X Ads MCP is X's official remote Model Context Protocol server at https://ads-api.x.com/mcp. X documents 23 tools for reading accounts, campaigns, analytics, reach, and targeting data, plus creating, updating, targeting, promoting, and activating campaigns and line items.

Is X Ads MCP read-only?

It can be. The ads.read OAuth scope grants read and analytics access, while ads.write grants campaign and creative writes. A team that only needs reporting can omit ads.write so write tools fail authorization.

Can an AI agent spend money through X Ads MCP?

Potentially, yes. X says newly created campaigns and line items always start paused, but the documented tool list also includes separate activate_campaign and activate_line_item tools. Paused-by-default delays spend; it is not by itself a mandatory human approval workflow.

Does X Ads MCP require human approval before activation?

X's public Ads MCP documentation does not describe a mandatory human approval step. Production teams should enforce approval in the MCP host, a gateway, or a separate write session and log the exact campaign, budget, targeting, creative, approver, and activation result.

Which OAuth scopes does X Ads MCP use?

X documents ads.read for reads and analytics, ads.write for campaign and creative writes, and offline.access for refresh tokens. Without offline.access, X says access tokens expire in roughly two hours and cannot be refreshed.

Is X Ads MCP safe from prompt injection or ad fraud?

The protocol does not eliminate either risk. X documents scoped OAuth and paused creation, but teams still need trusted-input boundaries, restricted write access, budget limits, approval gates, audit logs, anomaly detection, and a kill switch for production use.

X Ads MCP: 23 Tools, Read/Write Safety Guide | explainx.ai Blog

As of August 22, 2026, X's official developer documentation describes a new X Ads MCP endpoint at https://ads-api.x.com/mcp. It gives MCP-compatible AI clients a natural-language path into X Ads reporting and campaign management without requiring teams to write their own Ads API adapter.

The headline circulating on X was that agents can create and manage advertising campaigns through conversation. That is directionally correct, but incomplete. The official X Ads MCP documentation lists 23 tools, separates read access from write access with OAuth scopes, and creates campaigns in a paused state. It also exposes explicit activation tools. For anyone building AI marketing agents, that final detail is where the architecture starts—not where the safety discussion ends.

TL;DR: what can X Ads MCP actually do?

table · 2 cols

Question	Direct answer
Is the launch real?	Yes. X's official developer docs publish a remote Ads MCP endpoint and a 23-tool API reference.
Is it only for analytics?	No. Thirteen documented tools are reads, analytics, or targeting search; ten create, update, activate, promote, or remove data.
Can I make it read-only?	Yes. Grant `ads.read` and omit `ads.write`.
Do new campaigns spend immediately?	No. X says new campaigns and line items are created paused.
Can the agent activate them later?	Yes. `activate_campaign` and `activate_line_item` are documented write tools.
Does X require a human approval before activation?	The public Ads MCP docs do not document a mandatory approval gate. Add one in your client or gateway.
What should teams deploy first?	A read-only analyst, then paused drafting, then a separately authorized activation workflow.

What X actually documented

X describes Ads MCP as a remote Model Context Protocol server using Streamable HTTP. An MCP client discovers the tool schemas and calls the hosted endpoint; X translates those calls into version 12 Ads API operations.

The official API reference divides the 23 tools into four practical groups:

table · 4 cols

Surface	Count	Examples	Risk level
Account and campaign reads	9	List accounts, campaigns, line items, funding instruments, promoted posts, targeting, account posts	Low to medium; can expose sensitive business data
Analytics	2	Account statistics, campaign reach	Low to medium; decisions can still be wrong if metrics are delayed or misread
Targeting search	2	Search interests and locations	Low; useful for planning
Writes	10	Create/update/activate campaigns and line items, add/remove targeting, create ad posts, promote posts	High; can change public creative, targeting, and spend state

This is not merely a chat interface over dashboards. A model can chain account lookup, funding-instrument selection, campaign creation, line-item creation, targeting, creative creation, promotion, and activation. That is real execution authority.

