How to verify an ads MCP server is really read-only

What does "really read-only" mean?

We use three levels, and only the last two count as evidence:

• Declared: the vendor's page, the README or the assistant says the server cannot change anything.
• Technical: the server has no tool that writes, and the credential or the role it connects with could not write even if it tried.
• Behavioral: you used it, and the ad platform's change history shows nothing it did.

Declared and technical can drift apart in a day. Google's official Google Ads MCP server is the current example. Its documentation, updated 2026-10-30, says: "This implementation is strictly read-only. It cannot modify bids, pause campaigns, or create new assets."⁴ On 2026-11-02 the repository's main branch merged tools that create assets, upload videos and create, update and remove labels, and they are enabled by default.⁵⁶ None of them pauses a campaign or changes a bid, and each write goes through a validate-first, confirm-second flow.⁵ But the install command in Google's docs runs the code on the main branch,⁴ so by our reading a fresh install today has write tools while the docs page still says it has none. Nobody did anything wrong here. It is just why the label is not the test.

How do I check that an ads MCP server is really read-only?

Seven checks, in the order we would run them. The order is ours, not a standard; the sources behind each check are cited.

1. Read the tool list, not the marketing page

   Your MCP client can show the tools a server exposes. Under the MCP specification, a server answers a tools/list request with the tools currently available to that client, and it can announce when the list changes.¹ Read every name, description and input schema. Writes hide in parameters as often as in names: update_campaign is obvious, a manage_labels tool with an action field is less so, and a status, daily_budget or bid field on any tool is a flag. Then compare the list with what the vendor's page says.

2. Check readOnlyHint, and treat it as a hint

   MCP tools can carry annotations such as readOnlyHint and destructiveHint, and a tool with no annotations is assumed to be not read-only and potentially destructive.² The specification also says clients must treat annotations as untrusted unless they come from trusted servers,¹ and the MCP maintainers put it plainly: "A server can claim readOnlyHint: true and delete your files anyway."² So use annotations to decide which tools to read closely, never to skip reading. Google's new tools are honest about it: the four write tools are annotated readOnlyHint: false, and the two label tools destructiveHint: true.⁷

3. Look for escape hatches

   One generic tool undoes a read-only list. Look for a tool that sends any HTTP request or calls any API path, takes a raw mutate operation or an arbitrary JSON body, runs code with the platform's SDK, or runs shell commands. A tool that runs a Google Ads Query Language (GAQL) query is a search, and Google annotates its own search tool as read-only.⁷ OWASP's MCP cheat sheet says never to pass raw shell commands and never to fetch URLs the model supplies without an allowlist.³ Look at the other servers in the same client too. The MCP maintainers note that a tool's risk depends on what else is in the session.² By our reading, if you self-host an ads server and your client also has a shell tool, the shell can reach the credentials file on that machine.

4. Check the scope on the consent screen

   The sign-in screen lists what the server's access token can do, and OWASP's advice is to grant narrow scopes, its example being a mail read-only scope rather than one that can modify.³ For ads, the table below has the scopes that matter. A server that only reads but asks for a write scope may have a reason; ask what it is.

5. Connect with a read-only role

   The ad platform enforces the role on its side, whatever tools the server has, which makes it the strongest lock. LinkedIn says a user with the Viewer role on an ad account is read-only even with the rw_ads scope.¹¹ The Google Ads API has no read-only scope and follows the user roles of Google Ads instead,¹² and Google suggests Read only access for users who don't need to make changes.¹³ Meta's own ads MCP server has rules that can grant an agent read access to performance data while withholding changes to budgets, campaigns or creative.⁹ Some servers may not work through a read-only role; that is one more thing to test.

6. Test on an account where a mistake is cheap

   Note a test campaign's status and budget, connect the server, and ask the assistant to pause the campaign and change the budget. A refusal is a statement, not proof, so check the account afterwards. On Google Ads, the change event data records each change with the client type, such as the API, and the user who made it, for the past 30 days.¹⁴ If nothing changed and the change history is empty, you have behavioral evidence for the setup you tested.

