com.perfoadsPublished by perfoads.comv0.2.0-alpha.1Updated Nov 8, 2026
Checks your Google Ads accounts (162 checks) and changes them only after you approve. Self-hosted.
Self-hosted MCP server that lets an assistant read Google Ads accounts, run 162 account checks, and apply changes only after human approval.
Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.
Follow the launch instructions in the repository.
A self-hosted MCP server that works with Google Ads. It lets an AI assistant (Claude Desktop, Claude Code, Cursor and other MCP apps) read your Google Ads accounts, run 162 deterministic account checks, and change things only with your approval and within limits you set in a policy file.
PerfoAds MCP works with Google Ads. It is not made, endorsed or supported by Google (not a Google product). It works with the Google Ads API through your own Google Cloud project and your own sign-in; nothing goes through anyone else's servers.
Package and CLI: perfoads-mcp. License: Apache-2.0. Status: early alpha. On npm: perfoads-mcp (0.2.0-alpha.1).
The checks say what is wrong: the evidence, how serious it is and the money it wastes. They do not say how to fix it. Want fixes, not just findings? PerfoAds adds fix plans; Paweł Wilk offers a free 1-hour call - perfoads.com
No change can be applied through MCP without a human approving it outside the model. On hosts where the agent also has a shell or controls the browser (Claude Code, Cursor, browser-control tools) this holds only with the hardened setup (server + store under a separate OS user or in a container, approval_mode: code_only and open_browser: false), and only if you do the human steps (your password, approving, policy edits) from a session the AI can't change: another account's login session, SSH from another device, or with the AI agent sandboxed. An AI with a shell on your user can change your shell startup files, fake sudo and capture what you type.
The one exception is one you make yourself: the auto tier in your policy file (off unless you set it, and only for pausing a campaign or lowering a budget).
What this means in practice:
accounts.write.Read docs/THREAT-MODEL.md for what this protects against and what it does not.
node:sqlite).Step by step: docs/SETUP.md.
Always name the exact version (@0.2.0-alpha.1, not @latest or none), so npm can't hand you a different release. init asks for your OAuth client id and secret, opens Google's sign-in in your browser, saves the sign-in encrypted, writes a read-only starter policy, runs doctor, and prints the config for your AI app.
Or build from source:
init then prints your AI app's config for that copy (full path to node and to packages/cli/bin/perfoads-mcp.js). Wherever these docs say npx perfoads-mcp@<version> <command>, run that node command instead.
The AI app config (init prints it with your version filled in; for a source build it prints the node form):
Claude Desktop (Settings > Developer > Edit Config, claude_desktop_config.json), Cursor (~/.cursor/mcp.json):
Claude Code:
Or as a Claude Code plugin (it pins the release version; claude-plugin/):
ChatGPT desktop app and Codex: they run local MCP servers too; see docs/SETUP.md.
More: examples/ (Claude Desktop, Claude Code, Cursor, a starter policy). A Claude Desktop extension (.mcpb) can be built with node scripts/build-mcpb.mjs; run init in a terminal first, the extension uses the same settings folder.
Then ask your AI app: "run doctor", "list my Google Ads accounts", "audit account 123-456-7890".
What to ask your AI, step by step: docs/USING.md. Full list with every input: docs/TOOLS.md (generated from the server).
doctor (checks the setup and says what to fix), list_accounts (incl. accounts under manager accounts).get_account_overview, get_campaigns, get_ad_groups, get_keywords, get_search_terms, get_budgets_and_bidding, get_negatives, get_ads_and_assets, get_audiences, get_conversions, get_change_history, keyword_ideas, describe_resource, and query_gaql (one read-only GAQL SELECT). Summary first, then one page of rows and a cursor. Money is a decimal string in the account currency.build_snapshot reads what the checks need into a local snapshot, run_checks runs them (findings with evidence; "not run" with the reason, never "clean" when data was missing), explain_check. Prompt weekly_audit. Catalog: docs/CHECKS.md.propose_change, apply_change, undo_change, get_change, list_changes, resolve_change. Types: budgets, campaign status, bidding targets, negatives (campaign and shared lists), keywords, pausing keywords, responsive search ad text, sitelinks, callouts, audience exclusions, and creating a new Search campaign from plain fields (always made paused; undo only while it never ran).Text that comes from Google or the AI (names, search terms, ad texts, errors) is wrapped as {"untrusted": "..."} so the AI treats it as data, not instructions.
