Meta Ads MCP: what it does in Claude, and where it stops

What Meta's ads MCP server is

MCP (Model Context Protocol) is an open standard that lets AI assistants call outside tools. Meta launched its ads AI connectors in open beta on 29 April 2026: a hosted MCP server and a command-line tool. Since 16 July 2026 developers can also connect it through their own Meta app. Meta hasn't announced general availability.

• Hosted by Meta. One URL, https://mcp.facebook.com/ads, for every supported client. Nothing to install.
• Supported clients. ChatGPT, Claude, Claude Code and Perplexity, per Meta's Business Help Centre. Other agents connect through your own app.
• Size. Meta's developer documentation lists 86 tools, and the connector we checked exposed 100. Meta says to ask your agent which tools you have, because access rolls out by account.

Meta for Developers and Meta Business Help Centre, plus the tool list of a Claude connector, checked 24 October 2026. Tools change during the beta.

What the Meta Ads MCP is good for

It is strongest on questions one person asks while looking at the account, where a human reads the answer before anything happens. Requests like these work well:

• “Which ad sets spent over €500 last week with a cost per purchase above €40?”
• “Why has this ad stopped delivering?” The agent can read delivery status, learning stage and setup errors. Appealing a rejection still happens in Ads Manager.
• “What changed in this account in the last seven days, and who changed it?” This reads the same history as the Ads Manager campaign history page.
• “Which events in my dataset have weak match quality, and which should I fix first?”
• “Show me the ads competitors are running in Germany for running shoes.” The Ad Library is searchable from the chat.
• “Set up an A/B test of these two creatives in this ad set.”
• “Draft a prospecting campaign for Austria from this brief and leave it paused.”

For one advertiser on Meta alone, that covers much of the routine reading and drafting a media buyer does. For scheduled reporting into a sheet or dashboard, a data connector is still the better tool.

How to connect Meta Ads to Claude or ChatGPT

• Claude. In Claude's settings, add a custom connector with the URL https://mcp.facebook.com/ads, then sign in with Facebook and pick the business portfolios to share. Custom connectors work on every Claude plan, with one connector on Free (Claude Help Centre). On Team plans only Owners can add them; on Enterprise, Owners or members with a role that allows it.
• Claude Code. Run claude mcp add --transport http meta-ads https://mcp.facebook.com/ads, then sign in from /mcp.
• ChatGPT. In October 2026, OpenAI's help page limited full MCP use, including write actions, to Business, Enterprise and Edu workspaces, published by an admin. Pro gets read and fetch only, and the page doesn't mention Plus.
• Your own app. Add the use case for the ads MCP server to a Meta app. The minimum permissions are ads_mcp_management plus ads_read or ads_management (Meta's get-started guide). System-user tokens must have the Employee role; Admin-role tokens can't reach the server.
• Account access. The connector inherits your Facebook user's access to the portfolios you pick at sign-in, client accounts included, as Jon Loomer points out. Not every account is enabled yet; the agent can see which are.

Where the Meta Ads MCP stops

1. It runs when someone asks

The server has an anomaly tool, but it runs when the agent calls it. Nothing pushes an alert when spend spikes overnight or a pixel stops firing. Ads Manager's automated rules can pause or notify on thresholds you set, but they don't diagnose the cause, draft a fix or see other platforms.

You can schedule the assistant. Claude's cloud scheduled tasks run as often as hourly with connectors. Three things break in practice:

• A run can finish and still fail at the task. Anthropic's documentation says a green status “does not mean the work your prompt describes succeeded”.
• Sign-ins expire. Through your own app, a long-lived user token lasts about 60 days (Meta for Developers) and a system-user token doesn't expire on a timer. Meta doesn't document how long the hosted sign-in lasts. A check that stops quietly gives no warning that it stopped.
• Each run starts a fresh session with no memory of the last one.

Even on a schedule, the harder part is getting alerts right; on a simple account a threshold works. Across several channels, products and markets, an alert that is slightly off gets ignored. A chat assistant also varies from run to run: five 2024 models at “deterministic” settings varied by up to 15% in accuracy over ten runs (Atil et al.). Nothing makes it check every cause before it answers.

2. “Paused by default” protects new ads only

New ads start paused. In the connector we checked, draft mode was on: every edit except a pause on something already live waited as a draft until someone published it. The connector's own instructions say drafts are still rolling out by account. Without them, edits apply directly, and the server pauses any running campaign, ad set or ad it makes a non-trivial edit to, until someone turns it back on. The risk sits with things already running:

• A pause on a live campaign, ad set or ad applies at once.
• Budget, targeting and bid edits change delivery once published, and a significant edit can send an ad set back into the learning phase.
• Meta's Marketing API allows four budget changes per ad set per hour and blocks further changes for the next hour (rate limiting).

Meta's admin rules are the strongest control here. The server refuses a blocked action whatever the prompt says. They may start fully open: when Jon Loomer opened the panel in August 2026, his accounts allowed all seven actions: editing budgets, creating campaigns, ad sets and ads, and editing targeting, creative and status. Approval prompts protect less. Anthropic found that Claude Code users approve 97% of permission prompts.

3. The activity log has no reasoning

In the connector we checked, the activity log tool looks back three months by default. It shows each change, who made it and, where Meta records them, the old and new values. It doesn't record the reasoning, the data the agent looked at, or who approved it. Six weeks later, “budget raised 30% by a teammate” is all you have, and the chat that explains it sits in one person's history.

