Google Ads MCP: which servers exist, how to set one up and where the risks are

MCP (Model Context Protocol) is an open standard that lets an AI client call tools on an external server. A Google Ads MCP server wraps the Google Ads API into such tools. You ask "Which campaigns spent more than $500 last week without a conversion?", the model writes a GAQL query, the server runs it against your account and the answer comes back as a table.

There is one official server from Google and a growing number of alternatives. The main difference is write access: Google's server only reads, most hosted services can also change things.

Google's repository is actively maintained, with two releases in September 2026 alone (984 GitHub stars on 26 September). For a setup that should last, that matters more than the feature list.

Running Meta as well? The same comparison for Facebook and Instagram is in our Meta Ads MCP guide.

Google's server exposes three tools: search (runs a GAQL query), get_resource_metadata (tells the model which fields a resource such as campaign has) and list_accessible_customers (lists the accounts your login can reach). It also provides the API discovery document, the list of metrics and segments, and the current API release notes as resources. With a tools_config.yaml file you can switch individual tools off.

That is enough for most analysis work. Prompts that work well:

• Show every campaign with more than $300 cost and zero conversions in the last 14 days.
• List search terms with 20 or more clicks and no conversion, grouped by ad group.
• Compare CPA by campaign for this month and last month and sort by the biggest increase.
• Which Performance Max campaigns lost impression share because of budget?

What it cannot do: pause a campaign, change a bid or budget, add a negative keyword or create an ad. For many advertisers that limit is a feature. A model that misreads a report gives you a wrong answer, but it cannot spend your money.

Google sunset developer tokens on 9 September 2026. Your existing access level was moved automatically to your Google Cloud projects based on recent API activity. You can keep sending the token in the request header: the API accepts it but ignores it, so existing code keeps working. Google says it will start rejecting tokens in a future major API version. What counts now is the Cloud project that created your OAuth credentials.

For one person asking about one account, Explorer access is usually enough. That is our estimate: a chat session runs dozens of queries, not thousands. Agencies with many client accounts reach the limit sooner.

If the server reports that your access is only approved for test accounts, your Cloud project does not have production access yet. Request Explorer or Basic access for that project in the Google Cloud console.

You need a Google Cloud project, a Google login with access to the ad account, and Python with pipx.

1. Install pipx on your machine.
2. In your Google Cloud project, enable the Google Ads API.
3. Create an OAuth client of type Desktop app and download the JSON file.
4. Create Application Default Credentials with the Google Ads scope (command below) and note the file path gcloud prints.
5. Add the server to Claude Desktop in claude_desktop_config.json, or to Claude Code with claude mcp add.
6. Restart the client and ask: "List the Google Ads accounts you can access."

gcloud auth application-default login \
  --scopes https://www.googleapis.com/auth/adwords,https://www.googleapis.com/auth/cloud-platform \
  --client-id-file=client_secret.json

Configuration for Claude Desktop. The values are placeholders. Pinning the version makes sure an update to the repository does not change your server without you noticing.

{
  "mcpServers": {
    "google-ads": {
      "command": "pipx",
      "args": [
        "run",
        "--spec",
        "google-ads-mcp==0.0.4",
        "google-ads-mcp"
      ],
      "env": {
        "GOOGLE_APPLICATION_CREDENTIALS": "/path/to/application_default_credentials.json",
        "GOOGLE_PROJECT_ID": "your-cloud-project-id",
        "GOOGLE_ADS_LOGIN_CUSTOMER_ID": "1234567890"
      }
    }
  }
}

The same server in Claude Code:

claude mcp add google-ads --scope user \
  --env GOOGLE_APPLICATION_CREDENTIALS=/path/to/application_default_credentials.json \
  --env GOOGLE_PROJECT_ID=your-cloud-project-id \
  --env GOOGLE_ADS_LOGIN_CUSTOMER_ID=1234567890 \
  -- pipx run --spec google-ads-mcp==0.0.4 google-ads-mcp

Set GOOGLE_ADS_LOGIN_CUSTOMER_ID only if you reach the account through a manager account (MCC). Enter the manager ID without dashes. Without it, queries against client accounts under an MCC often fail with a permission error even though your login has access.

For teams, Google documents a second variant: the server runs as an HTTP service with an OAuth proxy, locally or on Cloud Run, and the credentials stay in the server process instead of client config files.

Yes, through developer mode. OpenAI lists it for Plus, Pro, Business, Enterprise and Education accounts on the web. ChatGPT only talks to remote servers over SSE or streaming HTTP. A local server started with pipx does not work there directly. You either run Google's server in HTTP mode behind a public HTTPS address, or you use a hosted option like Windsor.ai, Composio or Pipeboard.

OpenAI calls developer mode "powerful but dangerous" and warns about prompt injection and model mistakes on write actions. Writes ask for confirmation by default. Read the tool input before you confirm.

• Writes without review. "Cut the budget by 50" read as $50 instead of 50 percent goes live immediately unless something asks first.
• Broad login. The adwords scope covers every account your Google user can reach, including everything under a manager account. Use a login that only has access to the accounts you want the AI to see.
• Secrets in config files. Google notes that credentials in the client configuration are less isolated than in the HTTP variant. Config files get copied and synced.
• Prompt injection from account data. Search terms, ad text and landing page content are written by other people. A search term can contain instructions aimed at the model. Claude Code's documentation warns about exactly this for servers that fetch external content.
• Local code. A local server runs with your user rights, as the MCP security guide points out. Install from the official repository and pin a version.
• Where the data goes. Every query result goes to your AI provider. Check that your client contracts allow that.

A sensible order for most teams: start read-only, learn how the model reads your account, and only then decide whether you want writes at all.

An MCP server suits people who work in a chat window and are comfortable with OAuth clients and config files. It waits for your question. It does not watch the account at night or check later whether a change worked.

Marketing AIgency is not an MCP server. It is hosted software from CBX Media LLC. AI agents check Meta, Google and TikTok ad accounts, look at the numbers before they suggest anything, and put every proposal with its reasoning into an approval queue. Only what you approve is executed, and you can set single action types to autonomous within limits. New accounts start in shadow mode, where nothing runs until you want it to.

The target metric matters more than it looks. A connected-car app has been steering its ads with the same agent system since 14 September 2026, in nine markets on Meta, Google and TikTok, with around €470,000 in monthly ad spend. In Germany in September 2026, Google Ads alone reported €31.3k in revenue while the company actually made €23.4k. Across all three platforms, the reported revenue added up to 2.2 times the real figure. Why that happens is covered in our guide to true ROAS.

To be clear about the current state: Meta is fully live. Google Ads connects the same way and is being tested with the first accounts. Building new campaigns works on Meta only for now. If you need Google Ads write automation today and want full control, a self-hosted server with a strict review habit may suit you better. Weighing software against an agency? See what a Facebook ads agency costs.