Claude Code can operate your ad accounts. The question is what you let it touch.

You type one sentence: pull last week's search terms with spend over $50 and no conversions, and draft me a negative list. Seconds later Claude Code has queried the account, filtered the rows, and handed back a reviewed list, in the same terminal you would use to edit a config file. Type again and it stages the budget shift you asked for, ready to confirm. This is not a demo. It runs today, because two pieces finally clicked together: a standard way to give a language model access to a system, and ad platforms that expose that system through an API.

The standard is the Model Context Protocol (MCP), an open protocol for connecting AI models to the tools and data where your work lives. [2] Claude Code, Anthropic's command-line coding agent, speaks it natively and can connect to hundreds of external tools through it. [1] Point it at an ad platform and the assistant that drafted your campaign brief can now read the campaign, and, if you let it, change it.

The interesting part is not that this works. It is what the platforms decided to allow, and what they left for you to secure.

Before the guardrails make sense, the stack has to. There are three layers between your sentence and a changed account, and different people own each.

The whole safety question lives in layer two, and in the credential it carries. The API can do almost anything, and Claude Code will call whatever it is given. So the adapter you connect, and the token behind it, are the decisions that matter most, and the two platforms have made opposite ones.

Start where the risk is lowest and the value is immediate: reading. Reporting, anomaly-spotting, and cross-account analysis are safe to automate because the worst case is a wrong answer you can check, not a wrong charge you cannot undo. This is exactly the closed-loop, reversible territory where agents are already production-ready.

Google ships an official connector for precisely this. The Google Ads MCP server, published at github.com/googleads/google-ads-mcp, installs with a single pipx command and gives any MCP-compatible client read-only access to an account. [3] It exposes three tools, all queries: search to run a query, get_resource_metadata to return schema for resources like campaigns, and list_accessible_customers to list the accounts you can reach. It runs locally over standard input-output, so Claude Code launches it as a subprocess.

Wiring it in is a short entry in a .mcp.json file. Claude Code reads three scopes: local (just you), project (shared with your team through a committed file), and user (all your projects). [1]

{
  "mcpServers": {
    "google-ads": {
      "command": "pipx",
      "args": [
        "run", "--spec",
        "git+https://github.com/googleads/google-ads-mcp.git",
        "google-ads-mcp"
      ],
      "env": { "GOOGLE_ADS_DEVELOPER_TOKEN": "your-developer-token" }
    }
  }
}

Once connected, the agent works in the account's own query language, GAQL. You describe the report, Claude Code writes and runs the query, and reasons over the rows. The request that once took three screens becomes one line of intent behind this:

SELECT search_term_view.search_term, metrics.cost_micros
FROM search_term_view
WHERE metrics.conversions = 0
  AND metrics.cost_micros > 50000000
  AND segments.date DURING LAST_30_DAYS

One credential detail shapes how far this scales. A developer token at Test or Basic access runs up to 15,000 operations per day (any get or mutate request); Standard access lifts that to effectively unlimited. [4] For read-heavy analysis across a handful of accounts, Basic is usually enough to start.

The signal hiding in that read path is worth stating plainly: Google's own MCP server ships three tools, and every one of them is a query. [3] Read that as a design decision, not a limitation. The company that owns the data decided what an agent should get by default: look, do not touch. To spend money in Google Ads you will not use Google's connector. You build the write path yourself, which means you own the guardrails.

Writing is where the convenience gets seductive and the stakes change. A mutate action does not return a wrong answer you can catch. It spends a budget, pauses a winner, or ships a broken creative, at the speed of automation.

Here is the part that surprises people. Google Ads exposes one broad OAuth scope, adwords, described on the consent screen as "see, edit, create, and delete your Google Ads accounts and data." There is no read-only sub-scope, so a community MCP that only reports asks for the same all-powerful permission as one that can delete a campaign. Pipeboard, a hosted vendor, states that its Google integration requests that scope and lets an assistant "create or update campaigns." [8] Granting it is closer to adding an admin than wiring a reporting tool. The scope does the talking, not the tool's description.

That reframes the choice. There are two ways to give Claude Code write power, and they trade control against effort.

The fast one is to connect a write-capable server. A hosted option like Pipeboard's Meta Ads MCP exposes dozens of tools and skips the developer-app setup, and its defaults are safer than you might expect: it creates campaigns paused, so a human approves before spend starts. [8] But it holds the broad scope, and its safety model is the vendor's, not yours.

The slower one is to build your own mutate tools: thin, typed tools you write against the API and expose to Claude Code yourself. You still hold the broad scope, but you decide which actions exist, on which accounts, with what caps. It is the only path for Google Ads writes, and the honest choice for any account you cannot afford to have wrecked.

