Google’s Ads MCP Server Quietly Gains Write Tools

By
Google's Ads MCP Server Quietly Gains Write Tools
Google's Ads MCP Server Quietly Gains Write Tools
Affiliate disclosure: This post contains affiliate links. If you buy through them, I may earn a commission at no extra cost to you. Full disclosure

Google’s official Google Ads MCP server can now create assets and labels inside your ad account, and Google never announced it.

If you run a Shopify store on Google Shopping and you’ve connected Claude, Cursor or any other AI assistant to your Google Ads account through this server, that assistant went from read-only to read-and-write on November 2. Google’s own documentation still calls it read-only. Here at Ecommerce Paradise, that changes how I’d set up an AI-assisted ad workflow. On a high-ticket dropshipping store, one bad sitelink or a mislabeled product group touches $2,000 orders.

Below: exactly what changed in version 0.0.6, what the server still can’t touch, the safety mechanism Google built in and why it’s weaker than it looks, and the settings I’d check this week before the Black Friday traffic hits.

An AI that can write to your ad account still needs a human checking its work. A trained virtual assistant can review every AI-proposed asset and label before it goes live, so mistakes get caught in the change log instead of the bill. Hire an ad-ops VA on OnlineJobs.ph →

Google Ads MCP Server v0.0.6 Adds 4 Write Tools Without an Announcement

Version 0.0.6 of the open-source Google Ads MCP server went live on November 2, 2026, per the release history on PyPI. It is the first version that can change anything in an advertiser’s account. PPC Land’s Luís Rijo reported the change on November 9 and said he found no Google announcement about it.

MCP stands for Model Context Protocol. It’s the plug that lets an AI assistant like Claude talk to an outside system. Google’s server sits between your AI tool and the Google Ads API, so you can ask questions in plain English instead of writing reports. I walked through where that kind of setup fits in my guide to running a leaner high-ticket store with Claude.

The release adds four write tools to the three read tools that were already there, according to the PyPI listing:

  1. create_asset creates text, image, YouTube video, sitelink, callout and structured snippet assets.
  2. upload_video_asset uploads a local video to YouTube so it can be used as a video asset. It works in local stdio mode only.
  3. manage_labels creates, updates and removes account labels.
  4. manage_label_associations adds and removes labels on customers, campaigns, ad groups and ad group criteria.

The three original tools are unchanged. Those are search, which runs Google Ads Query Language (GAQL) queries for metrics, budgets and status, list_accessible_customers and get_resource_metadata. That takes the server from three tools to seven.

The two-step write flow

Google built a guardrail into every write. Per PyPI, each write tool defaults to a “propose” step that changes nothing. The server returns a checksum, and a second call with the identical parameters plus that checksum is what actually modifies the account.

According to PPC Land, the parameter behind this is validate_only, which defaults to true. The write tools ship switched on through a file called tools_config.yaml. Setting labels and assets to false in that file turns them off.

What the server still can’t do

The list of things it can’t touch matters more than the list of things it can. Per PPC Land’s review of the code, the server still has no tools for campaigns, ad groups or ads. It can’t change budgets, bids or status. It can’t add or edit keywords. It also can’t attach the assets it creates to a campaign.

So an AI can build a sitelink, but a human (or a separate tool) still has to put it to work. It can stick a label on a Shopping product group, but it can’t pause that product group.

Google’s own docs still say read-only

Google’s developer guide for the MCP server, last updated October 30, 2026, still says: “This implementation is strictly read-only. It cannot modify bids, pause campaigns, or create new assets.” The third clause in that sentence stopped being true three days after the page was last edited.

Thomas Wismer, a Swiss Google Ads consultant, tested the new write tools in a client account on November 9, per PPC Land. That makes him one of the first practitioners on record using them in a live account.

From Two Read-Only Tools in 2025 to Seven Tools Now

Google introduced the server on October 7, 2025, in a post titled “Open Source Google Ads API MCP Server” on the Google Ads Developer Blog. It launched read-only with two tools, according to PPC Land. Version 0.0.1 hit PyPI on October 22, 2025.

Then the project sat still for almost a year. The pace picked up in September 2026, per the PyPI release dates and PPC Land’s changelog review:

  1. 0.0.2, September 9, 2026: namespaced tool names. PPC Land flagged that this can break permission lists that allow tools by their old names.
  2. 0.0.3, September 10, 2026: removed developer token validation. Google’s guide now says developer tokens are no longer needed.
  3. 0.0.4, September 25, 2026: fixed Streamable HTTP interoperability.
  4. 0.0.5, October 9, 2026: upgraded FastMCP.
  5. 0.0.6, November 2, 2026: added the four write tools.

