Meta Ads

The film shows hosted getmcpads with sample data. Its MCP Apps, from creative galleries and alerts to Google Sheets exports and bulk launches, belong to the hosted product. This repository provides the standalone native API tools.

42 read tools · 24 write tools, disabled by default.

Run locally with your own platform credentials and a client that supports stdio MCP, such as Claude Desktop, Claude Code or Cursor. Your requests go directly to the platform. For managed connections, including supported ChatGPT setups, use the hosted option.

What's new

v2.1.1: Zod 4 security update · October 26, 2026

• Update zod to 4.6.7. Every Zod release before 4.6.6 is covered by the high-severity advisory GHSA-mrhx-c7xc-m3w5: validating an oversized constrained collection can exhaust memory, and no Zod 3 release carries the fix. npm audit --omit=dev reports no vulnerability again.
• Keep the Zod 3 validation behaviour. A parameter default is still validated and completed before use, so an omitted object must still supply its required fields.
• Keep each parameter's own description when the parameter is optional or has a default. Zod 4 stores a description on the wrapped schema only, so the shared fallback description could otherwise replace it.
• Tool names, parameters and descriptions published over MCP are unchanged. server-card.json is regenerated with Zod 4's JSON Schema output, which spells some constraints differently.

Earlier releases

Full changelog · All releases

Source synchronization: SOURCE_SYNC.md.

Upgrade notes

Requires Node.js 22.23.4 or newer on the 22 line, 24.22.1 or newer on the 24 line, or 26.12.1 or newer. These releases carry the October 2026 security fixes. On an older runtime the server still starts and writes a warning to stderr. CI covers Node 22, 24 and 26. meta_health_check now reports a check it could not run as unknown, not as missing. Read the current tool schemas before reusing saved arguments. Writes remain optional and require explicit confirmation. Hosted creative integrations and MCP Apps UI are outside this release.

Install this release

This is a GitHub source release. npm and MCP Registry versions are published separately. The commands below select this exact version; unpinned npx examples later in this document select the version currently available on npm.

git clone --branch v2.1.1 --depth 1 https://github.com/get-mcp-ads/meta-ads-mcp-server.gitcd meta-ads-mcp-servernpm cinpm run build

Configure your MCP client to run node with the absolute path to dist/cli.js and the platform credentials documented below.

Prefer a managed connection? Use Meta Ads with hosted getmcpads. Connect your account, select the data your assistant may access and use the hosted MCP connection. See the site for current features and plans.

What you get

The query planner

Meta rejects many metric/breakdown combinations, and the error messages rarely say why. This server encodes the compatibility matrix, so it splits an impossible request into several valid API calls and merges the results instead of failing.

meta_validate_query lets the model check a combination before spending a call on it. That is the difference between an assistant that reports "the API returned error 100" and one that returns your numbers.

Getting a token

This is the one step that takes real effort, and it's worth doing properly.

You need a Meta access token with ads_read. There are three ways to get one; the second is the one we recommend.

Recommended: System User token (does not expire)

A System User belongs to your Business, not to a person. Its token survives password changes and staff departures, and needs no App Review to access ad accounts your Business already owns.

1. Go to Business Settings → Users → System Users
2. Add a system user. Give it the Employee role unless you need more.
3. Assign Assets → select your ad accounts → grant View performance (add Manage campaigns only if you plan to enable writes).
4. Generate New Token → pick your app → select scope ads_read (add ads_management only for writes).
5. Set the expiry to Never.
6. Copy the token. Meta shows it once.

📖 Meta's System User documentation

Quick test: Graph API Explorer (expires in ~1 hour)

Fine for trying the server out, useless for daily work. Graph API Explorer → select your app → add ads_read → Generate Access Token.

Long-lived user token (~60 days)

Exchange a short-lived token for a 60-day one. You will have to redo this every two months. 📖 Long-lived tokens

Which permissions?

Run meta_health_check as your first call: it reports which scopes you actually have and which ones are missing for the tools you tried to use, without printing your token.

