MCP security for marketing data: read-only, scopes, and the permission you shouldn't grant
Google's Ads MCP server is read-only, yet its OAuth scope can edit and delete your account. For ad data, MCP risk lives in the token's scope.
9 min read
2 articles
Google's Ads MCP server is read-only, yet its OAuth scope can edit and delete your account. For ad data, MCP risk lives in the token's scope.
A Google Ads campaign name takes 256 characters with no documented content validation. Meta documents no maximum at all.
Leave your details and the conversation opens straight in WhatsApp.
Opening WhatsApp...