AI agents and MCP servers for ad platforms: what they can do, and the controls they need.
Connecting an AI assistant to an ad account now takes an afternoon. Deciding what it may do there takes more thought. This guide explains what an MCP server is, what Google's own server for Google Ads allows today, where the risks specific to advertising lie, and which controls to put in place before an agent changes anything.
An MCP server, in plain terms.
The Model Context Protocol (MCP) is an open standard for giving an AI model access to outside systems. A server exposes a list of tools, each with a name, a description and the parameters it accepts; the model reads that list and decides which tool to call, with which values. The protocol describes tools as model-controlled: the model can discover and invoke them on its own, based on the conversation.
An agent is simply a model allowed to chain such calls towards a goal: read the campaigns, look at the search terms, propose something, and possibly act. The quality of the answer depends on the model. What it is able to touch depends entirely on the tools the server exposes and on the access behind them.
What the Google Ads MCP server allows today.
| What Google documents | What it means for you | |
|---|---|---|
| Tools | Three: list the accounts the user can access, run a query in Google Ads Query Language, describe a resource and its fields | An agent can report on anything the API can read, in answer to a question in plain words |
| Changes | “Strictly read-only” in the current release: it cannot modify bids, pause campaigns or create assets | With this server alone, an agent advises; a person still makes the change |
| Sign-in | OAuth 2.0 or a service account | The agent sees every account that identity can access, not only the one you had in mind |
| API access | The Cloud project needs the Explorer, Basic or Standard level | At Explorer, 2,880 operations a day: an agent that explores freely can use them up |
Read on 12 October 2026 from Google's page, which describes the current release. Other MCP servers for Google Ads, published by third parties, may expose tools that make changes: read their tool list before connecting them.
Four risks that are specific to advertising.
A change costs money at once
An agent editing a document can be corrected tomorrow. A budget raised or a match type broadened spends from the next auction, and the money does not come back.
A confident figure can be a wrong one
A model asked to summarise can recompute, round or mix periods. If the cost per conversion it quotes drives a decision, you need to be able to trace it back to the rows it came from.
Account data is text someone else wrote
Search terms are typed by strangers; ad copy and campaign names by colleagues or past agencies. An agent reads them as text, and text can contain instructions. Treat what the agent reads as data, never as orders.
Access is wider than the task
The identity you connect often reaches several accounts. An agent asked about one client can list, and read, all the others.
Seven controls to set before an agent acts.
The MCP specification itself says there should always be a human in the loop with the ability to deny tool invocations. Here is what that means in an ad account.
| Control | What to put in place | The question it answers |
|---|---|---|
| 1. Narrow access | Connect an identity that reaches only the accounts concerned; read-only tools unless writing is the point | What is the worst this agent could reach? |
| 2. A list of allowed changes | Name the change types permitted; everything else is refused | Can it do something nobody thought of? |
| 3. Limits in code | Caps on amounts and volumes enforced by the tool, not requested in the prompt | What if the model ignores its instructions? |
| 4. Confirmation by a person | Before any change, show the exact before and after and wait for a yes | Who agreed to this? |
| 5. Figures from code | Totals and ratios computed by a program from the rows read; the model writes the explanation | Can I trust this number? |
| 6. A record | Log each tool call with its inputs, who asked, and what was approved | What happened, three months later? |
| 7. A way to stop | Know how to withdraw the access in one step, and who may do it | How fast can we switch it off? |
Controls 4 and 6 echo the MCP specification, which asks clients to prompt for confirmation on sensitive operations, show tool inputs to the user and log tool usage. The list as a whole is ours.
Four stages, and no need to rush to the last.
- 01Read and explainThe agent answers questions from read-only tools. Risk: a wrong figure. Control needed: traceable numbers.
- 02RecommendIt proposes what to do, and a person does it in the platform. Most of the value, almost none of the risk.
- 03Prepare, with approvalIt writes the exact change; a person approves it before it is applied. Needs the list of allowed changes, the limits and the record.
- 04Act within limitsIt applies low-risk changes on its own, inside strict caps, and reports. Only for change types whose worst case you have measured and accepted.
Changes made by a tool appear in Google Ads change history as “Google Ads API” or under the tool's name, not under a person's. Without your own record, nobody will know who asked the agent.
Where Plireo stands on agents.
Plireo is being built on the third stage: the AI analyses and proposes, rules written in code decide whether a change may be prepared, and a person approves. Figures are computed by code and the model writes the explanation. Execution from Plireo is in development and is not enabled.
Connecting your own assistants and agents to Plireo through MCP is on the roadmap. Its status is shown below.
The capabilities concerned.
- Ask PlireoQuestions on a campaign, answered with evidence and stated uncertaintyIn progress
- Prepared changesExact changes, validated by Google without being appliedIn progress
- ApprovalsApproval bound to the exact change, with a written reason when a warning is openIn progress
- Audit recordAppend-only record of what was prepared, checked and approved in PlireoIn progress
- Execution by PlireoApplying approved changes, with safety controlsIn progress
- MCP for assistants and agentsConnect AI assistants and your own agentsPlanned
Frequently asked questions
Can an AI agent change my Google Ads campaigns?
It depends on the tools it is given. Google's official MCP server is documented as strictly read-only in its current release: it cannot modify bids, pause campaigns or create assets. A third-party or custom server may expose tools that make changes, with the access of the identity you connect.
Is a read-only agent safe?
It cannot spend your budget, which removes the main risk. Two remain: it can read every account the connected identity reaches, and it can state a wrong figure with confidence. Narrow the access and check figures that drive decisions.
Does the MCP standard require human approval?
It recommends it without enforcing it. The specification says there should always be a human in the loop with the ability to deny tool invocations, and that applications should present confirmation prompts. Whether that happens depends on the application you use and how it is configured.
What API access does an agent I build myself need for Google Ads?
If you build or host the agent yourself, the Google Cloud project behind it needs the Explorer, Basic or Standard access level to reach real accounts. At Explorer, the limit is 2,880 operations a day. If you use a product that manages API access for you, there is nothing to request.
Related pages
Be among the first to use Plireo.
Plireo is in pre-launch. Request early access to be told when it opens, or apply to take part in private testing. Access opens gradually, so a request does not mean immediate access.
Paid plans open once the Google Ads, Meta, GA4 and GTM integrations are operationally validated.
Request early access