 rows the result goes to a file. A busy account's monthly search terms can run to thousands of rows, and a summary of a partial read looks complete.

Watching every KPI this way means pushing raw rows through a model every day, which costs more as data grows, on the API or against a subscription's usage limits (Anthropic).

6. Monday's answer about Sunday is incomplete

For Sunday's data, Google's freshness table gives these times in London.

Figures are also restated days later, for invalid traffic, late conversions and billing adjustments. The model won't know unless the prompt says so.

7. The setup belongs to one person

The local server runs on one laptop with one person's credentials, and scheduled tasks, memory and chat history stay in that person's account. For an agency, one login with manager access reaches every client below it, and the model picks the customer ID on each query, so a long chat can answer about the wrong client. Google's README notes that the server exposes your data to the model you connect; check your AI plan's data terms before connecting client accounts.

Google Ads keeps two years of change history in the interface (Google Ads Help), and the API's change_event covers 30 days (change events). Both record what changed and who did it, while the reasons and the approval sit in someone's chat.

What it takes to run it

The server is free. Running it safely is a small project that someone then has to keep up.

Access after the developer token sunset

Google retired developer tokens on 9 September 2026. Access levels now belong to the Google Cloud project that owns your OAuth client (Google for Developers), and you apply on the Google Ads API Overview page in the Cloud Console.

Google for Developers, access levels (updated 19 October 2026) and developer token sunset.

• The GitHub README still has a developer-token step, marked optional. Google says you no longer need one.
• A project with Test access gets CLOUD_PROJECT_NOT_APPROVED_FOR_PRODUCTION on a live account. Apply for Explorer.
• Google lists a known issue: projects on the Google Cloud free trial, or with suspended billing, can be refused Explorer or Basic. In October 2026, users also reported Explorer applications from new projects rejected within seconds; a maintainer said Google was investigating and closed the issue as not specific to the server (issue 133).

How to connect Google Ads to Claude or ChatGPT

The local route needs a terminal and the Google Cloud CLI.

1. Prepare the Cloud project. Use one off the free trial, enable the Google Ads API, and apply for Explorer.
2. Create the credentials. Set up the OAuth consent screen (in Testing, add the assistant's Google account as a test user) and a Desktop app OAuth client. Sign in as a dedicated account with Read-only access (step 2 of the checklist below).

   gcloud auth application-default login \
     --scopes https://www.googleapis.com/auth/adwords,https://www.googleapis.com/auth/cloud-platform \
     --client-id-file=client.json

3. Claude Code. With pipx installed, add the server:

   claude mcp add google-ads \
     --env GOOGLE_PROJECT_ID=your-project-id \
     --env GOOGLE_APPLICATION_CREDENTIALS=/path/to/credentials.json \
     -- pipx run --spec google-ads-mcp==0.0.5 google-ads-mcp

4. Claude Desktop. In Settings, then Developer, then Edit Config, add the mcpServers block from Google's guide, then restart Claude.
5. Manager accounts. Add GOOGLE_ADS_LOGIN_CUSTOMER_ID with the manager's ID, then ask the assistant to list the client accounts under the manager.

Claude on the web, mobile and ChatGPT. Claude's custom connectors reach a server from Anthropic's cloud, so it must be on the public internet (Claude Help Centre). ChatGPT connects to remote servers, or to one on your machine through OpenAI's Secure MCP Tunnel (OpenAI Help). The usual route is Cloud Run:

• Create a Web application OAuth client with https://claude.ai/api/mcp/auth_callback or https://chatgpt.com/connector_platform_oauth_redirect as redirect URI, and the adwords scope on the consent screen.
• Deploy with the client ID and secret set. Google's guide uses --allow-unauthenticated and lets the server's OAuth check guard the service; without the OAuth variables, it warns, the container's service-account credentials are exposed to anyone.
• In Claude, add a custom connector under Customize, then Connectors (on Team plans only Owners can add one, under Organization settings, then Connectors), with your URL ending in /mcp and “Use your own OAuth client”.
• ChatGPT gives full MCP support to Business and Enterprise/Edu workspaces only; Pro gets read and fetch.

Eight controls to keep up

1. A separate Cloud project and OAuth client, so you can revoke the assistant alone.
2. A Read-only user. Give a dedicated Google account Read-only access in Google Ads, under Admin, then Access and security (access levels). It can run reports, and no tool holding its token can edit campaigns.
3. A narrow manager scope. Access at a manager reaches every client below it. Grant the assistant's account individual client accounts, or a sub-manager holding only those in scope, and agree it with each client.
4. A private credentials file, out of synced folders and repositories. When someone leaves, run gcloud auth application-default revoke or delete the OAuth client.
5. An updated, authenticated server. Versions 0.0.2 and 0.0.3 wrote users' Google access tokens to the logs when run over HTTP; 0.0.4 fixed it (root cause, fix). Three other bugs each made every query fail, in March, May and August 2026 (29, 74, 102). All are fixed, after someone noticed and updated. Self-hosted, keep the OAuth client set and limit who reads the logs.
6. Gated write tools. When Google ships them, leave them off in tools_config.yaml, or set them to “Needs approval” or “Blocked” in Claude (Claude Help Centre). Cloud scheduled tasks start in auto mode, where a classifier allows or blocks actions that would otherwise wait for your approval, so keep write tools out of unattended runs.
7. A decision log with the why behind every change, the data and who approved it. Our change approval policy template has a format to copy.
8. A re-sign-in date. With an external consent screen in Testing status, Google's refresh tokens expire after 7 days (Google Identity), and a scheduled check then stops silently. Make the app Internal if you use Google Workspace.

The tally: a Cloud project and OAuth client, an Explorer application, a Read-only user, a manager scope, a private credentials file, an updated server, gated write tools, a decision log you keep yourself, and re-sign-ins every 7 days in Testing or more often under Workspace session control, all maintained by whoever set it up. With every control in place you still have no baseline per market and season, no root-cause checks that run the same way every time, no shared record of who approved what and why, and no guardrails across channels. A large company can build those. It takes a machine-learning engineer, a backend engineer and a data engineer, then months of work with the marketing team to get the alerts and suggestions right, and maintenance after that. It’s a product, not a script one person writes in two weeks.

Short answers on the Google Ads MCP