For Meta, the community ecosystem is where the writes live. Pipeboard's Meta Ads MCP runs as a hosted server and can launch campaigns, upload creatives, and update budgets through conversation, with every new campaign paused by default. [8] That is the posture to demand from any write-capable server. If you build your own path instead, keep write actions in narrow, separate tools that validate inputs and create changes paused, so the only things that can change are the ones you deliberately allowed. The scope alone will not stop the rest.

The two platforms differ in ways that decide how you wire each, and both move under your feet.

The versioning treadmill is real. Google moved the Google Ads API to a monthly release cadence starting with v23 in January 2026; the current version is v24, with v24.2 out on June 24, 2026, and older versions sunset on a schedule, v20 on June 10 and v21 on August 5, 2026. [5][6] Meta introduced Graph and Marketing API v25.0 in February 2026 and expires versions on its own clock. [7] Any integration is a maintenance commitment, an argument for a thin mutate layer you can update in one place rather than custom code sprawled across endpoints.

The subtler shift is strategic. The API is narrowing on the automated campaign types you might most want an agent to manage: as of Marketing API v25.0, Meta's legacy Advantage Shopping and App campaigns can no longer be created or updated through the API. [7] The platforms are steering their most automated products, the same push visible in Performance Max and Advantage+, toward goal-set control that you set and they run. Where that happens, the lever an agent can pull through the API gets shorter, and the setup you define matters more.

Do not assume the platforms will secure this for you. They are adding controls, but they guard a different door. Google now requires multi-factor authentication for new API tokens on the user-auth flow [10], and its new multi-party approvals cover account actions like user invitations and access-level changes, not the budget and bid moves an agent makes once authorized. [9] They harden who gets in. What an authorized agent does inside is still on you.

So build the write path like it can spend money, because it can. Turn the read path on this afternoon. Before you turn on the write path, work down this checklist, and treat the failures as blocking.

One control needs underlining: the server you trust. Claude Code's documentation warns to verify you trust each server before connecting it, because a server that fetches external content can expose you to prompt injection. [1] For a connector holding a scope that can delete campaigns, that is not boilerplate. It is the threat model.

So where does this leave the other ways to automate an account? Google Ads scripts still win the deterministic, scheduled, single-platform jobs. A workflow tool wins the fixed, repeatable pipeline. Claude Code with MCP wins the exploratory, conversational work: pull the data, reason about it, draft the change, stage it for a human, across accounts, in one terminal. Most teams run all three, each on the work it fits.

The honest position for 2026 is the same one that holds for every capable agent. The convenience is real, and you should take it: the reading alone saves your team hours a week, starting now. What has not changed is who is accountable when a budget moves. Keep a human on every write, wire the agent to the narrowest slice of the account it needs, and the account that gets wrecked this year will not be yours. It will be the one where someone mistook a plain-English sentence for a safe one.

Sources

1. Anthropic · Connect Claude Code to tools via MCPtransports (HTTP recommended, stdio local, SSE deprecated), installation scopes, OAuth via /mcp, per-tool permissions, and the trust and prompt-injection warning
2. Model Context Protocol · IntroductionMCP as an open standard for connecting AI models to tools and data
3. Google · Google Ads MCP serverofficial server, read-only by design; the three query tools (search, get_resource_metadata, list_accessible_customers) and the pipx install
4. Google for Developers · Access levels and permissible useTest and Basic access capped at 15,000 operations per day; Standard access effectively unlimited
5. Google for Developers · Google Ads API release notesmonthly cadence since v23 (January 2026); current v24, with v24.2 on June 24, 2026
6. Google Ads Developer Blog · Google Ads API v21 sunset reminderv21 stops serving requests on August 5, 2026; v20 sunset June 10, 2026
7. Meta for Developers · Introducing Graph API v25.0 and Marketing API v25.0v25.0 on February 18, 2026; legacy Advantage Shopping and App campaigns can no longer be created or updated via the Marketing API, extending to all versions by May 19, 2026
8. Pipeboard · Google Ads MCP: permissions and capabilitiesrequests the broad adwords OAuth scope ("see, edit, create, and delete"); write-capable ("create or update campaigns"); the Meta server creates campaigns paused by default
9. Google Ads Developer Blog · Multi-party approvals in the Google Ads APIsecond-admin approval added across versions for sensitive account actions such as user invitations and access-level changes, not campaign mutations
10. Google Ads Developer Blog · Multi-factor authentication requirement for the Google Ads APIMFA required for new OAuth refresh tokens on the user-auth flow, rolling out from April 21, 2026; service accounts unaffected

MS

Editor-in-chief

Mikołaj Salecki

Writes about media, tech, and AI business for people who actually run digital. Former agency lead. Skeptic of frameworks that read better than they perform.

LinkedIn ↗Facebook ↗

More articles →