Five releases in under two months, after nearly eleven months with one. The GitHub repository had about 1,100 stars, 356 forks and 14 contributors when PPC Land checked it.

The release lands in a crowded month for AI-run ad accounts. I covered how Supermetrics now lets Claude build ads on six platforms on November 3. A day ago, Microsoft Ads admitted its interface has problems and promised rebuilt reports. Google is moving one careful step at a time while third-party tools move faster.

Google’s own ad products keep shifting under advertisers too. On November 9 it added a new-customer-only option to manual CPC. Earlier this month it told PMax advertisers to fund brand search. An AI assistant reading your account has more moving parts to keep up with every week.

The counterpoint: the guardrail is a suggestion

The two-step propose-and-confirm flow sounds like human approval. PPC Land pointed out that it isn’t. The server can’t verify that a person approved anything. The approval step is an instruction to the AI model, not a control the server enforces.

In practice, an AI agent running on autopilot can call the propose step, read the checksum and call the confirm step on its own in the same session. Whether a human sees the change first depends on how your AI client is configured, not on Google.

There’s a fair argument on the other side. The blast radius is small. Assets can’t be attached to campaigns through the server, and nothing here touches spend. A rogue sitelink sitting unattached in your asset library doesn’t cost a dime.

What AI Write Access Means for a High-Ticket Google Shopping Account

My read is that this release is low risk today and high signal for 2027. The tools Google picked (assets and labels) are the safest things to hand an AI. They’re also the first rung on a ladder that ends with budgets and bids.

For a high-ticket store, labels are where I’d pay attention. Labels are how a lot of advertisers organize Shopping product groups by margin, brand or supplier. Automated rules and scripts often key off them, the same way Shopify’s per-channel product data decides what Google sees in your feed. If an AI mislabels a product group, a rule that says “raise bids on everything labeled high-margin” now raises bids on the wrong products. The server can’t change bids, but your existing automation can, and labels are what point it.

The hypothetical math

Here’s a hypothetical. Say your store spends $9,000 a month on Google Shopping across 400 product groups, and you sell products averaging $1,800. A VA labeling 400 product groups by margin tier at 30 seconds each spends about 3.3 hours on it. An AI agent does it in a few minutes.

Now say the agent swaps two labels and an automated rule pushes 20% more spend onto a low-margin product line for a week. That’s roughly $400 of misdirected spend on a $9,000 month. Annoying, not fatal. The same mistake in the second week of December, when CPCs are inflated, costs more.

Security belongs in the same conversation. Every connector you add is another set of credentials with access to your money, and banks have started saying so out loud. Bank of America told customers not to hand AI agents their passwords last month, and the same logic applies to the OAuth token sitting in your MCP config.

The time savings are real. The risk is small but it sits in the worst possible weeks. That’s why I’d want a human reviewing every confirmed change between now and January, and why I put a VA from OnlineJobs.ph in the box above. A good VA can check an AI’s change log every morning in 15 minutes.

Assets are the bigger opportunity

The asset tools are where high-ticket stores get the most value. Sitelinks, callouts and structured snippets are the extensions that make a $3,000 sauna or a $6,000 golf simulator ad look like it comes from a real business. Most small stores run with half of them missing because writing them is tedious.

An AI that can draft a full set of callouts (“Free Freight Shipping”, “Authorized Dealer”, “Talk to a Product Specialist”) and park them in your asset library for you to attach is a genuine time saver. Pair that with a phone line that actually gets answered, like Quo for business calls and texts, and the “call us” callout becomes a sales channel instead of a promise. Phone sales are critical for high-ticket stores, which I broke down in my guide to turning Google Shopping clicks into sales.

Who should ignore this, and who shouldn’t

If you’ve never connected an AI tool to Google Ads, nothing changed for you. This is a developer tool you install yourself, not a toggle in the Google Ads interface. If you’re still picking a product line, start with my high-ticket niches list and worry about AI tooling later.

If you installed the server through pipx straight from the GitHub repo, as Google’s guide recommends, you may already be on 0.0.6 the next time it runs. That’s the group that needs to act. Check your version before your AI assistant makes its first write.

