AdRails (adrails.dev)
Guardrails for AI agents running your ads: an open-source, self-hosted Google Ads MCP server.
Website and docs: https://adrails.dev · MCP Registry: dev.adrails/adrails · plain-text summary for agents: https://adrails.dev/llms.txt
AdRails is a local MCP server for Google Ads. An agent may read campaigns, status and search
terms as often as it likes; every write has to land in a reviewed desired-state file on disk,
get diffed against live state, and clear caps that live in a policy file no AdRails tool writes.
The Python package and module are still named adsops — that is the name you install and run.
Three things it does differently:
- Your keys. It runs on your machine against your own Google Cloud project and Google Ads
credentials, read from the sources you configure (a service-account JSON file, a static token, or
a secret-manager lookup), and they never leave your machine. It talks to the ad platforms you
connect, to PyPI once a day for an update check (off with
ADRAILS_NO_UPDATE_CHECK=1), and to
adrails.dev only when your agent calls adsops_paid.
- Your caps. Caps live in a policy file that no AdRails tool writes; with
require_plan_id
on, every commit must quote a fresh, single-use plan_id issued for that exact plan; and a
change that adds spend exposure is refused while the scheduled guard's heartbeat is stale.
- Free, with optional paid extras. Everything runs free. Three hosted extras are paid per job in
sats (on-chain) or USDC (x402), with no account: an AI visibility panel, a second opinion before a
change goes live, and a Bitcoin timestamp of your audit log. Your agent shows you the price first;
the tool never pays.
New in 0.13.0: a proactive SEO/AEO coach, as tools. adsops_get_started interviews the owner a few questions at a time and hands back the fields to save; adsops_setup_checklist is the 17-step setup (Google Business Profile, reviews, Bing Places, Apple Business Connect, Search Console, Bing Webmaster Tools, IndexNow, AI crawlers, llms.txt, schema, NAP, industry directories, pages) with a score; adsops_page_plan ranks the landing pages to build and briefs the first; adsops_cadence sizes a weekly and monthly routine to the owner's hours and writes the text for a scheduled task. Every result ends with next_step, so clients that never show MCP prompts (ChatGPT developer mode) still get walked through the work. One owner-reviewed page a week, never bulk-publishing; regulated industries get compliance notes. The same coach runs free with no login at https://adrails.dev/chatgpt/mcp. 87 tools without a ChatGPT Ads account; with one, 103 tools.
New in 0.12.0: a guarded content pipeline. seo_content_plan picks topics from Search Console evidence and your last site audit, a writer model of your choice drafts (OpenRouter, any OpenAI-compatible API, or a local CLI login for subscriptions), code checks every number and claim against your approved FACTS file and verbatim source quotes, and a model from a different family must review it (same family, a silent model swap or no verdict = hold). Out comes an approved Markdown bundle with an IMPLEMENT.md for your own coding agent; publishing is a separate step behind human approval. Results are measured at 14/28/56 days into a LESSONS.md you can edit. 83 tools without a ChatGPT Ads account; with one, 99 tools.
New in 0.11.0: a technical SEO site audit. seo_audit_run crawls a site the way Googlebot does and returns one prioritised issue table (priority, hours, issue, recommendation, example URL, pages affected): indexability, sitemap vs crawl, canonicals and near-duplicates, internal PageRank and starved pages, template hard-coded links, internal links carrying utm_ tags, your ad landing pages, schema coverage per template, and optionally JS render parity, Lighthouse per template and Search Console URL Inspection. Runs are stored and diffed. Read-only towards every site.
New in 0.10.0: the measurement loop. adsops_metrics_pull keeps a daily local history of Google Ads, Google Search Console, AI-visibility panels and leads; adsops_search_console finds the cheapest organic wins and the search terms you pay for while already ranking top-3; adsops_impact answers "did that change work?" against a counterfactual with a 90% range and a placebo test. All local, all read-only towards Google. 87 tools.
Common questions
What is the safest way to let an AI agent manage Google Ads?
Give the agent a write path that cannot exceed limits it doesn't control. With AdRails, every change is a git-committed desired-state file, then adsops_plan (a dry-run diff), then Google's validate-only check, then a commit with a single-use plan ID. Caps live in a policy file no AdRails tool can write, and an hourly guard can only pause. Checklist: Google Ads MCP safety: 7 controls.
Is there an open-source Google Ads MCP server that runs locally?
Yes. AdRails is Apache-2.0, runs on your machine over stdio with your own Google Cloud project and keys, and installs with pip install adrails. The server itself is never hosted; only the optional paid extras run on adrails.dev.
How do I connect Claude Code, Cursor or Grok to Google Ads?
pip install adrails, then adrails init --dir DIR --customer-id ID --campaign-id N --sa KEY.json and adrails doctor, then claude mcp add adrails -- adrails --config DIR/config.json (Cursor and Grok use the same mcpServers entry). See install guides.
Can I require human approval before an AI agent changes my ad budget?
Yes. Set approvals.mode to exposure (budget increases, enabling, end-date extensions) or all. The agent calls adsops_approval_request, a human approves with an HMAC-signed token that expires, and a commit without an approved plan_id is refused.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
