Google, Meta, TikTok Shipped MCP Servers. Now What?

For two years, "should we let AI agents touch ad platforms?" was a debate. Then, in the space of eight months, Google, Amazon, Meta and TikTok all answered it by shipping official MCP servers. The debate is over — the Model Context Protocol, an open standard first published by Anthropic in late 2024, is now ad-industry infrastructure. What remains genuinely open, and genuinely interesting, is what each platform chose to let an agent do. The choices differ sharply, and the differences map exactly onto where third-party connectors still matter.

Eight months that settled the protocol question

Google's Ads API team open-sourced a Google Ads MCP server in October 2025. Amazon shipped an ads MCP server in open beta in February 2026. Meta launched its hosted Ads AI Connectors in April. TikTok announced its Ads MCP server at TikTok World in May, alongside an agent-skills SDK. Four platforms, four independent conclusions that agents are a first-class client of an ad account — reached fast enough that none of them can have been following the others' results, only the same pressure from advertisers already wiring agents up through unofficial means.

The timing was not mysterious. By the time the ad platforms moved, the protocol had already won the client side — the major AI vendors had adopted MCP across their assistants and coding tools through 2025, which meant every platform's advertisers were showing up holding compatible clients and community-built connectors of uneven quality. Shipping an official server stopped being a bet on a protocol and became basic custody of the platform's own integration surface.

What each official server actually contains

Platform	Shipped	Access model	Capability	Hosting
Google Ads	Oct 2025	Your API credentials + developer token	Read-only: 3 tools (list accounts, GAQL search, metadata)	Self-hosted
Amazon Ads	Feb 2026	Amazon Ads auth	Read/write across campaigns and billing	Platform-provided
Meta	Apr 2026	Business OAuth, tiered scopes	Read/write, new entities paused by default	Hosted endpoint
TikTok	May 2026	TikTok Ads API auth	Full campaign lifecycle	Platform-provided

The spread is the story. Google — the platform with the most spend at stake — drew the line at reads: three tools plus a handful of metadata resources, mutations deliberately excluded, changes routed to the ordinary API instead. Meta ships a genuinely broad surface — dozens of tools spanning catalogue, insights, campaign management and tracking diagnostics — but makes new entities arrive paused. TikTok markets the full lifecycle, campaigns built and optimised by agents, with a skills SDK alongside for developers building on it. Same protocol, three different answers to the question what happens when the agent is wrong?

Note also what every one of them assumes: you bring the credentials, you define the governance. Official servers authenticate you and expose capability; none of them ships an approval workflow, a cross-platform audit trail, or an opinion about which of your team members may touch which accounts. The platforms solved protocol access. Operational safety remained, deliberately, the customer's problem.

Why Google stopped at read-only

No platform explains its own caution, so reason from incentives — and label it as reasoning, which this is.

Liability flows uphill. An official write tool makes every agent mistake a platform support case — "your server let the AI empty my budget". Reads carry no such tail. A read-only server democratises data while transferring zero risk, which for a platform of Google's size is the whole trade.

Google already sells the write path. Performance Max, AI Max and the advisor agents are Google's automation products — inside the product, under Google's guardrails, optimising toward Google's definitions. An official external write channel would hand that surface to whichever agent the advertiser prefers. You do not build a door for your competitor's salesman.

Support economics. Every write tool is documentation, edge cases, and an on-call rotation. Three read tools are none of those things.

Meta's paused-by-default writes show the middle path exists. That Google declined it anyway tells you the read-only choice is strategy, not timidity — and strategy changes slowly.

The write layer: what the official servers leave open

For Google Ads, the official position leaves a precise gap: everything between reading and regretting. Teams want an agent that can act — add the negatives it found, create the campaign it drafted, change the budget it argued for — under governance that makes acting safe. That governance is a product in itself, and it is where hosted connectors live. The checklist worth demanding from anything write-capable:

• Approval by default — every write surfaced in the client before it executes, reads flowing freely.
• No delete, structurally — remove tools absent from the list and REMOVED-status mutations refused server-side, not promised away in a prompt.
• An audit trail — every call recorded with tool, account, outcome and timestamp, including refusals.
• Scoping and seats — per-member sign-in, per-connector account restrictions, a kill switch that works in one action.
• Nothing to host — the point of an agent is less operations, not a new server to run.

That is the standard AdCopilot was built against, and the honest framing is complementary, not competitive: Google's server answers "can agents see the account?" — the write layer answers "can they be trusted to change it?" The two even compose: nothing stops a team using Google's server for heavy custom GAQL work in a developer's client while the operators run reads and governed writes through a hosted connector. The mistake is only in believing the first covers the second.

What to do about it this quarter

For a working advertiser, the official servers change the near-term checklist more than the tooling:

1. Audit what is already connected. MCP made connecting easy, which means someone on the team may have done it without a decision being made. Inventory which AI clients hold which ad-platform access today.
2. Split reads from writes on purpose. Reads are now commodity — free, official, safe. Decide separately, per platform, whether an agent may change things, under what approval, and with which accounts in scope.
3. Demand the governance list — approval, audit, scoping, no-delete — from any write-capable connector, official or third-party, before it touches a live account. Meta's paused-by-default is one item of five, not the list.
4. Put agent access in the client-agency conversation. Whose seat, whose audit trail, and who revokes what at handover — questions that now have concrete answers and belong in the contract.

Our predictions for the next twelve months — clearly labelled ours

These are inferences from incentives, not announcements. One: Google keeps its MCP server read-only or close to it, and routes write-shaped automation through its own advisor surface instead — the agent Google wants changing your account is Google's. Two: Meta's beta hardens into tiers, and pricing appears once usage proves out. Three: the first well-publicised agent-overspend incident on a write-capable official server pushes the industry toward approval-style guardrails as the norm rather than the differentiator. Four: MCP support becomes a procurement checkbox for ad tooling, the way API access was a decade ago — at which point the differentiation question stops being whether a tool speaks MCP and becomes what it refuses to do. The year's running context lives in what actually changed in Google Ads in 2026.

The platforms have voted: agents are clients now. The remaining choice is yours — which agent, holding which capabilities, under whose governance — and it is a better choice than it was a year ago, because the official servers made the baseline free and the differences legible. Start a free pilot to try the governed write layer on your own account: 7 days, up to five accounts, no card.