MCP, MCP server
Google Ads Mcp
A comprehensive Model Context Protocol (MCP) server for Google Ads API integration, enabling AI assistants like Claude, ChatGPT, and Gemini to analyze, manage, and optimize Google Ads campaigns through natural language conversations.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit c85df0d75216, unchanged since the check below.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
generate_refresh_token.py, line 15
credentials_path = Path("credentials.json")
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Concern
dependencies are not pinned.
INSTALL_UNPINNED
requirements.txt, line 1
google-ads>=25.0.0
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
managers/extensions_manager.py, line 669
response = requests.get(image_url)
scripts/virustotal-audit.mjs, line 32
const response = await fetch(url, {
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
generate_refresh_token.py, line 15
credentials_path = Path("credentials.json")
generate_refresh_token.py, line 20
client_secret = os.getenv("GOOGLE_ADS_CLIENT_SECRET")
generate_refresh_token.py, line 24
"Provide credentials.json or set GOOGLE_ADS_CLIENT_ID and GOOGLE_ADS_CLIENT_SECRET"
Show more
google_ads_mcp.py, line 33
load_dotenv(_server_dir / ".env")
google_ads_mcp.py, line 521
"""Try to initialise the Google Ads client from .env credentials."""
google_ads_mcp.py, line 522
dev_token = os.getenv("GOOGLE_ADS_DEVELOPER_TOKEN")
google_ads_mcp.py, line 524
csecret = os.getenv("GOOGLE_ADS_CLIENT_SECRET")
google_ads_mcp.py, line 525
rtoken = os.getenv("GOOGLE_ADS_REFRESH_TOKEN")
google_ads_mcp.py, line 542
logger.info(f"✓ Auto-initialised from .env (MCC: {clean_login_id or 'none'})")
scripts/virustotal-audit.mjs, line 5
const API_KEY = process.env.VT_API_KEY;
utils/config_manager.py, line 218
if os.getenv("GOOGLE_ADS_DEVELOPER_TOKEN"):
utils/config_manager.py, line 219
config["authentication"]["developer_token"] = os.getenv("GOOGLE_ADS_DEVELOPER_TOKEN")
utils/config_manager.py, line 224
if os.getenv("GOOGLE_ADS_CLIENT_SECRET"):
.env.example, line 2
# Copy this file to .env and fill in your credentials
.github/pull_request_template.md, line 15
- [ ] No secrets added (credentials, tokens, `.env`, `config.yaml`, `credentials.json`)
.gitignore, line 25
# Local environment and secrets
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit c85df0d75216. dependencies are not pinned. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: c85df0d75216e01e6765da03e9b5b5d44716a327
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.