PlaybookAdvanced25 min read22 September 2026

Put Your Ad Budget on Trial

Make your AI check the spending before you increase it.

In short

Install Google's open-source Google Ads MCP connector, authorize a Google account with appropriate access, and connect it to a desktop AI app that supports local MCP. Run Prompt 1 to check data quality, investigate spending and save a baseline. Make approved changes yourself in Google Ads and record them. After a suitable measurement window, run Prompt 2 with that baseline and change log to decide what to keep, reverse, investigate or test next. The connector and Google Ads API have no usage fee, but model usage, your computer and any optional hosting have their own costs. This is analysis and decision support, not automatic campaign execution or guaranteed savings.


What you will build

You will give your AI access to advertising reports so you can ask where money is going, which findings deserve attention, and whether a proposed change is supported by the numbers. You will keep control of the live account.

The cycle: Connect once → audit → save the evidence → approve and make a change → wait for usable results → re-analyze → choose the next action.

The three files you keep: Audit Baseline, Change Log, and Follow-up Review. Save them in a private local folder or your existing approved document system. No new paid dashboard or spreadsheet connector is required. An AI conversation is not a reliable substitute for saved records.

Who this is for: people with an existing Google Ads account, permission to analyze it and useful campaign history. Start with one Search account. Performance Max, Shopping and other campaign types do not expose identical reports or support identical conclusions.

Choose your AI app before installing. Astra is the model named in this workflow. Its host app must support launching a local MCP server and reading its tool responses. A model name by itself does not confirm that support. Do not assume your Astra app has a particular connector menu. If it accepts local stdio MCP, use the server settings below in that app's documented configuration. If it only accepts remote URLs, this local setup will not work there.

Concrete desktop route: the steps below use Claude Desktop on macOS or Windows because its local configuration is documented. In Claude Desktop you are using Claude, not Astra. The same two prompts work with either model when its host has this connector working. Do not buy or switch subscriptions until you have checked your host's connector support and organization policy.


Understand the safety boundary first

MCP is the connection between the AI app and a small program on your computer. That program asks the Google Ads API for reports. The AI then interprets those reports. Local installation does not make the AI private or offline: report data is exposed to the AI service you connect.

The pinned connector exposes reporting tools, not campaign-editing tools. However, Google Ads has no separate read-only OAuth scope. The Google authorization is broader than the operations this connector exposes. A read-only tool label is not an account-level security guarantee.

  1. Prefer a dedicated Google user that has Read-only access to the advertising account. Ask the account administrator to grant access through Google Ads Access and security. Use an authorized account, never another person's shared password.
  2. Do not add browser-control or campaign-editing tools to this audit session. The prompts prohibit changes, but a prompt alone is not an access-control system.
  3. Review your AI provider's data handling and organizational rules before sending client or business data. Customer-level records, emails and audience lists are not needed for this workflow.
  4. Keep credential files and developer tokens out of chats, screenshots, shared documents and Git repositories. Keep the setup folder outside a shared or publicly synced directory.
  5. Make changes separately in Google Ads using the normal authorized editor account. Keep the auditing identity read-only where possible.

Source: authorization scope and credential handling · Official connector


Prepare your accounts and computer

You needWhat it means
A Google Ads customer IDThe advertising account's number, visible in Google Ads. Use digits without hyphens in the connector. A manager account's ID is a different number.
A Google Cloud projectA container for API settings and your sign-in configuration. It is not a new advertising campaign.
Production API accessA test-only API setup cannot query a live advertising account. Check the project's access level and, if using a developer token, that token's access level too.
Python 3.10 or newerRuns the connector. Use a current supported Python version from python.org with pip and virtual-environment support.
Google Cloud CLIThe gcloud command signs you into the API from your computer. Install it from Google's official instructions for your operating system.
A supported desktop AI appClaude Desktop, or an Astra host with documented local stdio MCP support. Organization administrators may restrict connectors.

Cost: the connector is Apache-2.0 open-source software. Google's project guide states that the Google Ads API has no charge. Your AI usage and advertising spend remain separate. This guide uses your computer rather than a hosted server and does not require a GoodLads subscription.

Python download · Google Cloud CLI installation · Claude Desktop · Google project and API access guide

Make a private working folder

On Mac, open Terminal. On Windows, open PowerShell. These are apps for entering commands. Paste one line at a time and press Enter. Do not paste the commands into the AI chat. If the folder already exists, reuse it rather than deleting anything.

mkdir -p "$HOME/ads-audit"
cd "$HOME/ads-audit"
python3 --version
gcloud --version
New-Item -ItemType Directory -Force "$HOME\ads-audit"
Set-Location "$HOME\ads-audit"
py -3 --version
gcloud --version

Checkpoint: Python prints version 3.10 or newer, and gcloud prints its version. If either command is missing, complete that program's official installation and reopen Terminal or PowerShell. On Windows, select the Python launcher when installing Python. Do not continue with a missing prerequisite.


