Read-only ads MCP: why it matters

What is an ads MCP server?

The Model Context Protocol is an open standard that allows AI models to connect to, and act on, external data sources and applications.² An MCP server exposes tools, and tools let a model interact with external systems, for example by querying a database or calling an API.⁵ An ads MCP server does that for an ad platform: it gives your assistant tools to list campaigns, pull a report or preview an ad and, on some servers, to create and edit campaigns too.

What does "read-only" mean for an ads MCP server?

In this guide it means the server's tool list contains no tool that creates, edits, pauses or deletes anything in the ad platform. Google's official Google Ads MCP server is built this way. Its documentation says it "is strictly read-only" and "cannot modify bids, pause campaigns, or create new assets",¹ and Google's launch post said the initial release can be used for reporting and diagnostics but will not make changes to your account.²

As of 2026-10-19, Hopkin, our product, is read-only for your ad accounts: it cannot pause a campaign, move a budget or edit an ad, and our homepage calls that "a genuine limit".¹²

We checked rather than asserted. Hopkin publishes its full tool manifest at hopkin.ai/docs/api/tools.json. It listed 216 tools across 9 servers (commit 9e9feae).¹¹ They break down like this:

We also scanned every tool name and description for create, update, pause, delete, edit, launch, publish and remove. It flagged 14 tools. We read each: 11 are connection or competitor-tracking housekeeping inside Hopkin (removing a connection, untracking an advertiser), and 3 are false positives where the word appears in a field name, a metric note or a filter note. None touches an ad platform. A keyword scan cannot prove absence, which is why the manifest is public: read it yourself.¹¹

Why does read-only matter?

Our argument, not a measured finding: permissions are the part of an agent's design you can fix before anything goes wrong, and an ad account is an expensive place to learn that.

Tools you do not need are risk you do

OWASP's Top 10 for LLM applications calls this Excessive Agency: the vulnerability that lets damaging actions happen in response to unexpected, ambiguous or manipulated model output, whatever caused the model to malfunction.³ Among its examples is an agent meant to read documents that is handed an extension able to modify and delete them, and one of its mitigations is to limit extension functions to the minimum necessary.³ An assistant whose job is to explain last week's CPA needs read tools. A pause button is surplus functionality.

Ad tools return text you did not write

Simon Willison's point about prompt injection is that language models cannot reliably distinguish the importance of instructions based on where they came from.⁴ In ad work, that bites when you ask an assistant to search an ad library: the tool returns ad copy written by whoever is advertising. By our reading, search terms and landing page copy can contain text you did not write as well. We did not search for documented injection cases in ad accounts and do not claim there are none.

Willison's "lethal trifecta" is access to private data, exposure to untrusted content and the ability to communicate externally.⁴ By our reading, Hopkin's tools bring the first two: your ad accounts are private data, and ad library results are untrusted text. The third leg is mostly a matter of what else you connect to the same assistant: add email or web tools and all three are present. Hopkin also has one narrow outbound channel of its own, a developer-feedback tool that sends free text to us. It is not an ad account write, but it is the kind of tool the trifecta is about, so a client that asks before calling it is worth having. What read-only removes is one costly outcome on the ads side: an injected "pause everything" has no tool to call. We think of that as limiting the blast radius, not as a defense.

A human in the loop depends on the loop

The MCP specification says there should always be a human in the loop with the ability to deny tool invocations.⁵ We suspect a confirmation prompt weakens as it gets more frequent. A server that can change money should ask only before the changes, so each prompt carries weight. A read-only server leaves no ad change to approve, though the advice to keep a human able to deny calls still applies to data leaving.

What do you give up with a read-only ads MCP?

The click is what you give up. The assistant can tell you which ad set broke your CPA and which campaign to pause, but you make the change. If you want an agent that changes things overnight, a read-only server is the wrong tool.

Write-capable servers exist: Pipeboard, for example, publishes tools to create, update and pause Google Ads campaigns (read 2026-10-19), with new campaigns created paused by default.¹⁰ Our view is that write access plus approvals plus narrow permissions is a legitimate design, not a reckless one. It fits when you have rules that must run unattended or a high volume of routine changes. Read-only fits when the slow part of your week is finding the answer across Meta, Google and LinkedIn rather than clicking the button, which we think describes most teams of one to five. We have no data on that, so test it against your own week.

Which ad tasks are fine with read-only?

Diagnosis, reporting and creative analysis. Anything that moves money stays with a person. This is our rule of thumb, not research: ask what a wrong answer costs and how soon you would notice.

How do you check that an ads MCP server is really read-only?

Our checklist, not a standard. An assistant telling you it cannot pause a campaign is a statement, not a test, so do not take the label on trust:

1. Read the whole tool list and the vendor's own words. Look for verbs that mutate: create, update, edit, pause, delete, set budget, and for a plain sentence about what the server cannot do, like Google's "cannot modify bids, pause campaigns, or create new assets".¹ Copy about "managing" your ads is a flag. Hopkin publishes its manifest; ask any vendor for theirs.
2. Treat annotations as hints. MCP lets a server mark a tool with a read-only hint, but the specification says all tool annotations are hints that are not guaranteed to describe the tool faithfully, and clients must treat them as untrusted unless the server is trusted.⁵⁶ Ours was wrong until recently: a bug in the script that builds our public manifest marked eight read-only ChatGPT Ads tools as not read-only, and we fixed it on 2026-10-19.
3. Check the scopes and the role. Meta lists ads_read as a requirement for the Ads Insights API (reporting).⁷ LinkedIn's docs say its Marketing APIs require rw_ads,⁸ and its conversion-tracking docs accept the read-only r_ads scope as an alternative,⁹ so a server that only reads has a read-only scope to ask for. LinkedIn also says a user with the Viewer ad account role is read-only even with the rw_ads scope,⁹ so connecting through a read-only role is a second lock there; whether a given vendor's server works with a Viewer connection is a question to put to them. If a server asks for write scopes, ask why. (All read 2026-10-19.)
4. Test on a throwaway account. Compare the tool list your assistant reports with the vendor's manifest, then ask it to pause a test campaign. A refusal alone is not proof, because an assistant's description of its own tools is not evidence; check the account afterwards.

On that third check: as of 2026-10-19, Hopkin requests no write scopes, and its tool list has no tool that writes to an ad platform.¹¹ You can read the tool list yourself.

How does Hopkin handle this?

Meta, Google, LinkedIn, Reddit and TikTok connect through OAuth, and per our docs the platform tokens are stored encrypted and refreshed automatically.¹³ ChatGPT Ads connects with an API key scoped to one ad account. You can remove a connection in Hopkin at any time, but per our tool descriptions that does not revoke the OAuth grant at the platform, and they point to disconnecting via the dashboard.¹¹ To be sure the grant is gone, also remove Hopkin under the platform's own connected-apps settings (our advice, not a tool description). For ChatGPT Ads, delete the API key in ChatGPT Ads. Campaign and creative records are cached so answers come back fast, while performance metrics are fetched live each time and not kept.¹² Hopkin covers Meta, Google, LinkedIn, TikTok, Reddit, Mailchimp, Google Search Console, Google Analytics 4 and ChatGPT Ads,¹¹ and works with Claude, Notion Custom Agents or any MCP-compatible assistant.¹² Setup is in the getting started guide; authentication details are in the authentication docs.