What changed
Google Ads MCP server v0.0.6 adds create_asset, upload_video_asset, manage_labels and manage_label_associations behind a propose-and-confirm checksum; the tools ship enabled in the bundled tools_config.yaml, and campaigns, budgets, bids, keywords and status stay out of reach
When
Released on GitHub and PyPI on November 2, 2026; reported by PPC Land on November 9, 2026; Google's integration guide, updated October 30, still says read-only
Who it affects
Shopify and D2C brands, in-house teams and agencies that connected Claude, Cursor or another AI client to Google Ads through Google's official MCP server
What to do
Check which version you run, pin a release instead of the main branch, set labels and assets to false for read-only use, add a human approval hook before any confirm call, and audit labels that drive scripts or rules

Key takeaways

  • Version 0.0.6 of Google's Ads MCP server, released November 2, 2026, adds four write tools for assets, video uploads and labels, enabled by default, while Google's guide still says read-only.
  • The propose-and-confirm checksum proves parameters did not change; it does not prove a human approved the write, so add your own approval step and pin a version.
  • Labels are the live wire because scripts and rules key on them; assets land unattached, and budgets, bids, campaigns and keywords remain out of reach.

How Google's Ads MCP server went from read-only to write

  1. Google announces the server as read-only

  2. v0.0.1 published on PyPI

  3. v0.0.2 adds namespaced tool names

  4. Integration guide updated, still says read-only

  5. v0.0.6 adds four write tools, on by default

  6. PPC Land reports it; live account test succeeds

What changed on November 2

The GitHub releases page for googleads/google-ads-mcp shows v0.0.6 published on November 2 at 15:48 UTC with two entries: pull request #139, "Implement asset and label management with propose-and-confirm flow," and #142, a version bump. The project README now lists seven tools. The three read tools are unchanged: search runs Google Ads Query Language reports, list_accessible_customers returns the accounts the login can reach, and get_resource_metadata describes a resource's fields.

The four new tools are create_asset (text, image, YouTube video, sitelink, callout and structured snippet assets, plus other types through extra parameters), upload_video_asset (a local video file uploaded to YouTube through the Google Ads API as a background task, local mode only), manage_labels (create, update and remove account labels) and manage_label_associations (attach or remove labels on customers, campaigns, ad groups and ad group criteria such as keywords). Under the default configuration the tools are exposed with namespace prefixes, for example assets_create_asset and labels_manage_labels.

Google introduced the server on October 7, 2025 as a read-only reporting bridge between AI assistants and Google Ads. Version 0.0.1 followed on October 22, 2025, and the project then sat for almost eleven months before five releases arrived between September 9 and November 2, 2026. Our Shopify and ecommerce news channel covered the parallel move on the storefront side when Shopify shipped its own Shop MCP and agentic checkout.

The guardrail is a two-step checksum, not a human

Every write runs twice. The first call, with validate_only set to true by default, validates the request, runs a Google Ads API dry run where supported, and returns a list of human-readable change items plus a checksum bound to the customer ID and parameters. Only a second call with identical parameters and that checksum commits the change. The README says the confirm step comes "after explicit user approval."

PPC Land's reading of the published code, and the consultant Thomas Wismer's own test, both reach the same limit: the server cannot tell whether a person approved anything. The checksum is a SHA-256 digest of the customer ID and the parameters, with no secret and no expiry, and the server keeps no record between calls. It proves the parameters did not change between proposal and commit. The instruction to show the plan to the user and wait is written into the tool description, which means it is addressed to the AI model, not enforced by the server. Wismer's advice in his blog post was short: "If you want a hard stop, add your own." He uses a Claude Code hook that requires his approval before any call with validate_only set to false.

On November 9 Wismer ran the tools in a client account with permission: a dry run for a label and a callout returned planned changes and a checksum without writing anything; he then committed the label, read it back with a GAQL query as ENABLED, removed it in a second cycle and confirmed REMOVED. A test sitelink he created appeared in the asset library but was attached to nothing, because version 0.0.6 has no tool to link an asset to a campaign or ad group.

On by default, and the install command pulls the newest code

Which tools the server exposes is controlled by tools_config.yaml. The bundled default in version 0.0.6 adds two lines, labels: true and assets: true, and the README states that a default with all tools enabled ships with the package so it works with no extra setup. For read-only use the README says to set labels: false and assets: false. The server looks for a config file first at the path in the GOOGLE_ADS_MCP_TOOLS_CONFIG environment variable, then in the current working directory, then falls back to the bundled default.

The install route matters. Google's integration guide configures the server with a pipx command that pulls the repository's main branch, so an assistant set up that way picks up new write tools whenever the branch moves. The README documents an alternative that runs an exact version published on PyPI. Pinning a release tag is how a team decides when, or whether, write capability arrives.