4. Big questions take many calls

In the connector we checked, the reporting tool defaults to the last 28 days and returns up to 1,000 rows per call, with a cursor for the next page. Account-level queries can't filter, sort or return cost per result; campaign and ad set queries can. A question across hundreds of ads and several months takes many calls, and the model decides when it has seen enough.

A wrong date range or a partial page, summarised as if complete, is how a confident wrong number gets into a report. In one documented test of Google's official GA4 server, the query used the wrong year and stopped at 1,000 rows, and the answer reported sessions up 35% when they had fallen (Coupler.io, which sells its own data connectors). Check any number you act on against Ads Manager.

Watching every KPI this way costs more as the data grows. Pushing raw rows for several markets through a model every day adds up on the API, and on a subscription each scheduled run draws down the same usage limits as your chats (Anthropic).

5. The numbers are Meta's, under Meta's attribution

In the connector we checked, results follow each ad set's attribution setting, as in Ads Manager, with no option to pick another window. Unless told otherwise, it also adds Meta's industry benchmarks and incrementality signals where available. Platform-reported conversions are not incremental results, and the gap runs both ways: across 663 Facebook experiments, observational estimates missed measured lift by a wide margin (Gordon, Moakler and Zettelmeyer), while Haus found Meta under-crediting itself on 7-day click (Haus). A change in how a platform credits conversions also looks like a change in performance unless you compare it with data the platform doesn't control, such as your shop's orders or GA4. See why Meta conversions don't match GA4.

6. Meta's tools include instructions to the model

The server tells the model how to behave. In the connector we checked:

• The ad set update tool tells the model to keep Advantage+ Audience on unless the advertiser explicitly asks to turn it off or needs a hard age limit or delivery only to a custom audience.
• Every call asks the model to send Meta your request in your own words, a task label, the model's name and a conversation ID, without names or contact details. Meta's public documentation does not mention these fields.

Both sit in the tool definitions, which is normal for a platform's own tool. The assistant works from Meta's view of how an account should run.

7. One platform, one person's setup

Meta's server sees Meta. Google publishes a Google Ads MCP server that is read-only, TikTok and Amazon run their own, and each counts conversions its own way. Moving budget from Meta to Google, or holding a monthly ceiling across all of them, needs something above the platforms.

The other channels are also how you read a drop. If conversions fall on Meta, Google and email at once, the cause is usually shared: the site, checkout, tracking or demand itself. If only Meta falls, start with Meta, including its pixel. Business context sits outside every ad account too: promotions, stock, price changes and margins. You can paste it into a chat or a project, but someone has to keep it current, and it lives in that person's setup.

Memory, scheduled tasks and approvals sit with whoever set them up; a scheduled task belongs to one person's account. For an agency it is sharper: one sign-in can reach many client accounts, so a long chat can act on the wrong client, and when a buyer leaves, their checks and chat history leave too.

8. Third-party servers and untrusted text

Meta's hosted server keeps your token with Meta. Self-hosted alternatives keep it on your machine. The open-source package meta-ads-mcp had three advisories in 2026 when run in HTTP mode, including a critical one that could leak the owner's Meta access token (CVE-2026-48039) and one that let a request with an arbitrary header value reuse it (CVE-2026-54547). All three were fixed by version 1.0.115. Keep any self-hosted server updated.

Ad accounts also hold text written by strangers: comments on boosted posts, competitor ads from the Ad Library, supplier catalogue feeds, landing pages. An agent that reads that text and can also write is open to hidden instructions, the attack researchers demonstrated against GitHub's MCP server in 2025. No case involving an agent managing an ad account has been published yet.

A safe setup in eight steps

1. Start read-only. Use the server for reporting and diagnostics first. With your own app, pair ads_mcp_management with ads_read, not ads_management.
2. Set Meta's admin rules. In Business Suite go to Settings, then Integrations, then Ads MCP server. Block the actions you don't want, such as “Create campaigns” or “Edit or set budget”, or block “Budgets set above this amount” (Meta's guide). If the menu is missing, your portfolio doesn't have it yet.
3. Connect one portfolio. Share only the accounts you own when you sign in. Ask clients before connecting theirs.
4. Gate the write tools in your client. In Claude's connector settings, set each write tool, including the one that publishes, to “Needs approval” or “Blocked” and avoid “Always allow”. On Team and Enterprise, Owners can enforce these settings for the whole organisation (Claude Help Centre). Claude's cloud scheduled tasks start in auto mode, where a classifier decides on actions that would otherwise wait for your approval (Anthropic). For anything unattended, leave the Meta connector out of the task or block its write tools, and rely on Meta’s admin rules.
5. Publish drafts on purpose. Review staged changes in Ads Manager before they go live, and treat any live pause as already done. If your account has no drafts yet, treat every edit as live, and expect an edited running item to pause.
6. Keep a hard stop outside the model. An account spending limit in Meta's billing settings holds whatever the agent does.
7. Write down the why. For every change: date, what, why, the data behind it and who approved it. Our change approval policy template has a log format to copy.
8. Check scheduled runs by their output. Have each run send its result where a person reads it, and put the token expiry in a calendar. Don't let one unattended run both read outside text and make changes.

Questions about Meta's ads MCP