C

Google Ads MCP

MCP server for Google Ads API — query ad data, retrieve resource metadata, and list accessible customer accounts

Overall Score60/100

Score Breakdown

Server Info

Package
google-ads-mcp
Registry
pypi
Maintainer
Community
Category
Marketing
Tags
advertisingppcgoogle
Last Scanned
7 Apr 2026

Findings

5 issues

Authentication & Identity

HIGHNo per-request auth - requires instance-per-user

Stdio-only transport via FastMCP. Auth uses Google Application Default Credentials (ADC) for OAuth with read-only adwords scope, plus GOOGLE_ADS_DEVELOPER_TOKEN env var (required). GOOGLE_ADS_LOGIN_CUSTOMER_ID is optional (for MCC accounts). No MCP OAuth or HTTP transport. For multi-tenant deployment, the platform must spawn a separate server instance per user.

Remediation

Add HTTP/SSE transport to accept per-request Authorization headers, or implement the MCP OAuth spec.

Tool Schema Quality

MEDIUMOnly 0 of 3 schemas have parameter constraints

Most schemas lack maxLength, enum, or pattern constraints on string parameters.

Remediation

Add constraints to string parameters, especially on write operations.

CRITICALDangerous execution surface: search: constructs raw GAQL queries from user-supplied fields, conditions, orderings, and resource params. String interpolation into query without parameterization.

Tool allows raw code/query execution which could be exploited via prompt injection.

Remediation

Use parameterized queries or validated command sets.

LLM Safety

HIGHTool descriptions contain instructional language

Descriptions include directives that could influence LLM behavior beyond tool selection.

Remediation

Remove instructional language. Descriptions should be purely factual.

Maintenance & Trust

LOWCommunity-maintained by Google LLC (googleads org)

No official vendor backing.

Remediation

Seek vendor verification.

Tools

3 total
NameDescriptionRisk
searchFetches data from the Google Ads API using the search method. Accepts customer_id, fields, resource, conditions, orderings, and limit parameters. Builds and executes GAQL queries.read
get_resource_metadataRetrieves the selectable, filterable, and sortable fields for a specific Google Ads resource. Use this tool to find out which fields you can select, filter by, or sort by when querying a specific resource (e.g., 'campaign', 'ad_group'). Do not guess fields, you MUST use this tool to discover them.read
list_accessible_customersReturns ids of customers directly accessible by the user authenticating the call.read

Deploy Google Ads MCP securely

CompleteFlow adds per-user authentication, permission scoping, and audit logging to any MCP server out of the box.

Deploy on CompleteFlow