If you’re on a managed AI ad platform, ask the vendor whether it pulls in Google’s server or uses its own. Google’s guide also offers a hosted Cloud Run setup, and it warns never to deploy that version without OAuth credentials, because the server would fall back to the container’s own access.

Whatever tool you pick, the data underneath still decides your results. Clean product titles on a solid Shopify store, real margins and a conversion setup that tracks phone orders matter more than which AI writes the sitelinks. I made that case in why high-ticket Google Ads need a complete conversion system, and it applies double when an AI is reading those numbers.

If all of this sounds like a second job on top of running the store, that’s because it is. My team’s turnkey done-for-you store build builds and launches the whole high-ticket business for you, so you start with an account that’s clean enough for an AI to help instead of hurt.

Trying to figure out how far to trust AI with your ad account? Talk it through with other store owners and me inside the community, starting with a 7-day free trial. Join the Ecommerce Paradise Skool community →

Lock Down Your Google Ads MCP Setup Before Black Friday

What I’d do this week, in this order:

  1. Check which version you’re running. Run pip show google-ads-mcp or check your MCP client’s server log. If it says 0.0.6, the write tools are live unless you turned them off.
  2. Turn the write tools off until you need them. Set labels and assets to false in tools_config.yaml. Turn them back on deliberately for a specific job, like a one-time callout build, and switch them off again after.
  3. Make your AI client ask before every write. In Claude Desktop, Cursor or whatever client you use, set the confirm step to require manual approval instead of auto-approve. The server won’t enforce that for you.
  4. Write an SOP for AI changes. Spell out which changes the AI may propose, who approves them and when. My post on building AI-ready SOPs for ecommerce covers how to structure them.
  5. Keep a change log humans can read. Have the assistant write every proposed asset and label into a shared sheet in Google Workspace before it confirms. Your VA reviews it each morning, and you have a record if a rule misfires.
  6. Audit any rules or scripts that read labels. List every automated rule that filters by label. If an AI can change those labels, those rules are now indirectly AI-controlled.
  7. Freeze label changes from Thanksgiving through Cyber Monday. Let the AI draft assets for your review, but hold off on confirming new label changes during your highest-spend days. If you want a second set of eyes on your plan, book a discovery call before the rush.

Before you let any AI touch ad copy, look at what your competitors are actually running. Semrush shows the paid keywords and ad text rivals use, which gives your assistant real inputs instead of generic filler.

And if the AI writes a callout promising live help, make sure someone answers. Tidio live chat catches the shoppers who won’t pick up the phone, which matters on a $2,500 order where buyers want answers before they pay. More on that in my high-ticket dropshipping marketing playbook.

Frequently Asked Questions

Is the Google Ads MCP server still read-only?
No. Version 0.0.6, released November 2, 2026, added four write tools that create assets and manage labels. Google’s developer guide still describes it as read-only, but that page was last updated October 30, before the release.

Can an AI change my Google Ads budget or bids through this server?
Not through Google’s MCP server. It still has no tools for budgets, bids, campaign status, keywords or ads. Automated rules you already have can still change bids based on labels the AI edits, so check those.

How do I turn off the write tools?
Set labels and assets to false in the server’s tools_config.yaml file, per PPC Land’s review of the release. The write tools are on by default in 0.0.6.

Do I need a developer token to use the server?
Not anymore. Version 0.0.3 removed developer token validation, and Google’s guide says you need a Google Cloud project with Explorer, Basic or Standard API access plus OAuth credentials.

Is this worth setting up for a small high-ticket store?
Only if someone on your team will review what it does. For a brand-new store, getting the niche, suppliers and feed right matters far more, and my free high-ticket niches list is a better first step than wiring up AI tools.

How is this different from Supermetrics or other AI ad tools?
Google’s server is free, open source and narrow, limited to assets and labels for writes. Third-party tools often go further, which I covered in my post on Supermetrics letting Claude build ads.

Will AI assistants change how Google Shopping ads look?
They already are on Google’s side. Google is testing AI Mode layouts that group Shopping ads under one sponsored label, so strong assets and clean feeds matter more, not less.

Want my team to build your high-ticket store with Google Shopping set up right from day one? See the turnkey done-for-you service →

AI write access to ad accounts is coming whether Google announces it or not. The stores that win with it will be the ones with clean data and a human who reads the change log. Start there.

Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day.

Related Articles

If this was useful, these go deeper:

Share on Facebook
Post on X
Save
Share