Setup

Claude Desktop

~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{  "mcpServers": {    "meta-ads": {      "command": "npx",      "args": ["-y", "@getmcpads/meta-ads-mcp-server"],      "env": {        "META_ACCESS_TOKEN": "your-token-here"      }    }  }}

Restart Claude Desktop. Ask it: "list my Meta ad accounts".

Claude Code

claude mcp add meta-ads --env META_ACCESS_TOKEN=your-token-here -- npx -y @getmcpads/meta-ads-mcp-server

Cursor

.cursor/mcp.json in your project, same shape as the Claude Desktop config above.

From source

git clone https://github.com/get-mcp-ads/meta-ads-mcp-server.gitcd meta-ads-mcp-servernpm install && npm run buildcp .env.example .env   # then fill in META_ACCESS_TOKENnpm start

Configuration

Check your setup at any time:

npm run doctor

Writes, and why they preview first

Write tools are disabled by default. Enable them with META_ENABLE_WRITES=1.

When enabled, every write tool returns a preview and changes nothing:

// meta_update_adset_budget { adSetId: "123", currency: "EUR", dailyBudget: 50 }{  "applied": false,  "action": "meta_update_adset_budget",  "change": { "adSet": "123", "field": "daily_budget", "amount": 50,              "currency": "EUR", "inMinorUnits": 5000 },  "message": "Preview only, nothing was changed. Repeat the same call with confirm: true to apply this change to the live account."}

Only a second call carrying confirm: true touches the live account.

This is deliberate. An assistant composes these calls, and it can pick the wrong account, the wrong campaign, or the wrong order of magnitude on a budget. A mandatory preview makes the mistake visible before it costs money, and gives a human the stopping point the protocol does not guarantee on its own.

Two further guardrails:

• meta_create_campaign always creates the campaign PAUSED. There is no option to create it active.
• Budgets are converted to minor units per currency. The yen, the won and the CFA franc have no subunit, so sending 1250 for ¥12.50 would multiply the spend by a hundred. The server knows the zero-decimal currencies.

Tools

Every tool is listed below. See server-card.json for complete parameter and output schemas.

Security

The server holds a credential that can read live ad accounts, and modify them when writes are enabled. Concretely:

• The token is never logged, at any log level, and never written to disk.
• Requests go only to graph.facebook.com on the pinned version. Any other host is refused rather than called. Covered by tests.
• Redirects are refused once a token is attached, so a redirect cannot forward your credential elsewhere. Covered by tests.
• No telemetry. The server makes no network call other than to the Graph API. There is no analytics, no phone-home, and no usage reporting. You can verify this by grepping the source for fetch.

Full policy and reporting instructions: SECURITY.md.

Looking for a managed, multi-platform version?

Try hosted Meta Ads if you want to use this source without operating a local server. getmcpads also connects advertising, Search Console and GA4 through one MCP URL. Source availability and plan limits are listed on the site; connecting an account is still required.

1. Follow the Meta Ads connection guide.
2. Select the account or property your assistant may read.
3. Connect Claude, ChatGPT or Codex.
4. Try a read-only review: “Compare campaign results and investigate frequency alongside CTR. State missing data and do not change anything.”

See the current hosted tool catalogue and pricing before choosing a paid plan. This Apache 2.0 adapter remains independently useful with your own credentials.

Contributing

Issues and pull requests are welcome. See CONTRIBUTING.md. Please read SECURITY.md before reporting anything security-related.

Licence

Apache License 2.0. See also NOTICE.

Facebook, Meta, Instagram and the Meta Marketing API are trademarks of Meta Platforms, Inc. This project is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc. It is an independent client of a public API.

MCP contracts and desktop bundle

Every tool declares read/write annotations, parameter descriptions and a structured output schema. Successful calls expose the payload as structuredContent.result; errors retain isError: true. The generated server card contains definitions only.

Run npm run bundle -- /path/to/output to build a .mcpb desktop bundle from the current catalog. Credentials are entered locally during installation. Write tools remain disabled unless explicitly enabled.

More from getmcpads

Google Ads · Google Analytics 4 · Google Search Console · TikTok Ads · Pinterest Ads · X Ads

Maintained by Emmanuel at getmcpads. Questions: [email protected].