open_browser: false, you open it yourself with approvals open <id> in a terminal. You approve with its code, or reject.stale). An unclear answer from Google is never re-sent: it is re-checked by reading the account.verified), or says loudly that it did not.changes://log); undo_change proposes the reverse as a new change, with its own approval.Approval paths and approval_mode: see docs/HARDENED-SETUP.md.
policy.yaml in the settings folder decides which accounts the AI may read and change and how far: per-account spend limits in the account's currency, budget and target step limits, writes per minute and day, tiers per change type (auto, confirm, blocked), brand terms that are never negated, a Google Ads operations reserve for changes, and a kill switch. It is re-read on every check, and no tool can edit it.
Every key, range and default, with examples: docs/POLICY.md. Starter file: examples/policy.example.yaml.
Everything lives in one settings folder, never in your project: ~/.config/perfoads-mcp (or $XDG_CONFIG_HOME/perfoads-mcp), %APPDATA%\perfoads-mcp on Windows. Change it with PERFOADS_MCP_HOME, but keep it outside any folder the AI works in (doctor checks).
store.sqlite - your OAuth client id, client secret and refresh token (each encrypted, AES-256-GCM), the list of your accounts, proposed and applied changes, approval sessions (codes only as hashes), the audit log, Google Ads operations used, and every policy version loaded.snapshots/ - account snapshots for the checks (gzipped JSON, owner-only, kept 24 hours, at most 20). They hold account data such as campaign names and search terms.policy.yaml - your change policy. config.json - optional approval_mode, open_browser, retention_days and pro_plugin (an absolute path to a separately installed plugin package, loaded at start; a plugin runs as code with the server's rights, so set it only for a package you trust; it is refused when anyone but the user running the server, or root, can change its files or a folder above them; its text comes back wrapped as untrusted; doctor shows whether it loaded and why not)."retention_days" in config.json, 30 to 3650): when the server starts, changes in a final state (verified, failed, rejected, expired, stale, settled, abandoned), finished approval sessions, policy versions nothing still refers to, and the oldest audit log entries, all older than that, are deleted. Unfinished changes (proposed, approved, applying, in doubt, applied but not yet checked) and anything they need are never deleted. Before deleting, the server writes a retention_pruned entry to the audit log with what it removes and a checkpoint (the number and hash of the last entry removed), so the rest of the log still verifies. Snapshot temp files from interrupted saves go after 1 hour.secret-tool), or a key file (key) in the settings folder (always the key file on Windows).policy.yaml are created 0600 and snapshot folders 0700 (a config.json you write yourself keeps the mode you give it). On Windows file modes do nothing, so each time the store opens the server sets an ACL on the whole settings folder with %SystemRoot%\System32\icacls.exe: inheritance from the parent removed, full control for your Windows user only, applied to everything already in it and inherited by everything created later (store, key file, snapshots, policy.yaml, config.json); the key file, snapshot folders and files and the starter policy get it again when they are written. doctor warns on Windows when the settings folder is outside %APPDATA%, and fails (with the fix) when icacls could not make it owner-only.Tokens are encrypted at rest and never written to logs or shown in tool results. Encryption protects a copy of the folder (a backup, a synced folder). It does not protect against programs running as your own OS user: the Keychain entry, the keyring entry and the key file can be read by any process of the same user without a prompt, including an AI agent with a terminal. The hardened setup closes that, within its stated limits (human steps from a session the AI can't change).
Disconnect and delete: npx perfoads-mcp@<version> reset asks Google to revoke the saved sign-in (best effort; it says whether Google confirmed), then deletes the sign-in and its key (it asks first). Delete the settings folder to remove everything else. If reset says Google did not confirm, remove the app's access at myaccount.google.com/permissions.
Nothing is sent anywhere except to Google's APIs. No telemetry.
Use npx perfoads-mcp@<version> <command> (or the command init printed) if it is not installed globally.
approve and approvals open are a convenience, not a guard). An AI that controls your browser can read the approval page, code included. Until you open it, the page link is visible for a moment in the browser opener's command line (ps) and stays in browser history; it stops working after the first open.keyword_ideas needs Basic or Standard). The server keeps a share of each day's operations for approved changes.init and doctor warn; publish the app to production to avoid it (docs/SETUP.md).in_doubt until the new value shows, you settle them (resolve_change), or 30 days pass.PerfoAds MCP runs on your computer. Your Google Ads data goes only between your computer and Google; nothing is sent to PerfoAds, and there is no telemetry. What is stored locally, for how long, and how to delete it: What is stored, and how to delete it. Full policy: https://perfoads.com/privacypolicy
Terms of service: https://perfoads.com/termsofservice (the PerfoAds MCP section: free, as is, no warranty, Apache-2.0, your own Google account and costs, you approve every change).