The implementation is also distinct from X's earlier general-purpose hosted MCP at api.x.com/mcp. The earlier server focuses on posts, search, users, bookmarks, news, trends, and Articles; our X hosted MCP setup guide covers that surface. Ads MCP lives at ads-api.x.com/mcp, uses Ads-specific scopes, and maps to the X Ads API.

Read access and write access should be separate products

X documents three relevant OAuth scopes:

table · 3 cols

Scope	What X says it enables	Recommended production use
`ads.read`	Read and analytics tools	Default for analysts, reporting bots, and diagnostics
`ads.write`	Campaign and creative writes	Temporary or tightly gated execution identity
`offline.access`	Refresh-token support	Needed for durable sessions; protect the rotating refresh token as a secret

This is a meaningful boundary. A reporting agent can answer “Which campaigns lost reach last week?” without receiving the ability to alter targeting or publish a promoted post.

But ads.write is broad. In the public documentation, it covers both drafting operations and activation operations. X does not document a finer OAuth split such as ads.draft versus ads.activate. That means the safest architecture is to treat analysis and execution as separate trust zones, even if both ultimately use the same server.

text

Untrusted briefs + reporting data
        ↓
Read-only agent: ads.read
        ↓
Structured change proposal
        ↓
Policy checks + human approval
        ↓
Short-lived write session: ads.write
        ↓
Create paused entities → verify exact IDs → activate

Use a dedicated X app for each zone when practical. Separate credentials make revocation, monitoring, and incident response much clearer than one long-lived token shared by every marketing workflow.

Paused by default is useful—but it is not an approval gate

X's best built-in safety choice is straightforward: new campaigns and line items start paused. The docs state that “campaigns and line items are always created PAUSED,” so a malformed creation request should not immediately begin buying impressions.

That protects the creation step. It does not protect the whole workflow.

The same documented server exposes activate_campaign and activate_line_item. If the MCP client has ads.write, and its policy lets the model call every discovered tool, the model can potentially create and then activate in one tool chain. Nothing in the public Ads MCP page says a human must approve between those calls.

This is the same distinction explained in our human-in-the-loop AI framework: a reversible draft can run autonomously, while the action that creates external cost should cross a deliberate checkpoint. “Starts paused” is a safe default. “Cannot activate without a separate approver” is an enforceable control.

A production approval contract for ad-spend agents

Before any activation, generate a review artifact that is boring, complete, and machine-checkable. At minimum, it should freeze:

Ads account ID and funding instrument
Campaign and line-item IDs
Objective, bid type, bid amount, daily budget, and total budget
Start and end time in the account's timezone
Target countries, locations, interests, exclusions, and audience size estimate
Promoted post or creative ID, exact copy, media, and landing-page URL
Policy category and any required X pre-authorization
The prompt, model version, tool calls, and source data used to make the recommendation
Approver identity, approval timestamp, activation result, and rollback owner

The activation service should reject any request whose live object differs from the approved snapshot. That prevents a human from approving a $100 test while the agent later activates a mutated $10,000 campaign.

For a first rollout, use this autonomy ladder:

Observe: ads.read only; the agent reports metrics and anomalies.
Recommend: the agent proposes budgets, targeting, and creative but makes no writes.
Draft: a restricted write session creates paused entities only.
Approve: a human reviews the frozen object IDs and financial exposure.
Activate: a non-LLM policy service, or a separately approved tool call, changes state.
Monitor: automated rules pause campaigns on overspend, policy errors, or metric anomalies.

This follows the broader MCP security guide: least privilege, explicit trust boundaries, and auditability matter more than whether the tool endpoint itself is first-party.

What about prompt injection and “ad fraud at machine speed”?

There is no evidence in X's documentation that Ads MCP itself creates a new ad-fraud technique. MCP standardizes tool access; it does not independently decide to commit fraud. The more defensible concern is execution speed plus compromised instructions.

An ad agent may reason over creative briefs, landing pages, account posts, campaign names, analytics exports, email, or documents. Any attacker-controlled text in that context can attempt indirect prompt injection: “ignore the budget,” “promote this post,” or “send performance data elsewhere.” If the same agent can read untrusted material and invoke activation tools, the blast radius moves from a bad recommendation to real spend.

