Google's Ads MCP server is read-only, so agents get write access from vendors first

Google has published an official MCP server for Google Ads, and the notable thing about it is everything it refuses to do. The integration guide in the Google Ads API developer toolkit, last updated 19 August 2026, describes a Python server that speaks the Model Context Protocol over standard input/output and authenticates with OAuth 2.0 or a service account. It hands a language model exactly three tools: list_accessible_customers, search for running Google Ads Query Language reports, and get_resource_metadata for inspecting which fields a resource such as a campaign carries. Google sets the ceiling itself: the implementation is "strictly read-only. It cannot modify bids, pause campaigns, or create new assets."

The specification sheet carries the interesting detail. Mode is listed as read-only, followed by a parenthetical — current release. That says where Google chose to begin, not where it intends to stop. It also means the platform owner has arrived at the agentic party with the write path deliberately switched off, while third-party connectors that can both read and write have been shipping for months.

What Google released, and what it did not

Two things landed within days of each other. The MCP server is plumbing: install it from Google's repository, point Claude, ChatGPT or another MCP host at it, and ask about spend, campaign status and budgets in plain language instead of building glue code around the API. Nothing it does can mark an account.

Separately, on 2 September, Google announced three agentic additions to Ads Advisor, the AI agent inside the Google Ads interface: proactive policy troubleshooting that scans the account and site and confirms a fix before you appeal, round-the-clock account monitoring with a security insights dashboard flagging things like dormant users, and automated business certifications built with Gemini. Google says these arrive "in the coming months", that Ads Advisor is available to all English-language accounts globally, and that it "will ask for approval before taking action in your account."

Together the two releases describe a deliberate split. Inside the interface Google will let an agent act, because an agent confined to an interface can only press buttons that already exist and its changes land in the account's change log like anyone else's. Outside the interface, where an agent calls the API directly, Google has so far shipped reading only.

The failure mode is silence, not error

Frederick Vallaeys, writing at Search Engine Journal, describes practitioners who now run a morning across several accounts without opening Google Ads — asking an agent what yesterday cost, having it pause the ad groups that overspent, then having it draft the client note. Vallaeys is chief executive of Optmyzr, whose connector he cites as a third-party server that reads and writes, so read the column as an informed vendor's account rather than a neutral one. The risks he catalogues still matter, because none show up in the reporting you already run.

Three are acute for a small software marketing team. A model calling a strict API can hallucinate the shape of a request rather than its content, and a shape error does not produce a small mistake — it produces a wrong batch, at scale, in one call. State stops being visible: a keyword added in an interface is a row you can check a fortnight later, while in a chat it is a line in a transcript that has scrolled away. And scheduled agents fail without telling anyone, because a report that stops arriving is invisible in a way that a report full of errors is not. Vallaeys draws the parallel to AdWords Scripts in 2012, when governance — libraries, version control, failure alerting — turned up years after the capability, and the losses lived in that gap.

You can re-run a report. You can't re-run yesterday.

That line is his, about a Quality Score script that died against an execution limit and took data with it that existed nowhere else. Agentic ad operations rarely break loudly; they stop, or they drift, and the cost is the weeks before anyone notices.

What this changes for a software marketing team

Paid acquisition at most B2B software companies is owned by one or two people running a few accounts on a modest budget, which makes the agent pitch genuinely attractive: the analysis that eats a Monday morning really can compress into a prompt. The uncomfortable part is that the capability reaching you first is the one with the fewest guardrails. Google's server cannot break your account. The connector your agency or your ad tool ships can, and it got there earlier.

So the question is not whether to put agents on ad accounts, but which layer earns write access and when. Read-only has no downside worth arguing about — Google's own server is the zero-risk way to learn where a model gets confused about your account structure while being wrong is still free. Write access deserves the scrutiny you would give a new hire with billing permissions.

• Run a few weeks on Google's read-only server and log every question the agent answers wrongly. That list is your risk register.
• Keep the change log, not the chat transcript, as the record of what happened. If a change is not reconstructable from Google Ads itself, the agent should not have made it.
• Register every standing agent, scheduled task and connector — owner, scope, and a heartbeat so silence raises an alert.