Google's Official Ads MCP Server Is Read-Only: What Agent Connectors Can and Cannot Do

Three tools, and none of them can pause a campaign

It is 7:40 on a Tuesday and nobody on the team has opened Google Ads. Someone asks their agent what three accounts spent yesterday and gets a usable answer before the coffee is poured, then follows it with the sentence that actually matters: pause the two ad groups driving the overspend. Whether that second sentence does anything at all depends entirely on which connector sits behind it, and hardly anyone checks before typing it.

Google publishes an official MCP server for the Google Ads API. Its Key specifications block lists the mode as "Read-only (current release)", and it exposes three tools: list_accessible_customers, search for GAQL queries, and get_resource_metadata. A note further down the same page is blunter than any summary of it: "This implementation is strictly read-only. It cannot modify bids, pause campaigns, or create new assets." Checked on September 2, 2026, that page carried a last-updated stamp of August 19, 2026, so this is a current document rather than a stale one.

Both halves of that are true at once, which is why the story keeps getting told wrong. Google's own server reads. The connectors people are actually running their accounts through are not Google's, and those write. What follows is where the write path really lives today, what breaks when the work leaves the interface, and why the same shift reached ad creative before anyone wrote a governance policy for it.

What Google actually ships in its Ads MCP server

The spec sheet is short enough to read in a minute, and it repays the minute.

The three tools, and what each one fetches

Tool	What Google says it does	Writes?
list_accessible_customers	Returns the customer IDs and account names you can reach	No
search	Runs GAQL requests for metrics, budgets and status	No
get_resource_metadata	Describes a resource type such as campaign	No

The shape is deliberate. get_resource_metadata exists so a model can find out which fields are queryable before it writes a query, which is a quiet admission that the failure mode Google expected was a model guessing at the schema. The only tool that touches your account data is search, and Google describes it as executing GAQL requests "to fetch resource metrics, budgets, and status". Fetch is the entire verb.

The note under the spec sheet does the real work

A spec line that says "read-only" invites interpretation. A sentence that names the three things it will not do does not. Google wrote the second kind, listing bids, campaign status and asset creation by name, which happen to be the three operations any agentic PPC demo opens with.

That is worth holding next to the other AI surfaces Google shipped this year. The Ask Advisor expansion across Ads and Analytics is a reporting story too: four capabilities, all of them reading data you already have. And the account-level gates on Google's newer AI tools decide whether any of it reaches you at all. There is a pattern in the release notes, and it is that Google ships the reading first.

What "current release" is doing in that parenthetical

Two words carry the future tense of this whole subject. Google did not write "read-only". It wrote read-only in the current release, which is a vendor telling you the roadmap without committing to a date. No availability window appears on the page.

So the honest form of this claim carries a timestamp. As of Google's documentation last updated on August 19, 2026, the official server does not write. Anyone building a process on that property should re-read the page before they trust it next quarter, because the day mutation ships, every workflow that assumed a safe read-only connector inherits a live one.

The write path is arriving from everyone except Google

Here is the part that makes the coverage confusing, and it is not an error in the coverage.

A headline and its own article can both be right

The Search Engine Journal piece that prompted this post carries a subhead saying connectors "now let agents pause campaigns and draft client emails outside the UI", while its body states that Google's official server "cannot modify bids or pause campaigns". Read quickly, those contradict. Read properly, they describe two different products: the category writes, and Google's entry in the category does not yet.

Frederick Vallaeys puts the consequence in one line: "Writes are coming. They just aren't here yet, which means our industry gets the write path from everybody else first." He writes from Optmyzr and discloses it, and Optmyzr sells a connector that competes in exactly this space, so treat his taxonomy as a well-informed practitioner's frame rather than as neutral product research. The frame is still the most useful one published.

Three ways to work, and two of them are new

Vallaeys splits the job into three, and the split is worth keeping because it names where the limits live in each one:

1. By hand in the interface. You get ground truth and everyone in the room can point at the same screen. You pay for it in clicks.
2. AI inside the interface. Google's Ads Advisor, Optmyzr's own Sidekick. He calls these safe by construction, on the grounds that an assistant living inside an interface "can't hallucinate the buttons it can click".
3. AI outside the interface. Your agent plus a connector. The bounds are whatever the connector chose to expose.

