The request flow
Nothing about this is magic, and it helps to know the sequence, because it explains both the speed and the limits.
- You describe an outcome
In plain language: an audit, a report, a change. You do not name a tool.
- The client picks tools
Claude reads the list of available tools and their parameters, and decides which ones can answer the request and in what order.
- MCP Ads calls the platform
The server calls the underlying platform API using your connected, scoped OAuth token. Your credentials never pass through the conversation.
- The result returns to the chat
Live data comes back into the same conversation, where Claude can analyse it, chart it, or use it to decide the next call.
Read tools and write tools
The distinction matters more than any other concept here, because it determines what can happen without your say-so.
| Read tools | Write tools | |
|---|---|---|
| What they do | Reports, account structure, audience insight, diagnostics | Create campaigns, adjust budgets, manage keywords and creatives |
| Share of the surface | The large majority of tools | A deliberately smaller set |
| When they run | Whenever they answer your question | Only when you ask for that specific outcome |
| Effect on spend | None. They change nothing. | Can change spend, which is why new campaigns start paused |
What authentication actually looks like
Each platform connection is a standard OAuth grant between you and that platform. MCP Ads holds the resulting token, encrypted, and uses it only to make the calls you trigger.
- You authorise on the platform's own screen — MCP Ads never sees your platform password
- Tokens are scoped to the permissions that platform grants, and are revocable per connection at any time
- The MCP endpoint itself is authenticated too: an unauthenticated request is rejected rather than answered
There is no API key to copy and no client secret to paste. If a guide anywhere tells you to put a secret into a config file for MCP Ads, it is out of date.
Safety boundaries
The design goal is that connecting the server extends what Claude can find out, without quietly extending what it can spend.
- Every action runs inside an account you explicitly authorised — never one you did not
- Deleting campaigns and removing budgets outright are not exposed as tools
- New campaigns are created paused by default, so a misread instruction cannot start spending
- Any connection can be revoked from your dashboard, which immediately invalidates the token