Typed beats prompted
The Google Ads API is notoriously easy to get subtly wrong – resource names, micros, versioned fields. A typed tool carries none of that surface into the model's hands.
Google Ads MCP
AI that can act inside Google Ads – with a human on every write.
Google shipped its official Ads MCP server on 28 April 2026 and drew a hard line: three tools, GAQL queries, and no mutations at all. Not a technical limit – the API supports writes fine – but a decision that AI should look and not touch. It is a defensible call, and it leaves the obvious question open. The analysis finds a keyword burning €8,400 on brand searches you already win. Something still has to go and pause it.
What is a Google Ads MCP server?
A Google Ads MCP server exposes the Google Ads API to an AI agent through the Model Context Protocol. Google's official server, released April 2026, is deliberately read-only: list_accessible_customers, search for running GAQL queries, and get_resource_metadata – enough to read every metric in an account, and nothing that can change one. A product-built server adds the other half: a small set of write tools, each bounded by limits you set, each executing only after a human approves that specific call.
Since April 2026, there is an official one
Google's official Ads MCP server.
Google's first-party server went the opposite way to Meta's. Three tools – list the accounts you can reach, run a GAQL query, look up a resource's structure – and not one of them can change anything. Google's own framing is that this is by design, not by limitation: the Ads API supports mutations through REST and gRPC, and Google chose to leave them out of the MCP surface entirely. If you want to read your account through an AI, it is excellent and you should use it.
- Shipped
- 28 April 2026
- Surface
- 3 tools and 4 resources
- Auth
- OAuth proxy or ADC, plus a developer token
- Access
- Read-only, by design
- Can it pause a keyword
- No – mutations are excluded
- Price
- Free
| Google Ads official | Kepra | |
|---|---|---|
| What it can do | Read every metric, budget and status in the account | The same reads, plus a bounded set of writes |
| Judges a campaign by | Whatever GAQL returns – Google's own conversion counting | Profit after COGS, refunds and fees, from matched orders |
| Acting on the finding | You do it yourself, in the Ads interface | One typed call, waiting for your approval |
| Risk of an unwanted change | Zero – nothing can be changed | A bad proposal, which stops at the approval step |
| Across platforms | Google only | Google and Meta judged against one order book |
| Setup | A developer token and OAuth of your own | Connect the account once; no token to manage |
When theirs is the right answer
Google's read-only stance is the honest version of the same worry that produced our approval gate: an agent with write access to a live ad account is a real risk, and pretending otherwise sells something. We disagree on the conclusion. Removing writes does not remove the change – it moves it back to a human copying a recommendation into the interface by hand, which is where transcription errors live. A typed call with hard bounds and a named approver is the safer version of the thing that was going to happen anyway.
Kepra’s surface, in full
Five tools. That is the point.
Against the official server’s breadth, this is deliberately narrow – a small surface is a security feature, because every tool the agent does not have is a mistake it cannot make. Reads run freely; that is how the case gets built. Writes wait for you.
| Tool | Access | What it does |
|---|---|---|
| get_campaigns | read | Campaign and ad group structure, status and budgets |
| get_search_terms | read | The queries that actually triggered your ads – where brand waste shows up |
| get_spend | read | Cost per campaign, ad group and keyword over any window |
| pause_keyword | write · approval | Stop one keyword – the classic fix for paid brand cannibalisation |
| set_campaign_budget | write · approval | Change a daily budget, bounded by limits you set |
Writes wait for you
The AI can read search terms all day. The moment it wants to pause the keyword buying your own brand name, it writes a proposal with the evidence – and waits.
Logged and revertible
Every executed call stores who approved it, the numbers cited, Google's response and the previous state. One click puts it back.
One verdict, end to end
How one call travels through the tools.
This is the demo’s own Google Ads verdict, followed from the first read to the log entry – real numbers, no hypotheticals.
- 01
The read tools build the case
get_search_terms and get_spend pull 30 days on the keyword "løbesko": €8,400 spent, healthy click volume, conversions reported by Google.
- 02
Orders tell a different story
Matched against real orders the keyword produced €0 in profit – the conversions land on brand searches you already win organically. Google counted them; the order book already owned them.
- 03
The verdict is written, with its evidence
The proposal names one call – pause_keyword – and attaches the spend, the matched orders and the overlap with organic brand traffic.
- 04
You approve, or you do not
The exact call waits in AI Actions. Nothing reaches the account until a human approves this specific change.
