Pinterest Ads

The film shows hosted getmcpads with sample data. Its MCP Apps, from creative galleries and alerts to Google Sheets exports and bulk launches, belong to the hosted product. This repository provides the standalone native API tools.

29 read tools · 30 write tools, disabled by default.

Run locally with your own platform credentials and a client that supports stdio MCP, such as Claude Desktop, Claude Code or Cursor. Your requests go directly to the platform. For managed connections, including supported ChatGPT setups, use the hosted option.

What's new

v2.1.1: Zod 4 security update · October 26, 2026

• Update zod to 4.6.7. Every Zod release before 4.6.6 is covered by the high-severity advisory GHSA-mrhx-c7xc-m3w5: validating an oversized constrained collection can exhaust memory, and no Zod 3 release carries the fix. npm audit --omit=dev reports no vulnerability again.
• Keep the Zod 3 validation behaviour. A parameter default is still validated and completed before use, so an omitted object must still supply its required fields.
• Keep each parameter's own description when the parameter is optional or has a default. Zod 4 stores a description on the wrapped schema only, so the shared fallback description could otherwise replace it.
• Tool names, parameters and descriptions published over MCP are unchanged. server-card.json is regenerated with Zod 4's JSON Schema output, which spells some constraints differently.

Earlier releases

Full changelog · All releases

Source synchronization: SOURCE_SYNC.md.

Upgrade notes

Requires Node.js 22.23.4, 24.22.1 or 26.12.1, or a newer release of those lines. On an older runtime the server starts and writes a warning to stderr. CI covers Node 22, 24 and 26.

This release has no breaking change, and existing configurations keep working. Two changes are planned for 3.0.0, and the server announces each one on stderr at startup when it applies to your configuration:

• PINTEREST_AD_ACCOUNT_IDS will be required. Set it now to restrict the server to the listed ad accounts. Until then, PINTEREST_AD_ACCOUNT_ID remains a default account, not a restriction.
• PINTEREST_ENABLE_WRITES will accept only true to enable writes. Replace 1, yes or on with true.

The pinterest://attribution resource now names its default defaultAttribution. The former defaults key remains as an alias until 3.0.0.

Read the current tool schemas before reusing saved arguments. Writes remain optional and require explicit confirmation. Hosted creative integrations and MCP Apps UI are outside this release.

Install this release

This is a GitHub source release. npm and MCP Registry versions are published separately. The commands below select this exact version; unpinned npx examples later in this document select the version currently available on npm.

git clone --branch v2.1.1 --depth 1 https://github.com/get-mcp-ads/pinterest-ads-mcp-server.gitcd pinterest-ads-mcp-servernpm cinpm run build

Configure your MCP client to run node with the absolute path to dist/cli.js and the platform credentials documented below.

Prefer a managed connection? Use Pinterest Ads with hosted getmcpads. Connect your account, select the data your assistant may access and use the hosted MCP connection. See the site for current features and plans.

What you get

Raw column names, on purpose

Pinterest names its reporting columns in its own way, and this server accepts those names directly rather than inventing friendly aliases on top. A column that exists in the API works here; one that does not fails immediately rather than being silently translated into something else.

pinterest://reporting-columns lists what is available, and pinterest_validate_report checks a request before it runs.

Privacy, built into what the tools return

Two protections, and they work differently.

Lead records are never exposed. pinterest_get_lead_assets returns lead form and subscription configuration, but never the lead export itself, because those rows carry personal information submitted by end users. This is an exclusion, not a redaction: the data does not leave Pinterest through this server at all.

Business member identifiers are redacted by default. Member IDs, email addresses and usernames are replaced before they reach the model when you read members, asset members or invites. includePersonalIdentifiers: true returns the raw values and defaults to false. These are your colleagues' addresses, so the default is the safe one.

Getting a token

You need a Pinterest access token with the ads:read scope.

1. Create an app in the Pinterest developer portal.
2. Note the App ID and App secret.
3. Run the OAuth flow while signed in to the account that can access your ad accounts. Request ads:read, and ads:write only if you plan to enable writes.
4. Keep the access token, and the refresh token if you want the server to renew it.

📖 Pinterest API authentication

You can run with just PINTEREST_ACCESS_TOKEN, but it expires. Supplying PINTEREST_REFRESH_TOKEN, PINTEREST_APP_ID and PINTEREST_APP_SECRET together lets the server renew the token itself, which is what you want for daily use.

Run pinterest_health_check as your first call. It verifies the token and lists the ad accounts you can reach, without printing the token.

Setup

Claude Desktop

~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{  "mcpServers": {    "pinterest-ads": {      "command": "npx",      "args": ["-y", "@getmcpads/pinterest-ads-mcp-server"],      "env": {        "PINTEREST_ACCESS_TOKEN": "your-token-here",        "PINTEREST_AD_ACCOUNT_IDS": "your-ad-account-id"      }    }  }}

PINTEREST_AD_ACCOUNT_IDS is optional and recommended. It restricts the server to the listed ad accounts, and version 3.0.0 will require it.

