Book a call

MCP servers for marketing data: what exists and what to watch

Analytics & measurement
Watching

By Peter Buczynski, Marketing StrategistUpdated 3 November 2026

For the wider question, read what an AI analyst gets right and wrong with marketing data.

What does an MCP server do?

Without a connector, you paste a report into a chat and ask questions. With one, the assistant asks the tool directly.

The server sits between the two. It offers a set of actions, such as "list accounts" or "run a report". The assistant calls them. Some servers only read. Some can also write, which means changing campaigns or budgets.

That difference is the whole risk conversation.

What exists for Google Analytics, Google Ads and Meta?

Google Analytics MCP server. A GitHub project in the Google Analytics organisation, labelled Experimental. It runs locally, exposes tools to get account and property details and run reports, and needs the Google Analytics read-only scope1.

Google Ads MCP server. Documented in Google's Ads API developer toolkit as strictly read-only: it cannot change bids, pause campaigns or create assets. It lists accessible accounts, runs queries, and returns resource metadata2.

Meta Ads AI Connectors. Trade press (PPC Land) reports that Meta announced Meta Ads AI Connectors in open beta on 29 April 2026, for Claude and ChatGPT, with read and write access3. That is a press report on a beta, not Meta's own documentation.

Things move. Check the current documentation before you act on any of this.

What about Claude custom connectors and remote MCP?

Claude's Help Center has a guide to custom connectors using remote MCP. It says custom connectors can reach services that Anthropic does not vet, that you should only connect to remote MCP servers you trust, and that a connector can let Claude access and potentially modify data in the connected service4. Our view: treat every connector as access to your accounts, and ask who runs the server before you approve it.

Why do e-commerce brands look at it?

Speed. A performance marketer can ask a plain question across several tools without exporting a stack of reports.

It also helps people who are not analysts to get a first answer. A first answer is not a checked one.

Where does the human stay in the loop?

The MCP specification says there should always be a human in the loop able to deny tool calls5. It also says clients must treat tool annotations, the labels a server attaches to describe how a tool behaves, as untrusted unless they come from a trusted server5. A tool that calls itself read-only is a claim, not a guarantee.

In practice:

  • Start with read-only access.
  • Let writes happen only after a person approves each one.
  • Do not let the assistant spend budget alone.

What are the risks?

Prompt injection. OWASP describes prompt injection as input that alters a model's behaviour or output in unintended ways, and indirect injection as input from external sources such as websites or files6. OWASP also says it is unclear whether any method fully prevents it6. Treat data an assistant reads as untrusted.

Wrong numbers. Models make mistakes. Claude's documentation lists techniques to reduce hallucinations and states that they do not eliminate them7. Check before a figure reaches the board. See how to verify AI-generated marketing reports.

Agent labels. Agent washing means selling an ordinary assistant or chatbot as an "agent". Ask what the thing does, not what it is called.

How do we implement it?

1

Start read-only

Install and authenticate on a non-critical account. Decide the scope of access before anything else.

2

Name who approves

Writes happen only after a person approves each one. Nothing spends budget alone.

3

Treat inputs as untrusted

Data the assistant reads may carry injected instructions. Keep its access narrow.

4

Check before it travels

Every figure is checked by someone who knows the data before it reaches a report. Use it to explore, not to report.

When should you not use it?

Skip it when:

What does it cost in effort?

We give no figures.

  • Access. Someone has to grant it, and decide the scope.
  • Set-up. Install, authenticate, test on a non-critical account.
  • Governance. Who approves writes? Who reads the logs?
  • Checking. Every output needs a human who knows the data.

Our take: Watching

We rate MCP connectors for marketing data Watching. This is our view, not a market fact.

Why? The Analytics server is marked Experimental1. The Google Ads server is read-only2. The Meta connectors are a beta we know of from a press report3. None of it is settled enough to build a reporting process on.

Our view: use it to explore, not to report.

FAQ

A rider in a red cape and bicorne hat on a rearing yellow plush horse, after David's Napoleon Crossing the Alps

What is an MCP server for marketing data?

It is a connector that lets an AI assistant query a marketing tool such as Google Analytics or Google Ads directly.

Is there a Google Analytics MCP server?

Yes. A GitHub project in the Google Analytics organisation is labelled Experimental, runs locally and uses the read-only scope1.

Is there a Google Ads MCP server?

Yes. Google documents one in its Ads API developer toolkit as strictly read-only2.

Can Claude connect to Meta Ads?

Trade press reports that Meta announced Meta Ads AI Connectors for Claude and ChatGPT in open beta on 29 April 2026, with read and write access3. Meta's own documentation is the place to confirm the current position.

Is it safe to add a custom connector to Claude?

Only if you trust who runs the server. Claude's Help Center says to connect only to remote MCP servers you trust, because custom connectors can reach services that Anthropic does not vet4.

Can an assistant change my campaigns?

Some connectors allow writes. Our view: require human approval for every change.

Sources

  1. Google Analytics MCP server (GitHub, Experimental)Primary source
  2. Google Ads MCP server (Google Ads API developer toolkit)Primary source
  3. Meta opens its ad system to Claude and ChatGPT with new AI connectors (PPC Land)Blog or media
  4. Get started with custom connectors using remote MCP (Claude Help Center)Primary source
  5. MCP specification: Tools (2025-06-18)Primary source
  6. LLM01 Prompt Injection (OWASP GenAI)Primary source
  7. Reduce hallucinations (Claude Platform docs)Primary source

Let’s find what’s actually working.

Next step. Want to talk through where AI access to your marketing data makes sense? Talk to us about your data set-up.

Talk to us about your data set-up