Amazon Ads

The film shows hosted getmcpads with sample data. Its MCP Apps, from creative galleries and alerts to Google Sheets exports and bulk launches, belong to the hosted product. This repository provides the standalone native API tools.

31 read tools · 77 write tools, disabled by default.

Run locally with your own Login with Amazon application and a client that supports stdio MCP, such as Claude Desktop, Claude Code or Cursor. Your requests go directly to the Amazon Ads API. For managed connections, including supported ChatGPT setups, use the hosted option.

What's new

v1.0.1: Zod 4 security update · October 26, 2026

• Update zod to 4.6.7. Every Zod release before 4.6.6 is covered by the high-severity advisory GHSA-mrhx-c7xc-m3w5: validating an oversized constrained collection can exhaust memory, and no Zod 3 release carries the fix. npm audit --omit=dev reports no vulnerability again.
• Keep the Zod 3 validation behaviour. A parameter default is still validated and completed before use, so an omitted object must still supply its required fields.
• Keep each parameter's own description when the parameter is optional or has a default. Zod 4 stores a description on the wrapped schema only, so the shared fallback description could otherwise replace it.
• Tool names, parameters and descriptions published over MCP are unchanged. server-card.json is regenerated with Zod 4's JSON Schema output, which spells some constraints differently.

Earlier releases

Full changelog · All releases

Source synchronization: SOURCE_SYNC.md.

Upgrade notes

Requires Node.js 22.23.4, 24.22.1, 26.12.1 or a newer release. These carry the October 2026 security fixes, and the server prints a warning on stderr when it runs on an older one. CI covers Node 22, 24 and 26.

This is the first release. Arguments saved from hosted getmcpads use region-qualified account IDs such as EU:1234567890; they are accepted when the region matches AMAZON_ADS_REGION.

Install this release

This is a GitHub source release. npm and MCP Registry versions are published separately. The commands below select this exact version; unpinned npx examples later in this document select the version currently available on npm.

git clone --branch v1.0.1 --depth 1 https://github.com/get-mcp-ads/amazon-ads-mcp-server.gitcd amazon-ads-mcp-servernpm cinpm run build

Configure your MCP client to run node with the absolute path to dist/cli.js and the credentials documented below.

Prefer a managed connection? Use Amazon Ads with hosted getmcpads. Connect your account, select the data your assistant may access and use the hosted MCP connection. See the site for current features and plans.

Configuration

Provide these environment variables through the client's secret configuration:

To obtain these values, follow Amazon's own guides:

1. Onboard to the Amazon Ads API and note the client ID and secret of your Login with Amazon security profile.
2. Create an authorization grant with the scope advertising::campaign_management, then generate access and refresh tokens. Amazon documents that refresh tokens issued on or after July 30, 2026 expire 365 days after advertiser consent.
3. Retrieve your profile IDs and list the ones this server may use in AMAZON_ADS_PROFILE_IDS.

This package does not run an OAuth browser flow. It exchanges the refresh token for access tokens in memory, renews them a minute before they expire and keeps any refresh token Amazon returns in memory only. When the refresh token is revoked or expires, authorize again, update the variable and restart the server.

A Claude Desktop entry looks like this:

{  "mcpServers": {    "amazon-ads": {      "command": "npx",      "args": ["-y", "@getmcpads/amazon-ads-mcp-server"],      "env": {        "AMAZON_ADS_CLIENT_ID": "amzn1.application-oa2-client.your-client-id",        "AMAZON_ADS_CLIENT_SECRET": "your-client-secret",        "AMAZON_ADS_REFRESH_TOKEN": "Atzr|your-refresh-token",        "AMAZON_ADS_REGION": "EU",        "AMAZON_ADS_PROFILE_IDS": "1234567890"      }    }  }}

With a source install, replace npx and its arguments with node and the absolute path to dist/cli.js. Run npm run doctor to check the configuration without contacting Amazon; it never prints a value.

Safety and coverage

Writes preview by default. Most writes return a previewToken bound to the exact change and to the entity as read from Amazon at preview time. Repeat the call with confirm: true and that token within ten minutes. A changed request, a changed entity or an expired token is refused before anything is sent. amazon_ads_update_campaign_status uses expectedStatus from its preview instead, and the rename tools need only confirm: true.

New Sponsored Products campaigns, ad groups, product ads, keywords and targets are created paused. Sponsored Brands and Display creates that carry a state must be paused, and creates without a state field require a paused parent. Negative keywords and targets start enabled because they suppress traffic. Previews mark a change that starts delivery with activationMaySpend. Archiving is irreversible.

An HTTP 207 response with any item error is reported as a failure. A change whose outcome is uncertain is never retried automatically; read the entity and reconcile it first. A read that receives HTTP 401 renews the access token once and repeats; a change does not. HTTP 429 responses report Amazon's Retry-After value and are not retried.

The profile allowlist is checked before every request, and amazon_ads_list_profiles returns only allowlisted profiles. Unknown arguments are refused. Amounts are in the profile currency, not micros. Large integer IDs are kept as strings so no digit is lost. Configuration lists return one page and say so with partial; follow nextToken or nextStartIndex.

Reports are asynchronous. amazon_ads_create_report returns a jobToken; call amazon_ads_get_report about 30 seconds later. A pending report is not an empty account. Sponsored Products purchases and sales use the click attribution window you choose. Brands and Display use their native 14-day attribution. Report files and asset uploads use signed Amazon S3 URLs, which must be HTTPS S3 hosts, are fetched without any Amazon credential and never follow a redirect.

This server covers Sponsored Products, Sponsored Brands, Sponsored Display, Reporting v3, the creative asset library and product metadata. It does not cover DSP, Amazon Marketing Cloud, billing, account management or portfolios. Hosted creative galleries, alerts, exports, the campaign launcher and MCP Apps UI are excluded. Use tools/list, server-card.json or the amazon-ads://write-contracts resource for exact schemas, and Amazon's API reference for provider details.

Amazon's own MCP server

Amazon announced the Amazon Ads MCP Server in open beta on February 2, 2026, for Amazon Ads partners with active API credentials. The comparison below uses only Amazon's own pages: the announcement, the overview, Connecting to the Amazon Ads MCP Server, the Lite version, Connecting using OAuth 2.1 and the MCP tool reference, as read on October 23, 2026.

Use Amazon's server for DSP, Amazon Marketing Cloud, billing or account management, which this server does not cover.

Hosted option

getmcpads for Amazon Ads manages the hosted connection and account selection. Hosted and source releases can differ. Contact: [email protected].

Development

npm run typechecknpm run lintnpm run buildnpm testnpm run catalog

All tests run offline with a mocked fetch and synthetic responses. No live account is read or changed.

Tools

Every tool is listed below. See server-card.json for complete parameter and output schemas.

Resources

License

Apache License 2.0. See NOTICE.

More from getmcpads

Meta Ads · Google Ads · Google Analytics 4 · Google Search Console · TikTok Ads · Pinterest Ads · X Ads

Maintained by Emmanuel at getmcpads. Questions: [email protected].