Contact: [email protected] for privacy and security questions (security reports: see SECURITY.md). Bugs and support: https://github.com/vilovibe/perfoads-mcp/issues
.mcpb.Packages: ads-client, reads, snapshot, checks, changes, policy, store, mcp-server, cli (see packages/). Contributing: CONTRIBUTING.md.
Apache License 2.0. See LICENSE and NOTICE.
Google Ads is a trademark of Google LLC.
Source: README.md at commit ce171c8
Check setup
Checks the setup step by step: Node.js, where settings are stored, the saved Google sign-in, Google Ads API access level and limits, and risky Claude Code hooks. Each line says ok, warn, fail or skipped in plain English, with a fix; exact commands and file paths are in each check's details.
Takes no parameters.
List Google Ads accounts
Lists every Google Ads account this sign-in can work on, including accounts under manager (MCC) accounts, with currency, time zone and the login-customer-id each one needs.
refreshRun a read-only GAQL query
Runs one Google Ads Query Language SELECT on one account. Read-only: anything but a single SELECT on a known resource is refused. LIMIT is added (200) or lowered (max 1000). Returns a summary first, then up to max_rows rows; next_cursor fetches the rest. Costs 1 Google Ads operation per call.
queryrequiredcursormax_rowscustomer_idrequiredAccount overview
One account at a glance: name, currency, time zone, totals for the date range (cost, clicks, conversions, value, ROAS), campaigns per channel. Example: {"customer_id":"123-456-7890"}
date_rangecustomer_idrequiredCampaigns
Campaigns that are not removed, plus removed ones that had activity in the date range: status, channel, budget, bidding, targets, metrics, Search impression share; highest cost first. Example: {"customer_id":"123-456-7890","date_range":"LAST_7_DAYS"}
cursorstatusmax_rowsdate_rangecampaign_idcustomer_idrequiredAd groups
Ad groups (not removed): status, type, CPC bid, metrics; highest cost first. Example: {"customer_id":"123-456-7890","campaign_id":"111"}
cursorstatusmax_rowsdate_rangead_group_idcampaign_idcustomer_idrequiredKeywords
Keywords with impressions: match type, quality score parts, bids, page CPC estimates, metrics; highest cost first. Example: {"customer_id":"123-456-7890","ad_group_id":"222"}
cursorstatusmax_rowsdate_rangead_group_idcampaign_idcustomer_idrequiredSearch terms
Search terms with clicks (Search + Performance Max) with triggering keyword, status and metrics; highest cost first; cost on terms with no conversions. Example: {"customer_id":"123-456-7890","date_range":"2026-09-01..2026-09-30"}
cursormax_rowsdate_rangead_group_idcampaign_idcustomer_idrequiredinclude_pmax_categoriesBudgets and bidding
Budgets with the campaigns sharing each, and portfolio bid strategies with their targets and campaigns: what a budget or strategy change touches. Example: {"customer_id":"123-456-7890"}
cursormax_rowscustomer_idrequiredNegatives
Negative keywords on ad groups and campaigns, shared negative lists (keywords, links) and account-level negatives and exclusions. Example: {"customer_id":"123-456-7890"}
cursormax_rowscustomer_idrequiredAds and assets
Ads (RSA texts with pinning and labels, URLs, ad strength, policy) and asset links (sitelinks, callouts, snippets, images...) on account, campaigns, ad groups. Example: {"customer_id":"123-456-7890","kind":"ads"}
kindcursorstatusmax_rowsdate_rangead_group_idcampaign_idcustomer_idrequiredAudiences
User lists (type, status, size, targeted or not) and audience targeting/exclusions on campaigns and ad groups, with metrics. Example: {"customer_id":"123-456-7890"}
kindcursormax_rowsdate_rangead_group_idcampaign_idcustomer_idrequiredConversions
Conversion actions (status, category, primary, counting, attribution, values) with conversions in the range; account/campaign goals; value rules. Example: {"customer_id":"123-456-7890"}
cursormax_rowsdate_rangecustomer_idrequiredChange history
Who changed what, when (1-28 days; Google keeps 30): resource, operation, fields, tool; users as "user at domain". Example: {"customer_id":"123-456-7890","days":7}
dayscursormax_rowscampaign_idcustomer_idrequiredresource_typeKeyword ideas