Controls should therefore include:

Tool allowlists: disable activation and targeting deletion in general chat sessions.
Budget ceilings: enforce daily and lifetime limits outside the prompt.
Account allowlists: prevent a client or agency agent from crossing tenant boundaries.
Input provenance: label briefs, webpages, posts, and retrieved text as data—not instructions.
No secret echoing: never place OAuth tokens, client credentials, or refresh tokens in model-visible prompts or logs.
Idempotency and deduplication: stop retries from creating duplicate campaigns or promoted posts.
Anomaly detection: alert or pause on spend velocity, targeting expansion, unexpected geographies, or rapid creative churn.
Immutable audit events: preserve the proposal, approvals, tool parameters, responses, and state transitions.
Kill switch: revoke the write app or token and pause affected campaigns without relying on the agent that failed.

Human review helps, but it should not carry the whole system. Real approval decisions degrade under repetition, as the 40,000-play agent approval study illustrates. Reserve human attention for the compact set of irreversible, costly, or public actions and let deterministic policy reject obvious violations first.

Safe prompts to use first

With a read-only token, start with diagnosis:

text

List the X Ads accounts I can access. For the selected account, compare campaign
spend, impressions, engagements, and reach for the last seven complete days.
Return observations and missing data only. Do not request or call write tools.

For a controlled draft session:

text

Create a PAUSED test campaign and PAUSED line item from the approved brief below.
Before calling any tool, restate the account ID, funding instrument, objective,
budget, bid, dates, targeting, creative ID, and landing page. Never call
activate_campaign or activate_line_item. Return the created IDs for review.

For approval, do not use “looks good” as the contract. Require exact values:

text

Compare the live paused campaign and line item against approval record AP-1042.
If any ID, budget, bid, dates, targeting, creative, or landing URL differs, stop.
If every field matches, produce a signed activation request for the policy
service. Do not activate from this session.

The prompt is guidance, not enforcement. The OAuth scope, tool filter, budget policy, and activation service are the actual control plane.

How to connect without granting writes

X's docs provide setup recipes for Grok, Grok Build, Claude Code, static tokens, and custom MCP SDK clients. For Claude Code, the official connection command is:

bash

claude mcp add x-ads https://ads-api.x.com/mcp \
  --transport http \
  --client-id YOUR_OAUTH2_CLIENT_ID \
  --callback-port 8080

X notes that Claude Code does not expose a scope flag in that command. To restrict it to read-only, configure the server entry in ~/.claude.json with a space-separated scope string:

json

{
  "oauth": {
    "scopes": "ads.read offline.access"
  }
}

Use a public/native X app, register the callback URL exactly, enroll it in an Ads Project, and verify the signed-in X user has access to the intended ads account. Do not paste access tokens into a chat transcript. For broader MCP client patterns, see our Claude connectors guide and the explainx.ai MCP server directory.

The practitioner takeaway

X Ads MCP removes integration work, not governance work. Its read-only surface is immediately useful for reporting and diagnosis. Its paused-write workflow is a sensible second step. Production activation should remain a separately authorized event with fixed budgets, exact-object approval, immutable logs, and a fast kill switch.

The most important implementation choice is simple: do not let the same unconstrained conversation both absorb untrusted marketing context and activate spend. Split read from write, draft from activation, and recommendation from approval.

Official references: X Ads MCP setup, X Ads MCP tool reference, X Ads API authentication, and X Ads analytics.

X Ads MCP endpoints, tool counts, OAuth scopes, and paused-creation behavior are accurate as of August 22, 2026 based on X's official developer documentation. The approval, budget, audit, and prompt-injection controls above are explainx.ai's production recommendations, not documented X platform guarantees.

TL;DR: what can X Ads MCP actually do?

table · 2 cols

Question	Direct answer
Is the launch real?	Yes. X's official developer docs publish a remote Ads MCP endpoint and a 23-tool API reference.
Is it only for analytics?	No. Thirteen documented tools are reads, analytics, or targeting search; ten create, update, activate, promote, or remove data.
Can I make it read-only?	Yes. Grant `ads.read` and omit `ads.write`.
Do new campaigns spend immediately?	No. X says new campaigns and line items are created paused.
Can the agent activate them later?	Yes. `activate_campaign` and `activate_line_item` are documented write tools.
Does X require a human approval before activation?	The public Ads MCP docs do not document a mandatory approval gate. Add one in your client or gateway.
What should teams deploy first?	A read-only analyst, then paused drafting, then a separately authorized activation workflow.

