AI and ad accounts · Security
Claude skills or an MCP for Google Ads: where the approval and the key live
Claude Code skills and an MCP can both ask before they change a Google Ads campaign. The difference is where two things live. With skills on the API, the key that edits every client account sits on your laptop, next to an agent with a terminal. In a console, the key and the approval sit on a server.
What is a Claude skills setup for Google Ads?
A skill is a folder of instructions and scripts that Claude Code loads when a task needs it. A Google Ads setup built on skills pairs them with your own API credentials, on your own computer. Claude follows the instructions, runs the scripts, and the scripts call the Google Ads API.
The best-known one is PPC OS, from PPC Mastery in the Netherlands. It runs on Claude Code, with one workspace per client, and its page says it reads only by default and nothing goes live without your approval. The write-up of how it was built lists 29 Google Ads skills: five gather data, thirteen audit, seven optimise and four build.
PPC OS is built with care, and its community knows it. Its build write-up describes four steps before anything is written:
- The reasoning becomes a fixed request. The model never talks to the API directly.
- A validate-only call asks Google to check the change without making it.
- The specialist approves a CSV before anything is sent.
- What was in the CSV is what gets written.
So the honest question is not whether it asks first. It does. The question is where the key sits while it asks.
Or skip to the seven questions to ask any setupWhy is the Google Ads key the part that matters?
Google Ads has one OAuth scope, and it reads and writes. There is no read-only key to hand an assistant. Whatever can read your account with that key can also change it.
Most of us connect through a manager account. A key from an MCC user reaches every client account that user can see: one key, twenty clients. Google asks you to store those credentials like any production secret.
| Skills on the API, on your laptop | A hosted MCP | Climent Ads | |
|---|---|---|---|
| Where the Google Ads key lives | In a file on the specialist’s computer | With the provider, after you sign in with Google | In the console, on the server. The specialist’s laptop holds none |
| Who enforces the approval | The setup’s own code, and the permissions each person gives Claude Code | The provider’s server | The server: a person signs that exact proposal |
| Can it be switched off | Whoever controls the laptop controls the code | It depends on the provider | No |
| What reaches the ad account | Scripts on the laptop, with your key | The provider’s write tools, with the key they hold | Only a signed proposal. Its MCP reads the data already imported, and is in testing, behind OAuth |
| Example | PPC OS | Ryze: 8 tools that read and 6 that write | The console I run my own clients on |
Each column can be run well or badly. The table only says where the risk sits, and who can move it.
What can go wrong when the key sits next to the agent?
Claude Code can run commands on your computer, and it has only the permissions you give it. Most people approve a command a few times and then allow it for good. That is normal. It also means the approval in a skills setup rests on each person’s settings, on each laptop.
The text the agent reads
The quieter risk is what the agent reads. A Google Ads setup reads text that other people wrote: search terms, landing pages, competitors’ sites, emails. PPC OS ships a competitor scraper and a landing page auditor, which is the job. If that text carries instructions, the agent may follow them, with the terminal and the key in reach. OWASP lists prompt injection as the first risk for LLM apps, and excessive agency as the sixth.
So the danger is not that someone hacks your email and then your accounts. It is a page the agent reads on Tuesday, and a permission somebody allowed on Monday.
None of this makes PPC OS unsafe. Its validate-only check and its CSV approval are the right brakes. They just live on a machine you also browse, email and download on.
Or go to the questions that find this in your own setupHow do I run 22 Google Ads accounts on this?
I run paid media on my own, with a team of Claude agents. Today that is 22 Google Ads accounts, with more than €150,000 a month of spend between them. I don’t log in to each one every day. Two Claude profiles sit on top of Climent Ads, and both work through its MCP:
- The paid media specialist, for Meta and Google. Its routines run on every account: the reading, the flags, the benchmarks and the reviews.
- The pod manager. It reviews what the specialist found, argues with the proposals, and brings me the ones worth deciding.
- Me. I decide. A change reaches an account only after I sign that proposal in the console, and each one can be undone.
The pod is not an AI running 22 accounts. The routines read 22 accounts, and one person decides. The reading is automated and the judgement is not.
Where does an MCP not protect you either?
- An MCP is not safe because it is an MCP. The protocol’s own security guide lists attacks that exist only there, like the confused deputy and passing a token straight through.
- A hosted server concentrates the risk. If one provider is breached, every account connected to it is too.
- Asking first is not only ours. Ryze’s Google Ads MCP puts each of its six write tools behind an approval, on by default, with a dry run where Google allows one.
- So I don’t sell “MCP, not skills”. I sell where the approval lives, where the key lives, and the way of working on top.
What should you ask before connecting any setup to a client account?
- Where does the Google Ads key live? A file, a keychain or a server. And who else can read that folder.
- Who enforces the approval? Code on a server, or a setting on one laptop.
- Can the approval step be switched off, and by whom?
- What else can the agent run? A terminal, a browser, your files.
- What does it read that someone else wrote? Search terms, landing pages, competitors’ sites, inboxes.
- Can each change be undone, and is there a record of who approved it?
- How far does one mistake reach? With a key from your MCC, every client that user can see.
If a setup answers all seven well, use it. PPC OS answers several of them better than most.
Want to see where the approval lives in Climent Ads?
The console runs on my own clients’ accounts before anybody else’s. If you run several Google Ads accounts, write to me with how many and how you connect them today. I’ll answer the seven questions for your setup, and show you the console, the MCP and the pod at work.
Written by Manuel Climent · Last updated:
Questions people actually ask
Are Claude skills safe for Google Ads?
Claude skills can be safe for Google Ads. Reading by default, a dry run and a person approving the file before upload is a sound design. The risk depends on where the Google Ads key lives and what else the agent can run on that computer.
Is an MCP more secure than the Google Ads API?
Not on its own. An MCP server calls the API underneath. It moves the key and the approval somewhere else, and that is only safer if the new place is.
Does PPC OS change campaigns by itself?
Not by default. Its page says it reads only and nothing goes live without your approval. The write-up of its build adds the detail: a validate-only check first, then a CSV the specialist approves before anything is sent.
Can Claude change my Google Ads campaigns?
Yes, if it holds a key with the Google Ads scope, because that one scope reads and writes. Whether it does is up to the setup. In Climent Ads, a campaign changes only through a proposal that a person signs.
Related reading.
- Connect Claude to Google Ads: the routes in, and the three locks on what it can change.
- Google Ads MCP: the four options, and what each one can change.
- Google Ads API access: the developer token is gone, and one scope also writes.
- MCP vs API: what changes when the model picks the call.
- 12 ad-ops skills for Claude: skills that read your accounts and flag what matters.
- Autonomous vs approved AI ad tools: what changes when a tool proposes and waits.
Who wrote this
I’m Manu. I’ve been buying media for eight years, and I run Climent Media from Utrecht with a team of Claude agents, not a team of people. The pod on this page is the one I work with every day.