7. Pin the tool list and re-check when it changes

   OWASP recommends pinning reviewed tool definitions with a hash of the whole definition, including the input schema and annotations, and requiring review when it changes, because "a flipped readOnlyHint or destructiveHint can change client approval behavior without any visible description change."³ The plain version: save the tool list to a file and compare it after every update. The Google example above is why.

Which OAuth scopes are read-only for Meta, LinkedIn and Google Ads?

On Meta, ads_read. On LinkedIn, r_ads and r_ads_reporting. On Google Ads, none: one scope covers reading and writing.

Read-only or write access: which should a small marketing team choose?

Our view: read-only, unless you have changes that must happen when nobody is watching, or so many routine edits that clicking them is the slow part of your week. For a team of one to five, the slow part is usually working out what happened across Meta, Google and LinkedIn, and a read-only server covers that. We have no data on how common each case is, so test it against your own week.

If you choose write access, the questions change: where does the approval happen, and can the model skip it? Approval enforced by the vendor's service or by a narrow platform role holds even if the model misbehaves. Approval that lives in the model's own judgement, or in a client set to auto-approve, does not (our reading; the MCP specification says there should always be a human able to deny tool calls¹). We wrote up the trade-offs in read-only ads MCP: why it matters.

Is it safe to connect Claude to my Meta Ads account? Can it change my campaigns?

Claude can change your campaigns only if the MCP server you connect has tools that write and your Meta permission allows it. Meta's own ads MCP server is built to change things: Meta says it lets users "create and optimize campaigns, pull performance insights, manage product catalogs, and more",⁹ and its permission, ads_mcp_management, covers creating and editing campaigns.⁸ To keep it to reading, set its ads MCP server rules to read access.⁹ With a third-party server, run the checks above. Either way, keep your client's confirmation prompts on for any tool that is not read-only. Our Meta Ads MCP comparison lists which servers write.

What is a safe way to let ChatGPT or Claude analyze Google, Meta and LinkedIn ads without edit permissions?

Use a server with no write tools, and give each platform a lock of its own:

• Google Ads: connect with a Google account that has Read only access to the ad account, because the scope cannot limit anything.¹²¹³ If you run Google's own server, set labels: false and assets: false in its tools_config.yaml, as its README says for a strictly read-only server.⁵ More in our Google Ads MCP guide.
• Meta: prefer a server that asks for ads_read only. If you use Meta's ads MCP server, set its rules to read access.⁸⁹
• LinkedIn: prefer r_ads and r_ads_reporting, or connect through a user with the Viewer role.¹⁰¹¹ Our LinkedIn Ads MCP guide compares the options.
• Everything else in the session: read-only stops changes, not leaks. Keep tools that can send data out, such as email or web posting, out of the session where you analyze ad data.²

Where does Hopkin fit?

Hopkin is our product, so weigh this accordingly. Our docs say Hopkin gives AI assistants read-only access to your advertising data and never changes your campaigns, budgets or ads.¹⁵ You can check that with steps 1 and 2: the full tool manifest is public at hopkin.ai/docs/api/tools.json, with each tool's annotations, and each platform's docs page, such as Google Ads or Meta Ads, shows a Read-only badge on the tools annotated that way.¹⁶ Some tools manage Hopkin itself, such as sharing, renaming or revoking a connection, and are annotated as not read-only. They change settings inside Hopkin, not your ad account. There are no generic API, code or shell tools to look for in step 3.

Step 4 is where we are weaker, and we would rather say so. Hopkin's read-only line is drawn at the tool layer, not the scope. On Meta, its sign-in asks for ads_management as well as ads_read; on LinkedIn, for rw_ads as well as r_ads and r_ads_reporting; on Google there is only the one scope. If you want a second lock, connect through a read-only role, and test that the reports you need still work.

Setup is in the getting started guide.