What X actually documented

The official API reference divides the 23 tools into four practical groups:

table · 4 cols

Surface	Count	Examples	Risk level
Account and campaign reads	9	List accounts, campaigns, line items, funding instruments, promoted posts, targeting, account posts	Low to medium; can expose sensitive business data
Analytics	2	Account statistics, campaign reach	Low to medium; decisions can still be wrong if metrics are delayed or misread
Targeting search	2	Search interests and locations	Low; useful for planning
Writes	10	Create/update/activate campaigns and line items, add/remove targeting, create ad posts, promote posts	High; can change public creative, targeting, and spend state

Read access and write access should be separate products

X documents three relevant OAuth scopes:

table · 3 cols

Scope	What X says it enables	Recommended production use
`ads.read`	Read and analytics tools	Default for analysts, reporting bots, and diagnostics
`ads.write`	Campaign and creative writes	Temporary or tightly gated execution identity
`offline.access`	Refresh-token support	Needed for durable sessions; protect the rotating refresh token as a secret

This is a meaningful boundary. A reporting agent can answer “Which campaigns lost reach last week?” without receiving the ability to alter targeting or publish a promoted post.

text

Untrusted briefs + reporting data
        ↓
Read-only agent: ads.read
        ↓
Structured change proposal
        ↓
Policy checks + human approval
        ↓
Short-lived write session: ads.write
        ↓
Create paused entities → verify exact IDs → activate

Use a dedicated X app for each zone when practical. Separate credentials make revocation, monitoring, and incident response much clearer than one long-lived token shared by every marketing workflow.

Paused by default is useful—but it is not an approval gate

That protects the creation step. It does not protect the whole workflow.

A production approval contract for ad-spend agents

Before any activation, generate a review artifact that is boring, complete, and machine-checkable. At minimum, it should freeze:

Ads account ID and funding instrument
Campaign and line-item IDs
Objective, bid type, bid amount, daily budget, and total budget
Start and end time in the account's timezone
Target countries, locations, interests, exclusions, and audience size estimate
Promoted post or creative ID, exact copy, media, and landing-page URL
Policy category and any required X pre-authorization
The prompt, model version, tool calls, and source data used to make the recommendation
Approver identity, approval timestamp, activation result, and rollback owner

For a first rollout, use this autonomy ladder:

Observe: ads.read only; the agent reports metrics and anomalies.
Recommend: the agent proposes budgets, targeting, and creative but makes no writes.
Draft: a restricted write session creates paused entities only.
Approve: a human reviews the frozen object IDs and financial exposure.
Activate: a non-LLM policy service, or a separately approved tool call, changes state.
Monitor: automated rules pause campaigns on overspend, policy errors, or metric anomalies.

This follows the broader MCP security guide: least privilege, explicit trust boundaries, and auditability matter more than whether the tool endpoint itself is first-party.

What about prompt injection and “ad fraud at machine speed”?

Controls should therefore include:

Tool allowlists: disable activation and targeting deletion in general chat sessions.
Budget ceilings: enforce daily and lifetime limits outside the prompt.
Account allowlists: prevent a client or agency agent from crossing tenant boundaries.
Input provenance: label briefs, webpages, posts, and retrieved text as data—not instructions.
No secret echoing: never place OAuth tokens, client credentials, or refresh tokens in model-visible prompts or logs.
Idempotency and deduplication: stop retries from creating duplicate campaigns or promoted posts.
Anomaly detection: alert or pause on spend velocity, targeting expansion, unexpected geographies, or rapid creative churn.
Immutable audit events: preserve the proposal, approvals, tool parameters, responses, and state transitions.
Kill switch: revoke the write app or token and pause affected campaigns without relying on the agent that failed.