Set up Google access

Create or select the Cloud project

  1. Open Google Cloud Console. Use a Google account authorized to create or administer the project, or ask your administrator to prepare it.
  2. Use the project selector to select an appropriate existing project or create a dedicated one. Record its project ID, not just its display name.
  3. In APIs and Services → Library, find Google Ads API and enable it for that project.
  4. Open the Google Ads API access-level instructions and check the project's current status. If it only has Test access, apply for Explorer or another appropriate production level. Follow Google's current review process. Do not interpret a successful sign-in as production approval.

Developer-token branch: the current connector accepts GOOGLEADSDEVELOPER_TOKEN when your setup uses one; its README labels this optional. If your project uses the developer-token route, obtain the token from the manager account's API Center following Google's developer-token guide. Verify it has production access. A manager account is not the same thing as the client advertising account. Do not invent a token or paste a client ID in its place. If your administrator confirms your project uses the tokenless route, omit this variable entirely. When access fails, resolve the actual API error instead of randomly switching authorization routes.

Create your desktop sign-in file

Use user authorization for this guide, not a service-account key. There are two different JSON files involved: the OAuth client file identifies your desktop application; the credentials file created by gcloud stores your authorized login. Keep both private.

  1. In the same Cloud project, open Google Auth Platform. If it has not been configured, complete the application branding/contact information and audience setup. Older interfaces may call this OAuth consent screen.
  2. Choose the audience appropriate to your organization. If you use an External app in Testing, add the Google user that will read the advertising account as a test user. Organization policies may require an administrator.
  3. In Data Access or the scope configuration, include the Google Ads scope: https://www.googleapis.com/auth/adwords. The login command below also requests cloud-platform, as in the connector's official ADC example. Neither scope automatically gives a user roles they do not possess, but the request is not restricted to read-only Ads operations.
  4. Open Clients → Create client, choose Desktop app, give it a descriptive name, and download the JSON file. Do not choose Web application for this local route.
  5. Move the downloaded file into your private ads-audit folder and rename it oauth-client.json. Ensure it is not accidentally named oauth-client.json.txt. Do not open it in the AI chat.

Google's OAuth client creation instructions. Menu labels may change; the required object is an OAuth client of type Desktop app. A managed organization's approval requirements cannot be bypassed with these commands.

Authorize the Google user

Run the appropriate single-line command below while still in the ads-audit folder. A browser sign-in opens. Select the Google account that has permission to read the intended Ads account. Read the consent screen before agreeing. If it shows an unfamiliar app or publisher, stop. Do not bypass a security warning for an app you did not create or have approved.

gcloud auth application-default login --scopes=https://www.googleapis.com/auth/adwords,https://www.googleapis.com/auth/cloud-platform --client-id-file="$HOME/ads-audit/oauth-client.json"
gcloud auth application-default login --scopes=https://www.googleapis.com/auth/adwords,https://www.googleapis.com/auth/cloud-platform --client-id-file="$HOME\ads-audit\oauth-client.json"

Checkpoint: the terminal reports that credentials were saved and prints a file path. Copy only the path into your private setup notes. This generated credentials path, not oauth-client.json, goes in GOOGLEAPPLICATIONCREDENTIALS below. This command changes your local Application Default Credentials; coordinate first if other tools already rely on them. Ordinary gcloud auth login alone does not create the same credential setup.

If the app is in Google's External Testing mode, authorization can expire and require renewal. Treat repeated invalid_grant errors as an authorization issue; do not expose credentials to an AI in order to troubleshoot them. See Google's ADC documentation.


Install the connector locally

Use a dedicated Python environment so this installation does not replace packages used by other projects. These commands install a fixed source snapshot rather than silently taking whatever code appears on the main branch later. The snapshot is 7a40eae9655194a84d5291c63af817bb20d02ea8, package version 0.0.3. The three accompanying package versions below are pinned for this setup; other dependencies still resolve during installation.

cd "$HOME/ads-audit"
python3 -m venv .venv
./.venv/bin/python -m pip install --upgrade pip
./.venv/bin/python -m pip install "https://github.com/googleads/google-ads-mcp/archive/7a40eae9655194a84d5291c63af817bb20d02ea8.zip" "google-ads==32.0.0" "fastmcp==4.0.3" "mcp==2.2.0"
./.venv/bin/python -m pip check
./.venv/bin/python -m pip show google-ads-mcp
printf '%s\n' "$HOME/ads-audit/.venv/bin/google-ads-mcp"
Set-Location "$HOME\ads-audit"
py -3 -m venv .venv
.\.venv\Scripts\python.exe -m pip install --upgrade pip
.\.venv\Scripts\python.exe -m pip install "https://github.com/googleads/google-ads-mcp/archive/7a40eae9655194a84d5291c63af817bb20d02ea8.zip" "google-ads==32.0.0" "fastmcp==4.0.3" "mcp==2.2.0"
.\.venv\Scripts\python.exe -m pip check
.\.venv\Scripts\python.exe -m pip show google-ads-mcp
(Resolve-Path ".\.venv\Scripts\google-ads-mcp.exe").Path

Checkpoint: installation finishes without an error; pip check reports no broken requirements; pip show reports version 0.0.3. The final line prints the server's full executable path. Save that path privately. Do not use pip install google-ads-mcp alone and assume it installs the same code.

The next one lands in your inbox before it lands here.

One email a week. What I tested.

Subscribe
Put Your Ad Budget on Trial · Playbooks · Steve Tan