● Model Context Protocol
The Model Context Protocol turns an API into typed, permissioned tools an AI can call – but not abuse. In April 2026 Google and Meta both shipped official ones and disagreed about writes. Neither can see what your products cost. Kepra adds the missing layer: profit after COGS as the judge, and a human approving every write.
MCP exposes an API to a model as typed tools with validated parameters. The model decides which tool fits; it never composes the raw request – so a misplaced zero or a wrong account id is structurally impossible, not just unlikely.
Reading insights and pausing a campaign are different powers. Under MCP they are different tools with different permissions – reads run freely, writes carry an approval gate and hard bounds you set.
The AI proposes a specific change with its evidence. Nothing reaches your ad account until you approve exactly that change – a commitment in our terms, not a toggle. Every action is logged and revertible.
The disagreement is the interesting part. Both companies looked at the same question – should an AI be allowed to change a live ad account – and reached opposite conclusions in the same week. Neither answer is wrong. Both are incomplete for the same reason.
What both are missing
A campaign reporting a 2.8 ROAS can still lose €5,200 a month once the products are paid for. Neither official server can know that, because neither can see an order book – they are single-platform by design, and their verdict is the platform’s own numbers grading the platform’s own homework. That is the layer Kepra adds, and the reason its write tools stop at a human: a change worth making is worth someone putting their name on.
These two are also the only platforms Kepra writes to. Shopify and Stripe are read-only sources – there is nothing there an agent should change. The action happens where the money is spent.
The actual surface – typed, scoped, gated
meta.campaign.pause(campaign_id)approval requiredmeta.adset.set_budget(adset_id, amount)approval requiredmeta.audience.create(spec)approval requiredgoogle.keyword.pause(keyword_id)approval requiredgoogle.campaign.set_bid(id, target_roas)approval requiredkepra.profit.query(range, dimension)read-onlykepra.leak.list(threshold)read-onlyEvery write is proposed by the agent, approved by you, executed over MCP, and written to an immutable audit log – with a one-click revert.
The agent pulls spend, insights and orders through read tools – no gate, because reading is how the case gets built.
The fix is a specific tool call with validated parameters – pause_ad_set(id), set_budget(id, amount) – never a free-form API request.
A proposal outside your limits – too large a budget, the wrong account – is rejected before any human ever sees it.
The exact call and its evidence wait in AI Actions. Approve and it executes in about a second; decline and nothing happened.
Approver, evidence, platform response, previous state. Revert is one click, and the record does not expire.
The question is never whether AI will touch ad accounts – it already does. The question is what stands between a bad idea and an executed one.
| Approach | What it can do | Failure mode | Approval | Audit |
|---|---|---|---|---|
| API keys in a chat prompt | Anything the key allows, composed freely | Hallucinated fields, wrong account ids, misplaced zeros – executed | None | None |
| Browser agent clicking the ads UI | Anything a logged-in human can | Misreads the page, clicks the wrong row, no record of intent | None | Screen recording, if you kept one |
| Platform automation rules | Only the trigger you wrote | Rules drift silently as the account changes | None once enabled | Platform change history |
| The platform's own MCP connector | Google: read only. Meta: read and write, 29 tools | Judges on the platform's own numbers – your COGS is invisible to it | Google: nothing to approve. Meta: new entities start paused, live edits do not wait | The platform's change history |
| MCP: typed tools + approval | A fixed tool surface, bounded by limits you set | A bad proposal – which stops at the approval step | Every write, per call | Approver, evidence, response, one-click revert |
The Model Context Protocol is an open standard, introduced by Anthropic in 2024, for connecting AI models to external systems through typed tools. Instead of generating raw API calls, a model calls named tools with validated parameters – and each tool carries its own permissions.
Both, since April 2026, and they disagree. Google released a read-only server on the 28th – three tools, GAQL queries, no mutations at any point, by design rather than by limitation. Meta released Ads AI Connectors on the 29th: 29 tools with read and write access behind a Business OAuth login, no developer app and no app review. TikTok followed in May. All three are single-platform by design.
Because neither official server can see what your products cost. They read the platform's own numbers and report the platform's own verdict – a campaign at 2.8 ROAS looks healthy right up until you subtract COGS, refunds and processor fees and find it losing money. Kepra judges the same campaign against your actual order book, across Meta and Google at once, and puts a human approval in front of any change that follows.
It has one real guardrail: entities it creates land paused, so a new campaign cannot start spending unattended. That covers creation, not change – raising a budget on a live campaign or pausing a running ad set executes the moment the agent calls the tool. Whether that is acceptable depends on how much a wrong call costs you and whether anyone would notice before the day's spend was gone.
Because ad accounts are where AI mistakes cost real money in real time. A hallucinated field in a CRM update is an annoyance; a hallucinated budget on a live campaign is a bill that arrives before anyone notices. Typed tools remove the failure mode, and the approval gate catches what judgement can still get wrong.
No. Rules execute what you already decided, on triggers you already wrote. Here the AI does the analysis – profit after COGS, matched orders, repeat behaviour – and proposes what deserves changing. The deciding stays with you.
Meta Ads and Google Ads – the two platforms where verdicts lead to actions. Shopify and Stripe are read-only data sources; there is nothing there an agent should write to.
Kepra is in private development. The demo is open without signup and shows the full loop on sample data – analysis, proposal, approval, execution. The waitlist is the way in when access opens.