Restart Claude Desktop. Ask it: "list my Pinterest ad accounts".

Claude Code

claude mcp add pinterest-ads --env PINTEREST_ACCESS_TOKEN=your-token --env PINTEREST_AD_ACCOUNT_IDS=your-ad-account-id -- npx -y @getmcpads/pinterest-ads-mcp-server

Cursor

.cursor/mcp.json in your project, same shape as the Claude Desktop config above.

From source

git clone https://github.com/get-mcp-ads/pinterest-ads-mcp-server.gitcd pinterest-ads-mcp-servernpm install && npm run buildcp .env.example .env   # then fill in your credentialsnpm start

Configuration

Either the access token, or the refresh trio. The server refuses to start with neither. Without PINTEREST_AD_ACCOUNT_IDS, every ad account the token can access is reachable, and the server says so on stderr at startup.

npm run doctor

Writes, and why they preview first

Write tools are disabled by default. Enable them with PINTEREST_ENABLE_WRITES=true, and grant ads:write on top of ads:read.

When enabled, every write tool returns a preview and changes nothing:

// pinterest_update_adgroup_budget { adAccountId: "549…", adGroupId: "268…", dailyBudget: 50 }{  "applied": false,  "action": "pinterest_update_adgroup_budget",  "change": { "adAccount": "549…", "adGroup": "268…",              "field": "budget_in_micro_currency", "amount": 50,              "inMicroCurrency": 50000000 },  "message": "Preview only, nothing was changed. Repeat the same call with confirm: true to apply this change to the live account."}

Only a second call carrying confirm: true touches the live account.

This is deliberate. An assistant composes these calls, and it can pick the wrong ad account, the wrong campaign, or the wrong order of magnitude on a budget. A mandatory preview makes the mistake visible before it costs money, and gives a human the stopping point the protocol does not guarantee on its own.

Two further guardrails:

• pinterest_create_campaign always creates the campaign PAUSED. There is no option to create it active.
• Amounts are converted to micro units for you. Pinterest holds money in millionths, so 12.50 in the account currency is 12500000. The preview shows both, so a factor-of-a-million mistake is visible before it applies. A daily and a lifetime budget sent together are refused rather than silently resolved.

Tools

Every tool is listed below. See server-card.json for complete parameter and output schemas.

Security

• The token is never logged, at any log level, or written to disk.
• Credentials go to the Pinterest API only: api.pinterest.com, or api-sandbox.pinterest.com in sandbox mode. A test fails the build if another host appears in the source.
• PINTEREST_AD_ACCOUNT_IDS restricts the reachable ad accounts. When it is set, a request that names another account is refused before it is sent, and discovery only returns listed accounts.
• No fetch follows a redirect. Every outbound call sets redirect: "error", so a redirect cannot forward your token to another host. A test fails the build if any fetch omits this.
• Async report URLs are validated before being fetched. Pinterest returns a download URL on a host it chooses; that value is data from the API, not something to trust. HTTPS only, no private or loopback address, no redirect, and no credential attached.
• Video uploads go to the destination Pinterest returns, an Amazon S3 host checked before use, with signed form fields and never the access token. A video URL you pass gets the same checks as a report URL. Every request has a timeout and a response size limit.
• No telemetry. Outside the Pinterest API, the server only contacts the report and upload URLs that Pinterest returns, and a video URL that you pass to the upload tools.

Full policy, including how personal data is handled: SECURITY.md.

Looking for a managed, multi-platform version?

Try hosted Pinterest Ads if you want to use this source without operating a local server. getmcpads also connects advertising, Search Console and GA4 through one MCP URL. Source availability and plan limits are listed on the site; connecting an account is still required.

1. Follow the Pinterest Ads connection guide.
2. Select the account or property your assistant may read.
3. Connect Claude, ChatGPT or Codex.
4. Try a read-only review: “Review campaign performance using your selected ad account. State missing data and do not change anything.”

See the current hosted tool catalogue and pricing before choosing a paid plan. This Apache 2.0 adapter remains independently useful with your own credentials.

Contributing

Issues and pull requests are welcome. See CONTRIBUTING.md. Please read SECURITY.md before reporting anything security-related.

Licence

Apache License 2.0. See also NOTICE.

Pinterest is a trademark of Pinterest, Inc. This project is not affiliated with, endorsed by, or sponsored by Pinterest, Inc. It is an independent client of a public API.

MCP contracts and desktop bundle

Every tool declares read/write annotations, parameter descriptions and a structured output schema. Successful calls expose the payload as structuredContent.result; errors retain isError: true. The generated server card contains definitions only.

Run npm run bundle -- /path/to/output to build a .mcpb desktop bundle from the current catalog. Credentials are entered locally during installation. Write tools remain disabled unless explicitly enabled.

More from getmcpads

Meta Ads · Google Ads · Google Analytics 4 · Google Search Console · TikTok Ads · X Ads

Maintained by Emmanuel at getmcpads. Questions: [email protected].