Meta, Google and TikTok ads MCP servers: what an AI agent can change in your ad account

Which ad platforms have an official MCP server

Six ad platforms run an official ads MCP server as of October 15, 2026: Meta, TikTok, Amazon, Google, Microsoft Advertising and Snapchat. An ads MCP server is an ad platform's own bridge between an AI app, such as Claude or ChatGPT, and its advertising API. It is built on the Model Context Protocol, so the AI app can read reports or change campaigns by calling the server's tools. Our guide to what an MCP server is explains the protocol itself.

The six servers split on one question: whether the agent can change anything. Three of them write and three only read.

LinkedIn, Pinterest and Reddit are left out. None of them had a generally available official ads MCP server that this article could confirm on the platform's own pages on October 15, 2026. Third-party servers exist for all three, and the section on official and third-party servers below covers what that means.

What Meta's ads MCP server can do

Meta's ads MCP server lets an AI agent report on, create and change Meta campaigns, and its tool reference lists 86 tools in seven categories, 36 of which change something. Meta announced it in open beta on April 29, 2026, as part of Meta ads AI connectors, together with an ads command line interface. Meta's help page names ChatGPT, Claude, Claude Code and Perplexity as supported AI apps, and the announcement says the connection needs no developer credentials, API setup or coding. Meta's developer overview says the server works with any MCP-compatible AI agent.

The method behind the count: each distinct tool name on the seven pages was counted once, and a tool counts as a change when its name says create, update, delete, activate, boost, connect or disconnect. Meta says it keeps adding tools and that you can ask the agent which ones it has, so the live list can differ from the reference.

Three details matter before you connect an agent to Meta's server:

• New items start paused. Meta's ad creation reference says the write tools create campaigns, ad sets and ads in a paused state, and that the AI client asks for confirmation before activation. ads_activate_entity is the tool Meta describes as the one that starts spending budget.
• Existing items can still change. ads_update_entity updates fields on a campaign, ad set or ad that already exists, and ads_boost_ig_post turns an organic Instagram post into an ad.
• Audiences can carry customer data. ads_update_custom_audience_users adds or removes people on a customer list audience by uploading hashed personal data, so treat any customer list you give the agent as data you are sending to Meta.

Meta opened the server to any developer with their own Meta app on July 16, 2026. Meta's get-started page says such a token needs at least ads_mcp_management plus ads_read or ads_management, and that ads_management, catalog_management and other permissions unlock more tools.

How the Google, TikTok, Amazon, Microsoft and Snapchat servers differ

The other five official ads MCP servers differ most in who runs them and how you sign in: Google's is code you host, while TikTok, Amazon, Microsoft and Snap host their own.

Google Ads. The Google Ads MCP server is open-source Python that you run on your own machine or deploy to your own Google Cloud Run service. Google's page says it is strictly read-only and cannot modify bids, pause campaigns or create assets. Its three tools list the accounts you can reach, run Google Ads Query Language searches and describe a resource's fields. The page, last updated October 14, 2026, says developer tokens were sunset on September 9, 2026 and are no longer needed for the server, because API access levels now belong to the Google Cloud project. Claude and ChatGPT connect to a deployed copy as a custom connector over OAuth, and a hosted endpoint is in a pilot for allowlisted participants. The code's latest release, v0.0.5, came out on October 9, 2026.

TikTok. The TikTok for Business MCP Server is hosted by TikTok and loads around 400 tools at once from its full address, or around 40 core tools from its progressive address, with the rest found on demand. TikTok's help page says no developer credential, API key management or custom coding is needed. It describes agents that create campaigns, adjust budgets and pause ad groups, and it does not describe a per-account control for limiting what an agent may do. TikTok also runs an Agentic Hub, a marketplace of AI Skills for agents, and says listed solutions go through a review process.

Amazon. The Amazon Ads MCP Server entered open beta on February 2, 2026, for Amazon Ads partners with active API credentials. Amazon says agents can create, update or delete campaigns, run reports, manage account-level settings and read billing data. One of its tools builds a whole Sponsored Products campaign that, in Amazon's words, "only needs review and approval" before launch. Amazon's MCP overview gives raising a campaign budget as an example request.

Microsoft Advertising. Microsoft hosts its server, and its entity tools page says the tools never modify account data. The setup guide has you register your own Azure Active Directory app, then sign in with OAuth from Copilot Studio, GitHub Copilot in VS Code, ChatGPT or Claude. The server address in that guide requests a tool set named OpenBeta.

Snapchat. The Snap Ads MCP Server launched on August 3, 2026, hosted by Snap, with every connection read-only. An Organization Admin approves each AI app first, then each user authorizes it, and an agent cannot do more than the person connecting it is allowed to. Snap says write access will come in an upcoming release and will be granted per AI agent, so one organization could let ChatGPT write while Claude and Gemini stay read-only.