The OAuth grant was never the protection. The server authenticates with the single adwords scope Google publishes for the Google Ads API, which permits writes; a comment in version 0.0.5 acknowledged there is no separate read-only scope and that read-only behaviour came from the limited tool set. Teams that approved the integration on the basis of the guide's "Mode: Read-only (current release)" line gave an access token that could always write. What changed is the code behind it. Our explainer on AI agents for ecommerce covers how to scope agent permissions by task rather than by platform default.

So what: the money and the risk for a D2C brand

Use illustrative numbers. A Shopify brand spends $40,000 a month on Google Ads, about $1,300 a day, and runs a bidding script that scales campaigns labelled "scale" and pauses campaigns labelled "cut" each morning. An agent that can now create, remove or re-attach labels sits one checksum away from that script's inputs. If a mislabelled $300 a day campaign runs the wrong way from Friday evening to Monday morning, that is roughly $900 of spend pointed in the wrong direction, or $900 of sales left on the table, before anyone looks. Nothing in the server stops the confirm call if the client auto-approves.

The direct blast radius is smaller than it sounds. Assets created by the agent land in the library unattached; a wrong sitelink or callout costs nothing until a person links it. Labels are the live wire, because labels drive scripts, rules, reports and in some accounts bid-management tools. Campaigns, budgets, bids, keywords and status cannot be touched by this release, so a runaway budget change through Google's official server is not possible yet.

The cost of the fix is near zero: two lines in a config file, a pinned version, and a human approval step in the client. The cost of not knowing is an audit nobody ran. For a brand that pays an agency, the question to ask this week is simple: which MCP servers touch our ad accounts, what version are they on, and who approves writes.

What the server still cannot do

According to the tool list in the package and Wismer's test, version 0.0.6 cannot create or edit campaigns, ad groups or ads; cannot change budgets, bids, bidding strategies or status; cannot add keywords or negatives; and cannot attach a new asset to a campaign or ad group. A community pull request offering campaign status, budget and negative keyword tools was closed by its author minutes after opening. Third-party MCP servers do cover more of the API, but they hold a token with access to every account under a manager login, which is a different risk conversation.

What an agent can and cannot change in v0.0.6

CanCannot
AssetsCreate, upload videoAttach to campaigns
LabelsCreate, edit, remove, attachNothing blocked
Campaigns and adsRead onlyCreate or edit
Budgets and bidsRead onlyChange any amount
KeywordsRead onlyAdd or negate

What brands and agencies should do this week

Each step names who does it, where, and the metric that shows it worked.

  • Ads lead: in the AI client's MCP configuration, read the exact command used to start the Google Ads server; if it pulls the main branch, change it to a pinned PyPI version. Metric: the server reports a fixed version string.
  • Ads lead: if the team only needs reporting, create a tools_config.yaml with labels: false and assets: false and point GOOGLE_ADS_MCP_TOOLS_CONFIG at it. Metric: the client lists three tools, not seven.
  • Developer or ops: if writes are wanted, add a client-side hook that requires a named person to approve any call with validate_only set to false. Metric: zero commits without a logged approval.
  • Ads lead: in Google Ads, open the Change History report filtered to the last 30 days and the API user, and look for label or asset changes you did not make. Metric: unexplained changes equals zero.
  • Ads lead: list every script, rule or bid tool that keys on labels and document which labels they read. Metric: a written label map the whole team can see.
  • Agency owner: ask each vendor and freelancer which MCP servers connect to client accounts and at what version. Metric: a complete inventory before Black Friday week.
  • Finance: confirm the Google Ads account has a monthly spend limit or alert set in billing, so a future write tool cannot outrun the budget quietly. Metric: alert threshold set and tested.

Settings to check before Black Friday week

  • Pin a PyPI version, do not run the main branch
  • Set labels: false and assets: false if read-only is enough
  • Add a human approval hook before any confirm call
  • Review Change History for label and asset edits
  • Map every script and rule that keys on labels
  • Inventory MCP servers across agencies and freelancers
  • Set a billing spend alert as a backstop

When this does not apply

If nobody on your team or at your agency has connected an AI assistant to Google Ads through an MCP server, there is nothing to change today. Teams on a hosted third-party Google Ads MCP server, or on Google's separate Ads API agent skills and developer assistant, are governed by that tool's own write controls, not by this release. The change also says nothing about Amazon Ads, Meta or Microsoft Advertising. And if your client already requires explicit human confirmation for every tool call, the server's weaker check is covered by yours.

Where PPC Spider helps

PPC Spider runs Google Shopping and Performance Max for D2C brands through its Google Shopping ads agency team and keeps every automated change, human or agent, in a change log with a named approver. If you want a review of what is connected to your ad accounts and how each tool is scoped, the free audit covers Google and Shopify as well as Amazon, and our Shopify D2C agency page explains how ads, store and automation work together.

Sources

Get the next change before your competitors do

We send the marketplace changes that matter each week, with what to do next.

By subscribing you agree to our privacy policy. Unsubscribe any time.
Want this done for your account?

We run these playbooks on client accounts every day. Start with a free audit.

Get a free audit