● Model Context Protocol
The Model Context Protocol turns an API into typed, permissioned tools an AI can call – but not abuse. Kepra uses it to close the gap between finding a profit leak and fixing it inside Meta and Google, with a human approving every write.
MCP exposes an API to a model as typed tools with validated parameters. The model decides which tool fits; it never composes the raw request – so a misplaced zero or a wrong account id is structurally impossible, not just unlikely.
Reading insights and pausing a campaign are different powers. Under MCP they are different tools with different permissions – reads run freely, writes carry an approval gate and hard bounds you set.
The AI proposes a specific change with its evidence. Nothing reaches your ad account until you approve exactly that change – a commitment in our terms, not a toggle. Every action is logged and revertible.
The actual surface – typed, scoped, gated
meta.campaign.pause(campaign_id)approval requiredmeta.adset.set_budget(adset_id, amount)approval requiredmeta.audience.create(spec)approval requiredgoogle.keyword.pause(keyword_id)approval requiredgoogle.campaign.set_bid(id, target_roas)approval requiredkepra.profit.query(range, dimension)read-onlykepra.leak.list(threshold)read-onlyEvery write is proposed by the agent, approved by you, executed over MCP, and written to an immutable audit log – with a one-click revert.
The agent pulls spend, insights and orders through read tools – no gate, because reading is how the case gets built.
The fix is a specific tool call with validated parameters – pause_ad_set(id), set_budget(id, amount) – never a free-form API request.
A proposal outside your limits – too large a budget, the wrong account – is rejected before any human ever sees it.
The exact call and its evidence wait in AI Actions. Approve and it executes in about a second; decline and nothing happened.
Approver, evidence, platform response, previous state. Revert is one click, and the record does not expire.
The question is never whether AI will touch ad accounts – it already does. The question is what stands between a bad idea and an executed one.
| Approach | What it can do | Failure mode | Approval | Audit |
|---|---|---|---|---|
| API keys in a chat prompt | Anything the key allows, composed freely | Hallucinated fields, wrong account ids, misplaced zeros – executed | None | None |
| Browser agent clicking the ads UI | Anything a logged-in human can | Misreads the page, clicks the wrong row, no record of intent | None | Screen recording, if you kept one |
| Platform automation rules | Only the trigger you wrote | Rules drift silently as the account changes | None once enabled | Platform change history |
| MCP: typed tools + approval | A fixed tool surface, bounded by limits you set | A bad proposal – which stops at the approval step | Every write, per call | Approver, evidence, response, one-click revert |
Shopify and Stripe are read-only sources – there is nothing there an agent should write to. The action happens where the money is spent.
The Model Context Protocol is an open standard, introduced by Anthropic in 2024, for connecting AI models to external systems through typed tools. Instead of generating raw API calls, a model calls named tools with validated parameters – and each tool carries its own permissions.
Because ad accounts are where AI mistakes cost real money in real time. A hallucinated field in a CRM update is an annoyance; a hallucinated budget on a live campaign is a bill that arrives before anyone notices. Typed tools remove the failure mode, and the approval gate catches what judgement can still get wrong.
No. Rules execute what you already decided, on triggers you already wrote. Here the AI does the analysis – profit after COGS, matched orders, repeat behaviour – and proposes what deserves changing. The deciding stays with you.
Meta Ads and Google Ads – the two platforms where verdicts lead to actions. Shopify and Stripe are read-only data sources; there is nothing there an agent should write to.
Kepra is in private development. The demo is open without signup and shows the full loop on sample data – analysis, proposal, approval, execution. The waitlist is the way in when access opens.