What Meta's WhatsApp Business Tools MCP does

WhatsApp Business Tools MCP is a separate Meta server that sets up WhatsApp Business messaging from an AI coding agent, and it does not run ads. Meta announced it on September 15, 2026. From a conversation, the agent can check Terms of Service status, create a WhatsApp Business Account, add and verify a phone number, register it for the Cloud API, create or edit message templates, send test messages and configure webhooks.

You sign in with Facebook Login for Business, and the server confirms you are an admin of the app before any tool runs. Meta says any tool that changes state needs an authenticated person rather than an app-level credential. The release is built for development and testing, not for production sending at scale, and Meta says it is rolling out gradually. Meta lists Claude, Codex and ChatGPT as the apps where it is discoverable today.

Meta now runs at least three MCP servers with different jobs. The ads MCP server manages campaigns. WhatsApp Business Tools MCP sets up messaging. Meta Social Technologies MCP, which the same announcement names, searches Graph API documentation and troubleshoots errors.

How to stop an AI agent overspending

The surest way to stop an AI agent overspending is to give it no write access. When it needs some, Meta's ads MCP server rules are the only server-side spending cap on the six platforms' pages read for this article. A rule denies one agent action on one ad account or catalog, according to Meta's rules guide.

Anyone with full control of a business portfolio sets rules in Meta Business Suite, under Settings, then Integrations, then Ads MCP server. Meta's help page gives the example of blocking any budget above USD 1,000. Since July 16, 2026, a Marketing API endpoint also sets the same rules from code, one call per rule for each ad account or catalog. A partner given access to an ad account can set rules that apply only to people in the partner business. The rules are in limited availability: Meta's guide says a business that is not enrolled gets an error from the endpoint, and the setting may not appear in Business Suite yet.

Five steps keep an agent's spending inside limits you chose:

1. Start read-only. Connect Google's, Microsoft's or Snapchat's server, or a Meta token without ads_management, until you trust what the agent reads.
2. Block what you will not automate. On Meta, set Create campaigns to Blocked and set a budget ceiling with an edit_budget rule.
3. Leave new items paused. Meta's write tools create campaigns paused, so activation stays a separate step that you confirm.
4. Keep confirmation prompts on. The MCP specification says there should always be a person who can deny a tool call. It also tells AI apps to treat a server's read-only and destructive labels as untrusted unless the server is trusted.
5. Check the record. Meta's activity log tool mirrors the Ads Manager campaign history, so you can see what an agent changed and when.

Official vs third-party ads MCP servers

An official ads MCP server is run by the ad platform itself, while a third-party server is run by another company, or by you, calling the platform's API under its own app's permissions. With a hosted official server, such as Meta's, TikTok's or Snap's, your sign-in goes to the platform. With a hosted third-party server, a vendor holds access to your ad account, so its approved permissions, its security and its logs become part of your risk. Google's official server is a third case: Google writes the code, and the credentials stay in your own Google Cloud project.

Meta also makes third-party use of its own server a reviewed step. Its July 16 developer post says an app that manages data for other businesses, such as an agency or a partner, must submit for App Review and request Advanced Access to the ads_mcp_management permission. Meta's help page says using its ads MCP server on its own does not put an account at risk. That statement covers Meta's server, not a third party's.

Before connecting any third-party ads MCP server, ask four things:

1. Who hosts it, and where your token is stored.
2. Which permissions its app holds on each platform.
3. Whether its write tools can be switched off.
4. Whether every tool call is logged where you can read it.

Our guide to why many ad tools can read campaigns but not change them explains the Meta permissions behind those answers.

Where overads fits

overads does not use any of these ads MCP servers, and its own MCP server cannot change an ad account. overads reads Meta, Google and Snapchat ad accounts read-only. In the App Review overads submitted on July 28, 2026, Meta approved ads_read and declined ads_management, and overads keeps write access off on every ad platform.

The overads MCP server, which ChatGPT, Claude and Claude Code reach by signing in to overads, has three ad tools: list_ad_accounts, get_metrics_summary and list_daily_metrics. All three are read-only, per the overads MCP tools reference, and a figure overads never received comes back as null, never as 0. The overads MCP setup guide covers the sign-in and API key options.

overads workflows draft posts and propose ad changes. A post a workflow writes waits for approval by default, and a person applies any ad change in the platform's own ad manager. The workflow templates show that pattern step by step.

What overads does not do:

• It does not create, pause or edit campaigns on any ad platform.
• It does not read TikTok, Amazon or Microsoft Advertising ad accounts.
• It does not wrap or resell Meta's, Google's or TikTok's MCP servers.

A team that wants an agent to build and launch Meta campaigns from a chat is better served by Meta's own server, with rules as the cap. A team that wants one platform's reports inside Claude or ChatGPT can use that platform's official server. overads fits a team that wants Meta, Google and Snapchat numbers read together, with every change waiting for a person, such as agencies reporting on clients' Meta ads.