Reading Google Ads from a chat is a reporting question. Changing Google Ads from a chat is a spending question. Most MCP servers that can write have a guardrail, but they put it in very different places, and only some of those places survive a busy Tuesday afternoon.
Three kinds of guardrail
Every write-capable option we looked at in our Google Ads comparison relies on one or more of these:
- No write tools at all. Google's official server, AnythingMCP and Adzviser are read-only. Nothing to approve, nothing to undo. Also nothing gets done.
- The chat asks first. Claude and ChatGPT show a confirmation before a tool runs, and several vendors build on that: Windsor.ai says nothing changes without your approval, Markifact says every write requires approval. The approval is the click of whoever is in the chat.
- The server limits what a write can do. New campaigns created as paused, for example, which Windsor.ai and Pipeboard both do.
And then there are the toolkits for developers. Composio exposes 25 write tools for Google Ads, from mutating campaigns and budgets to bidding strategies and batch operations, and leaves the policy to whoever builds the agent. That is correct for a toolkit and a lot of rope for a marketing team.
Why the chat's confirm button is not enough
A confirmation dialog answers "does the person in this chat want this call". It does not answer "is this person allowed to make it". Those are the same question only if everyone who can reach the connector has the same authority over the ad budget, which is rarely true. A working student preparing a report and the head of performance marketing click the same button.
It also does not survive habit. After the twentieth harmless confirmation in a session, the twenty-first gets the same click. Models are good at describing a change convincingly, and a call that sets a daily budget to 5,000 instead of 500 looks just as tidy in the dialog.
"Starts paused" is not "cannot go live"
Creating new campaigns as paused is a good default. But if the same server also has a tool to enable a campaign, or to change a status, the paused state lasts exactly until someone asks for the next step. Windsor.ai's write tools, for example, include pausing and enabling. The question to ask a vendor is not "does it start paused" but "is there any call through your server that makes an ad serve".
There is a second, quieter route to spend: changes under something that is already live. A new ad group in a running campaign, or a new keyword in a live ad group, starts spending as soon as it exists unless it is paused itself.
How we built it
Loopthink's Google Ads connector is read-only until somebody ticks Allow changes on the connection. After that, a person whose role includes the change tools can create and update campaigns, budgets, ad groups, ads and keywords. Nobody can make anything serve:
- New campaigns are created paused.
- Anything new under a live parent, an ad group in a running campaign or an ad in a live ad group, is created paused too. The server reads the parent's status before it writes.
- A status change can only go to paused. Enabling is not a parameter the tool accepts, and there is no remove.
- Every change runs through Google's validate-only mode first, then for real, and the audit log records who asked, the change, and the values before and after.
So the AI can draft a whole campaign, with budgets and keywords and ads, and a person goes into Google Ads to review it and switch it on. That last step stays in Google's interface, under that person's own Google login, in Google's change history with their name.
The comparison
| Google official | Composio | Windsor.ai | Markifact | Loopthink | |
|---|---|---|---|---|---|
| Can create campaigns | No | Yes | Yes, paused | Yes, with approval | Yes, paused |
| Can make something serve | No | Yes | Yes, enable is a tool | Not described | No |
| Who may write | Nobody | Whoever builds the agent decides | Whoever is in the chat | Whoever approves | Roles per person |
| Before and after in an audit log | Not applicable | Not described | Not described | Not described | Yes |
Sources: the vendor pages linked above, as read on 17 October 2026. "Not described" means we found nothing on the vendor's pages, not that it cannot exist.
Which one fits
If you want an agent that runs campaigns end to end, choose a tool built for that, and give it a Google account whose rights you would give a new hire. If you want the AI to do the tedious part, structure, keywords, ad copy, budgets, and keep the decision to spend with a person, then the write model above is the one we would want ourselves. That is why we built it.