- 05
Execution, log, undo
On approval the call executes against the Google Ads API in about a second. The log stores who approved it, the numbers cited, Google's response and the previous state – revert is one click.
The honest comparison
MCP vs Ads scripts vs automated rules.
Different jobs, not just different quality – which is why the comparison has columns instead of a winner’s podium. Some accounts run all three.
| MCP + approval | Ads scripts | Automated rules | |
|---|---|---|---|
| Who writes the logic | The profit engine – COGS, matched orders, repeat behaviour | You, in JavaScript, against a versioned API | You, in a form, one trigger at a time |
| Sees COGS and repeat rate | Yes, from Shopify and Stripe | Only if you build and maintain a data pipeline | No |
| Human approval | Every write, per call | None once scheduled | None once enabled |
| Maintenance | None on your side | Scripts rot as API versions retire | Rules drift silently as accounts change |
| Audit trail | Full: approver, evidence, response, one-click revert | Google's change history | Google's change history |
The loop, on Google Ads – from the demo
◆ The loop, on Google Ads
Google Ads → Kepra
K
Reading
spend + matched orders
Deciding
profit after COGS and LTV
Your call
nothing moves until you say so
Pushing
executed over MCP, logged
Verdict: The keyword "løbesko" has spent €8,400 in 30 days for €0 profit – the clicks convert on brand searches you already win.
Pause keywordawaiting your approval
Stated limits
What it refuses to do.
A system that only claims wins is a brochure. These are the boundaries, stated as plainly as the features.
- It never executes a write without a human approving that specific call.
- It cannot spend outside the bounds you set – budget tools carry hard limits enforced before the approval step.
- It does not write ads, build campaigns or edit landing pages. Pausing and budgets cover what profit verdicts call for.
- It does not take Google's conversion counting at face value. Brand-search spend is judged on incrementality logic – would that customer have arrived anyway – not on last-click credit.
Fair questions.
▸What is a Google Ads MCP server?
A server that exposes the Google Ads API to AI agents as typed tools over the Model Context Protocol. Google's official one, released 28 April 2026, gives three read tools: list_accessible_customers, search for GAQL queries, and get_resource_metadata. Product-built servers such as Kepra's add write tools – pause a keyword, change a budget – each bounded by limits you set and each requiring human approval per call.
▸Does Google have an official Ads MCP server?
Yes, since 28 April 2026, and it is read-only on purpose. It can read every metric, budget and status in an account and cannot pause a campaign, change a bid or create an asset. That is a policy decision rather than a technical one – the Google Ads API supports mutations through REST and gRPC. Meta went the other way a day later, shipping 29 tools with write access.
▸If Google's server is read-only, how does anything get changed?
By hand, which is the part worth thinking about. Read-only moves the write back to a person retyping a recommendation into the Ads interface – no bounds, no record of what the AI actually proposed, and every transcription error still available. Kepra's answer is a narrow set of typed write tools with hard limits, where the change executes only after a named human approves that exact call, and the log keeps the previous state for a one-click revert.
▸What is the most common fix it proposes on Google Ads?
Pausing keywords that buy traffic you already own – brand searches converting through paid clicks that would have arrived organically. The demo's verdict is exactly this: a keyword that spent €8,400 in 30 days for €0 in profit.
▸Does it change my campaigns on its own?
No. Reads run freely; writes stop at an approval naming the exact change. The commitment is contractual, not configurable.
▸Can I use Kepra's Google Ads MCP today?
Kepra is in private development. The demo shows the full loop on sample data, and the waitlist is the way in when access opens.
▸How is this different from Google Ads scripts or rules?
Scripts automate what you already decided; they cannot weigh COGS, repeat rates and matched orders to decide what deserves changing. Here the AI does the analysis and argues its case – and you stay the one who decides.
▸Is an AI agent safe on my Google Ads account?
Through typed tools, yes: the agent cannot compose raw API requests, writes carry hard bounds and stop at a human approval, and every change is logged with one-click revert. The risky versions are API keys pasted into a chat, or a browser agent driving the Ads interface unsupervised.
▸Do I need to write code to use a Google Ads MCP?
No. That is the practical difference from Ads scripts: the tools exist already, the agent calls them, and your job is reading the evidence and approving or declining. Nothing to write, nothing to maintain when the API version rotates.
See the loop run on sample data.
The demo is open – no signup. AI Actions shows a proposal, the evidence, and the approval step exactly as it ships.
Also running Meta Ads? Meta Ads MCP →