The Model Context Protocol (MCP) is an open standard that lets AI assistants such as ChatGPT, Claude, and Gemini call external tools. Once an ad platform ships an MCP server, an assistant can query that account’s data. If the server allows it, the assistant can also create campaigns, change budgets, and upload audiences.
In the first half of 2026, nearly every major ad platform released an official server. The interesting question is no longer whether agents can connect. It’s how much they’re allowed to do once connected.
Read-Only vs Read-Write, Platform by Platform
| Platform | Announced | Status | Access |
|---|---|---|---|
| Amazon Ads | February 2, 2026 | Open beta for partners with API credentials | Create, update, and delete campaigns, reporting, account settings, billing data |
| TikTok for Business | May 13, 2026 | Official hosted server | Campaign management, reporting, audiences, creative operations |
| Meta | July 16, 2026 (available to developers) | Tools rolling out gradually | Ad creation and editing, custom audiences, catalogs, insights, signal diagnostics, A/B and lift tests |
| Google Ads | 2026 | Open source, self-hosted | Read-only: account listing, GAQL queries, resource metadata |
| Microsoft Advertising | June 17, 2026 | Open pilot | Read-only: campaign data, performance analysis, audits |
| June 17, 2026 | Alpha with named partners | Read access: campaign data, analytics, keyword insights |
Why Google Allows Read-Only Access
Google’s documentation is explicit that its server can’t modify bids, pause campaigns, or create assets. The server offers three tools: listing accessible accounts, running queries in Google Ads Query Language, and retrieving the resource schema.
This positioning shows Google is treating agents as analysis tools for now. Finding which campaign is hemorrhaging budget, which search terms don’t convert, or which ad group had a sudden drop doesn’t require write access. The human makes the change.
Meta, TikTok, and Amazon Give Agents Budget Authority
Meta, TikTok, and Amazon went the other way. Amazon even ships prebuilt workflows, such as expanding campaigns to a new country with one prompt. TikTok’s server covers campaign management and creative operations. Meta’s includes ad creation and editing, custom audiences, catalogs, and conversion lift tests.
An agent with write access is functionally a user who can spend money. A misunderstood prompt can become a real expense—campaign budgets multiplied by ten, ads aimed at the wrong audience, or audience uploads that shouldn’t happen under the client contract.
A Governance Model for Agencies
An agent with write access is functionally a user with spending authority. Agencies already have controls for human users. The same controls need to apply to agents.
| Control | What it looks like in practice |
|---|---|
| Dedicated identity | The agent connects through its own user, not a senior buyer’s login, so its actions are attributable. |
| Least privilege | Google Ads connections use a read-only user. Meta business portfolio access is limited to the specific ad accounts the agent needs. |
| Spend guardrails | Any action that increases budget, bids, or launches a campaign waits for human approval. |
| Data boundaries | Customer list uploads and audience creation stay outside agent scope unless the client contract explicitly allows it. |
| Audit trail | Weekly review of the platform change history filtered to the agent’s user. |
| Kill switch | Removing the agent user’s access is documented and can be done by anyone on the account team. |
Clients increasingly ask whether AI tools touch their accounts. A written version of this table answers that question before it becomes a contract dispute. User access levels on each platform are covered in Taking Over an Ad Account: Access and Ownership.
Where the Early Value Is
The highest-return uses today don’t require write access at all:
- Pulling cross-account performance summaries for weekly client calls.
- Flagging campaigns whose cost per conversion moved sharply week over week.
- Running structured audits, such as finding ad groups with no negatives or campaigns limited by budget.
Write access pays off later, once approvals and audit routines are running, for repetitive changes such as pausing clearly failing ads or rolling proven campaigns into new markets.
Quick Take
Ad platforms have split into two camps. Google, Microsoft, and Pinterest are read-only for now. Meta, TikTok, and Amazon let agents spend. Treating agents as users with the same permissions, approvals, and audit expectations as people is what keeps that capability from turning into an incident.