B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
App connector · Data & databases, Web & browsing
google-ads-meta-ads-mcp
Google Ads MCP server + Meta Ads MCP (Facebook Ads MCP) + Google Analytics MCP (GA4) + Search Console in one hosted remote MCP for Claude, ChatGPT, Cursor & n8n: OAuth login, no API keys, approval-gated writes, 7-day free trial. By Ryze AI.
Bottom line: Signal-based grade (4/7 points): very widely starred on GitHub, public source code. This reflects adoption and transparency, not a code audit.
- Popularity score
- 42/100
- Rank
- #279 of 500
- GitHub stars
- 5.1k
What it does
Unified MCP server connecting Claude, ChatGPT, Cursor, and n8n to Google Ads, Meta Ads, Google Analytics (GA4), and Google Search Console through a single OAuth-authenticated interface. Handles read operations freely and gates write operations through an approval system, eliminating the need to manage raw API keys.
Who it’s for
Marketing teams and builders who need AI agents to analyze ad performance, manage campaigns, and pull analytics insights without handling credential management directly. Executives seeking streamlined AI-driven marketing automation with governance controls.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/irinabuht12-oss/google-ads-meta-ads-mcp (opens external site) for current setup instructions. Likely involves OAuth connection through the hosted service dashboard and configuration in Claude Desktop's mcpServers JSON or equivalent platform settings. A 7-day free trial is available.
Risks
- OAuth scope creep: Approval-gated writes mitigate some risk, but broad OAuth scopes can expose campaign management and analytics data to prompt injection if agent instructions are compromised.
- Third-party credential custody: Credentials are stored by Ryze AI's hosted service rather than locally, introducing supply-chain risk if the service is breached or governance changes.
- Data exfiltration via agents: Malicious or confused agent prompts could extract sensitive advertising spend, campaign strategy, or customer data from GA4 and Search Console.
- Approval workflow bypass: Depends on the robustness of the approval gate implementation; weak logging or race conditions could allow unauthorized writes.
- Vendor lock-in and continuity: Reliance on Ryze AI's hosted infrastructure means service unavailability, shutdown, or pricing changes directly impact agent functionality.
How to stay secure
Least-privilege permissions
- Restrict OAuth scopes to read-only where possible. Ask Ryze AI which scopes (permissions) are strictly necessary for your use case, and disable analytics write access if you only need to view campaign data.
- Use separate user accounts for agent access. Create a dedicated Google Ads and Meta Ads account with minimal permissions—only what the AI agent needs—rather than connecting your main admin account.
- Rotate approval-gate administrators regularly. Limit who can approve writes (e.g., budget changes, campaign pauses) to 1–2 trusted people, and review this list quarterly.
- Request read-only API tokens when available. If Ryze AI offers limited-scope tokens instead of full OAuth, use those for analytics queries to reduce blast radius if credentials leak.
Network isolation
- Restrict agent access by IP address. If possible, configure Ryze AI to only accept connections from your company's office or VPN, not the public internet.
- Use a dedicated workspace or team in Claude/ChatGPT. Keep the MCP connector in a separate workspace from general-purpose chat to limit cross-contamination if one user's chat session is compromised.
- Disable agent internet access outside the MCP. Prevent the AI from making HTTP calls to other services; restrict it to Ryze AI's hosted connector only.
- Request audit logs of all connections. Ask Ryze AI to provide logs showing which Claude/ChatGPT sessions, n8n workflows, or Cursor instances accessed your ads data and when.
Monitoring
- Review approval logs weekly. Check the list of writes the MCP approved (e.g., budget changes, paused campaigns) and ensure none are suspicious or unauthorized.
- Set up spend alerts in Google Ads and Meta Ads. Configure notifications if daily or campaign budget exceeds a threshold, to catch accidental over-spending from agent actions.
- Monitor unusual GA4 and Search Console queries. Track if the agent is querying unexpected date ranges, metrics, or customer segments that don't match your normal reporting.
- Audit Ryze AI's own access logs monthly. Request proof that Ryze AI engineers have not accessed your connected accounts, and verify their data retention and deletion policies.
Red flags to watch for
- Unexpected campaign or budget changes without approval records. If a campaign was paused or budget was cut, but the approval log is empty or vague, escalate immediately.
- Large or strange data exports requested by the agent. If Claude, ChatGPT, or n8n suddenly asks to pull all customer data, all historical spend, or PII from GA4, reject and review the agent prompt.
- Ryze AI asking for higher OAuth scopes or storing credentials locally. If they request write access to ad accounts or want you to save API keys, that increases risk—clarify why and document the reason.
- Service outages or slow approvals. If the approval gate suddenly stops working or takes hours, the MCP may be compromised; disconnect and contact Ryze AI support
Alternatives
- native API libraries (e.g., google-ads-node, facebook-business-sdk) – Full control and transparency, but requires manual credential management and MCP wrapping.
- Zapier + Make integrations – Lower-code orchestration for ad account actions, though less AI-agent-native and subject to their approval workflows.
- n8n self-hosted connectors – Build your own MCP wrapper around Google/Meta APIs for full control, higher implementation burden.
- LangChain/Anthropic official integrations – When available, reduce third-party dependencies, though may lag behind native API feature parity.