Google Ads + Claude or ChatGPT via MCP: what's safe
What connecting Google Ads to Claude or ChatGPT through MCP allows, where the risks are (write access, prompt injection, tokens), and a safer setup.
On this page
Connecting Google Ads to Claude or ChatGPT through MCP (Model Context Protocol) is safe for reading data and risky for changing it. An assistant saying "yes, done" should never be what approves a change to your spend.
What MCP is, briefly
MCP is an open protocol that lets AI applications call external tools. An MCP server exposes tools (say, "get campaign performance" or "add negative keywords"), and an MCP client, such as Claude, ChatGPT, Cursor or an always-on agent, decides when to call them.
The useful part: reading
Ask in plain language, get answers from your real numbers:
- "Which search terms spent more than $50 last month with no conversions?"
- "Why did CPA rise on the brand campaign this week?"
- "Compare PMax channel spend for the last two months."
The risks are modest but real: answers depend on the data the tool returns, models can misread a table, and queries consume API quota. Verify anything you'll act on.
The risky part: writing
Prompt injection from your own data
Search terms, competitor ad text, product feeds and landing pages are written by other people. A model that reads instructions inside them may follow them. Assume anything it reads from the account could try to steer it.Confirmation dialogs aren't approvals
An ”allow this tool call?” prompt shows a tool name and some parameters, not current vs. proposed settings, the evidence or the expected effect. An always-on agent may run with nobody watching. Approval belongs somewhere that shows the full change and records who approved it.Tokens with too much reach
A token that writes to every account under a manager, never expires and sits in a local config file is a lot of power in one place. Scope tokens to the accounts and actions you need, and make them revocable.
One misunderstood sentence
Worked example”Bring remarketing back to normal, it was at two hundred”
The numbers are illustrative, not real account data. An assistant with write access reads "200" from the wrong column and sets the daily budget to $2,000 instead of $200.
| Intended | What happened | |
|---|---|---|
| Daily budget | $200 | $2,000 |
| Maximum spend on a single day | Up to $400 (Google can spend up to 2× daily budget) | Up to $4,000 |
| Noticed | - | The next morning |
If the campaign ran up to the new limit overnight, one misread number costs thousands. Setting the budget back stops further spend, but money already spent isn't recovered.
With proposals, the same sentence produces "Daily budget: $200 → $2,000 (+900%)", flagged against a budget-change limit. Nobody would approve it.
A safer setup, step by step
Start read-only
Most questions don't need write access.Scope access
One workspace or account set per token, read and propose as separate scopes, with expiry and revocation.Turn writes into proposals
The MCP tool creates a proposal and returns a link; nothing changes in Google Ads yet.Approve outside the chat
On a page that shows before and after, the evidence and the risk, bound to the exact change being approved.Set limits per change type
Maximum budget change, protected campaigns, quiet hours.Log every call
Including which client made it, so you can answer ”what did the agent do last Tuesday?”Keep GAQL read-only and bounded
If you expose free-form queries: parsed, limited by rows and date range, and checked against account permissions.
Questions to ask any Google Ads MCP server
- Can any tool change the account directly, without a separate approval step?
- Where is the approval recorded, and what does the approver see?
- How are tokens scoped, how long do they last, and how do I revoke one?
- What happens if a model tries to approve its own proposal?
- Is there a log of every tool call?