The third is the new one, and it is the only one where the boundaries are set by a connector rather than by a screen. That is a real change in who holds the guardrail, not a change in tooling preference.

Why an official server lagging is not a footnote

It matters which vendor gets there first, because the vendor writes the limits. Google's server reaches Google Ads data and nothing else. A third-party connector, as Vallaeys describes his own, can also bring in GA4 behavioural data, competitor overlap, vertical benchmarks and account change history, which is genuinely more useful and also a much larger surface to be wrong about.

The practical effect is that nobody gets to defer this decision to Google. The write path is already available; it just arrives with a vendor's name on the guardrails rather than the platform's.

Four things that break when the work leaves the interface

Vallaeys catalogues four failure modes, and none of them are the ones people worry about out loud.

Hallucination about shape, not about facts

The familiar fear is a model inventing a number. The failure that actually costs money is a model inventing a structure. As he puts it, these APIs demand strict syntax, so "a small mistake about shape doesn't produce a small error. It produces a broken batch." Confuse a campaign for an ad group and an agent asked for a few new ad groups can build dozens of new campaigns instead.

When the connector is reading, that is an annoyance. When it is writing, it is a spend event that already happened.

State that scrolls away

In an interface, state is visible by default. You add a keyword, it appears in the keywords table, and the table is still there in two weeks. In a chat, the record of what you changed lives in a transcript, and finding it means remembering which conversation it happened in. This is the quietest of the four and probably the most common: not a wrong action, just no durable record of a right one.

Automations nobody remembers starting

The scarier category, in his framing, is the standing routine that outlives the conversation that created it. A scheduled agent checks for money-losing search terms, uses one connector to read the data and another to send the email, and when the email connector breaks, nothing crashes. The report simply stops arriving, and, in his words about a Quality Score script that died silently on a large account years ago, "nobody notices an email that doesn't show up".

The Scripts era already ran this experiment

Vallaeys dates the parallel precisely: Google Ads Scripts arrived as a limited release in June 2012 and reached every advertiser globally that September. Everything that followed is familiar: scripts copied out of blog posts and pasted in half-understood, nobody writing down what each one did, the person who added it leaving, and eventually somebody asking the question Vallaeys says every PPC lead asks once. The governance did arrive, and, as he puts it, "It arrived years after the capability did, and every bit of the damage lived in that gap."

His sharpest line is the comparison, and it is worth quoting whole: "A broken script does the wrong thing consistently, which at least makes it findable. A hallucinating agent does the wrong thing creatively." A consistent failure has a signature. A creative one does not.

The same shift already reached ad creative

Platforms keep moving the target too: Reddit's new 15-second engaged video views goal changes what a campaign is optimising for, and an agent acting on your behalf has to know that before it touches a bid. We build on the other side of this. Novoads publishes an MCP connector for making ads, documented at novoads.ai/mcp, and the questions Vallaeys is asking about campaign management are the questions we have had to answer about production. The difference is that a creative connector spends money on nearly every useful call, so the read and write distinction is not a governance abstraction. It is the invoice.

What a creative connector actually exposes

Ours publishes nine tools, and the published split is the first thing a caller should be able to see.

The four that spend credits:

• analysing an uploaded ad
• generating a video
• generating an image
• burning captions into a finished clip

The five that spend nothing:

• uploading an asset
• listing the caption presets
• quoting what a job would cost
• checking one job
• listing recent jobs

Access is OAuth, so no API key is issued for that path at all.

That split is the honest answer to the question Vallaeys tells people to ask a connector before trusting it. It is also the reason a chain can run unattended without being alarming: the tools that report and the tools that render are different tools, and a caller can be given a task that touches only the first group.

The annotation that separates a reading tool from a spending one

MCP has a mechanism for this, and it is more load-bearing than it looks. Every tool can declare whether it is read-only, whether it is destructive, and whether it reaches outside the system. Some clients treat a read-only hint as grounds to approve a call without asking anyone.

Which is why one change in our own codebase is worth confessing. Our ad-analysis tool used to declare itself read-only, because at the time it cost nothing to call. When it started charging a flat fee of one credit per call, that annotation had to flip, since a tool that spends money while advertising itself as read-only is not a mislabelled description. It is a behaviour change inside somebody else's approval flow. The annotation is a promise to a machine that may act on it without asking a human, and that is a higher bar than documentation.