Keyword Planner ideas from seed keywords and/or a URL: searches, competition, bids. Needs Basic/Standard access. Example: {"customer_id":"123-456-7890","keywords":["trail running shoes"]}
urlkeywordslanguagecustomer_idrequiredmax_resultsgeo_target_idsinclude_search_partnersDescribe a GAQL resource
Fields of one GAQL resource from Google's field catalogue (type, selectable, filterable, sortable, enum values) plus the metrics and segments you can select with it. Example: {"resource":"campaign"}
cursormax_rowsresourcerequiredBuild account snapshot
Reads everything the checks need (90 days) into a saved snapshot (kept 24 h; a complete one under 60 min old is reused unless refresh:true). Returns its id and how each read went; failed or cut reads are said. Then run_checks. Example: {"customer_id":"123-456-7890"}
checksrefreshcustomer_idrequiredRun account checks
Runs the checks on a snapshot (snapshot_id) or on customer_id (reuses one under 60 min old unless refresh). Findings first, with evidence and severity, paged by next_cursor; after the last finding: info (not faults), clean, not_run (why) and suppressed (why). For an audit, call again with next_cursor until it is null and report every finding in the audit report format (server instructions, weekly_audit prompt), never only the main points. A keyword id looks like "<ad_group_id>~<criterion_id>"; pause_keyword takes it as two fields (ad_group_id, criterion_id). Example: {"snapshot_id":"snap_..."}
cursordetailrefreshsettingsbrand_termscustomer_idsnapshot_idclient_contextExplain a check
What one check looks for, the data it needs, its settings with defaults, and when it cannot run. Tell the user in plain words what it looks for and what it needs; do not suggest settings overrides or how to fix things. Example: {"check_id":"BB02"}
check_idrequiredPropose a change
Builds one change, checks it with Google (validate only), never applies. params schema per type: schema://changes/{type}. Returns diff, risk, change_id; then apply_change.
typerequiredparamsrequiredreasoncustomer_idrequiredApply an approved change
Sends a proposed change once a person approves it: opens an approval page in the user's browser (approve there, or type its code when asked), sends once, reads back.
change_idrequiredPropose an undo
Proposes a change restoring the values from before an applied change. Needs its own approval via apply_change.
change_idrequiredGet a change
One change: status in plain words, diff, approval, result. An in_doubt change is re-checked by reading.
change_idrequiredList changes
Recent changes, newest first: id, type, status in plain words, account, a one-line summary and times. get_change shows one change in full.
limitstatuscustomer_idSettle an unclear change
Settles an in_doubt change after the user checked Google Ads (outcome + note). A person confirms on the approval page or types its code. Sends nothing.
noterequiredoutcomerequiredchange_idrequired90% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
npx [email protected] initgit clone https://github.com/vilovibe/perfoads-mcp.gitcd perfoads-mcppnpm install --frozen-lockfile && pnpm buildnode packages/cli/bin/perfoads-mcp.js init{ "mcpServers": { "perfoads-mcp": { "command": "npx", "args": ["-y", "perfoads-mcp@<version>", "serve"] } }}claude mcp add --scope user perfoads-mcp -- npx -y perfoads-mcp@<version> serve/plugin install perfoads --marketplace vilovibe/perfoads-mcpnpx perfoads-mcp@<version> policy check # is it valid, and what does it allow?npx perfoads-mcp@<version> policy show # what the server uses nowperfoads-mcp init guided setupperfoads-mcp auth sign in again (uses the saved OAuth client)perfoads-mcp doctor check the setupperfoads-mcp reset delete the saved sign-in and its key (asks first)perfoads-mcp serve run the MCP server over stdio (AI apps start this)perfoads-mcp approve <change_id> approve with the code from the approval page (terminal only)perfoads-mcp reject <change_id> reject a proposed change (terminal only)perfoads-mcp approvals open <id> show a change's approval page from this terminalperfoads-mcp policy check [file] check a policy file and say what it allowsperfoads-mcp policy show the change policy the server uses now