Safe prompts to use first

With a read-only token, start with diagnosis:

text

List the X Ads accounts I can access. For the selected account, compare campaign
spend, impressions, engagements, and reach for the last seven complete days.
Return observations and missing data only. Do not request or call write tools.

For a controlled draft session:

text

Create a PAUSED test campaign and PAUSED line item from the approved brief below.
Before calling any tool, restate the account ID, funding instrument, objective,
budget, bid, dates, targeting, creative ID, and landing page. Never call
activate_campaign or activate_line_item. Return the created IDs for review.

For approval, do not use “looks good” as the contract. Require exact values:

text

Compare the live paused campaign and line item against approval record AP-1042.
If any ID, budget, bid, dates, targeting, creative, or landing URL differs, stop.
If every field matches, produce a signed activation request for the policy
service. Do not activate from this session.

The prompt is guidance, not enforcement. The OAuth scope, tool filter, budget policy, and activation service are the actual control plane.

How to connect without granting writes

X's docs provide setup recipes for Grok, Grok Build, Claude Code, static tokens, and custom MCP SDK clients. For Claude Code, the official connection command is:

bash

claude mcp add x-ads https://ads-api.x.com/mcp \
  --transport http \
  --client-id YOUR_OAUTH2_CLIENT_ID \
  --callback-port 8080

X notes that Claude Code does not expose a scope flag in that command. To restrict it to read-only, configure the server entry in ~/.claude.json with a space-separated scope string:

json

{
  "oauth": {
    "scopes": "ads.read offline.access"
  }
}

The practitioner takeaway

Official references: X Ads MCP setup, X Ads MCP tool reference, X Ads API authentication, and X Ads analytics.

X Ads MCP: What Its 23 Tools Can Do—and How to Gate Ad Spend

TL;DR: what can X Ads MCP actually do?

What X actually documented

Read access and write access should be separate products

Paused by default is useful—but it is not an approval gate

A production approval contract for ad-spend agents

What about prompt injection and “ad fraud at machine speed”?

Safe prompts to use first

How to connect without granting writes

The practitioner takeaway

X Ads MCP: What Its 23 Tools Can Do—and How to Gate Ad Spend

TL;DR: what can X Ads MCP actually do?

What X actually documented

Read access and write access should be separate products

Paused by default is useful—but it is not an approval gate

A production approval contract for ad-spend agents

What about prompt injection and “ad fraud at machine speed”?

Safe prompts to use first

How to connect without granting writes

The practitioner takeaway

Related posts

What is Microsoft Copilot Studio? Build Your First AI Agent (2026 Guide)

Binance Agent OS: MCP Server That Lets Claude and ChatGPT Trade Crypto

Claude Gmail and Drive Connectors Get Write Actions — With Approval by Default

Related posts

What is Microsoft Copilot Studio? Build Your First AI Agent (2026 Guide)

Binance Agent OS: MCP Server That Lets Claude and ChatGPT Trade Crypto

Claude Gmail and Drive Connectors Get Write Actions — With Approval by Default

TL;DR: what can X Ads MCP actually do?

What X actually documented

Read access and write access should be separate products

Paused by default is useful—but it is not an approval gate

A production approval contract for ad-spend agents

What about prompt injection and “ad fraud at machine speed”?

Safe prompts to use first

How to connect without granting writes

The practitioner takeaway

Related on explainx.ai

TL;DR: what can X Ads MCP actually do?

What X actually documented

Read access and write access should be separate products

Paused by default is useful—but it is not an approval gate

A production approval contract for ad-spend agents

What about prompt injection and “ad fraud at machine speed”?

Safe prompts to use first

How to connect without granting writes

The practitioner takeaway

Related on explainx.ai

Related posts

What is Microsoft Copilot Studio? Build Your First AI Agent (2026 Guide)

Binance Agent OS: MCP Server That Lets Claude and ChatGPT Trade Crypto

Claude Gmail and Drive Connectors Get Write Actions — With Approval by Default

Related posts

What is Microsoft Copilot Studio? Build Your First AI Agent (2026 Guide)

Binance Agent OS: MCP Server That Lets Claude and ChatGPT Trade Crypto

Claude Gmail and Drive Connectors Get Write Actions — With Approval by Default