Pricing the call before it runs

"Don't spend more than $500" in a system prompt, Vallaeys writes, "is a suggestion, not a control". We agree, and the control we shipped instead is a tool whose only job is to answer what a job would cost, what the balance is, and whether one covers the other. It spends nothing and creates no job.

Here is the arithmetic on a real chain. Reading an existing ad costs a flat 1 credit. A 6-second vertical video, quoted through that same estimate call, comes back at 3.4 credits. So the whole loop of study a competitor's ad, then render your own version of it, prices at 4.4 credits before a single call is made, and on the Pro plan at $79 for 100 credits, that is roughly $3.48. The number is not the point. The point is that it exists before the spend rather than after it, which is what a credit price you can actually compare is for.

Guardrails belong in the connector, not the prompt

The advice below is Vallaeys' sequence, and our experience on the creative side has not found a reason to reorder it.

Start read-only, and stay there longer than feels necessary

Connect the agent without write access and spend a few weeks using it for reporting and the exports you would otherwise do by hand. His reasoning is not caution for its own sake: you are finding out where this particular agent gets confused while being wrong is still cheap. Google's read-only server, he notes, is a reasonable place to run exactly that experiment, which is a genuinely useful thing for a limited product to be. Reading is also getting cheaper on its own: Google's agentic video understanding in Gemini cuts the token cost of analysing long footage, which makes a read-only agent more useful than it was a month ago.

Ask the connector to declare itself

"Nobody is vetting these connectors for you," he writes, quoting Anthropic's own warning on the screen where you add one. So ask the agent to list the connector's capabilities before you trust it, and read the answer for three things:

• How many write functions are there, by name?
• What is the largest change a single call can make?
• Which calls cost money, and can you get a price before one runs?

We hold ourselves to a version of this that is easy to get wrong in the other direction. Our published tool list deliberately leaves out tools that only exist when a feature flag is on, because a card describing a tool the server will refuse to register is both a leak and a lie. A connector's documentation should describe the server you will actually reach.

Scope by account, not by instruction

His third rule is the one most teams skip. "Don't touch the enterprise accounts" in a prompt is a suggestion. A login that can only see one account is a boundary. Most connectors scope their permissions to what the underlying platform allows that user, so a tighter boundary is a new login with fewer accounts attached, not a firmer sentence. This is the same discipline that a creative operations practice applies to naming and versioning, moved one layer down into access.

How Novoads solves the creative half of the agentic shift

If the measurement half of advertising is being automated first, and Google's own release notes suggest it is, then the half that stays expensive is producing the ads. That is the half we build.

What the connector does before it spends

You add one URL inside Claude, Claude Code, Cursor or any MCP client, sign in with OAuth, and your agent can quote a render, submit it, and come back with the finished file. The estimate call runs first and charges nothing. The render call returns a job ID immediately rather than holding the connection open, so a long render does not depend on a chat session staying alive, which is the same silent-failure problem Vallaeys describes from the other direction.

From a product photo to a rendered ad in one session

Hand it a product image and a description of the ad you want, and the chain is upload, quote, render, then captions. It runs on the same frontier engines everyone else rents, so the render quality is a tie and the argument moves to what it costs to get an ad you can actually run. If you would rather drive it from a terminal, the five-stage Claude Code workflow we published covers the same chain as a set of skills. Either way the output lands in the same place: enough variants to run a real ad creative test, which matters because the working assumption of roughly ten tries per winner turns one good idea into a ten-video invoice. Try it for $1 for 3 days of access, cancel anytime.

The interface was the guardrail

That is the sentence worth taking away from all of this. For as long as anyone has run paid search, the Google Ads UI was not just how the work got done, it was the boundary on how wrong the work could go: you saw the state, you could only click buttons that existed, and the change log wrote itself. Move the work outside and none of that comes with you. The connector inherits the job the interface was quietly doing, and connectors are written by vendors, on their schedule, with their idea of what a safe default is.

Google's read-only server is not a weak product. It is a vendor choosing, for now, to ship the half that cannot hurt you, and being unusually clear on the page about which half that is. Everyone else shipping a write path owes you the same clarity, and the only way to get it is to ask before you connect. On the creative side that question has a specific form and a specific answer: which of these tools spend, and what will this one cost me before it runs. Reading what a credit actually buys is a good place to start, and so is knowing which metric will tell you the ad worked once it does, which is what creative analytics is for.