What Meta actually built
On 29 April 2026 Meta announced what it calls ads AI connectors, in open beta. There are two of them. One is a command line tool for developers. The other is an MCP server, and that is the one this page is about.
In plain terms: Meta put a socket on your ad account. Your AI app plugs into it. After that you can say “how did last week go” or “pause the ad sets over 50 ringgit per lead” and the AI does it against your real account.
The server lives at https://mcp.facebook.com/ads. Meta says it “works with any MCP-compatible AI agent.” Claude is where the search demand is, so that is what we use in the examples, but ChatGPT and the others work the same way, because they are all speaking the same protocol.
One thing to be clear about up front, because it is the whole reason this is worth writing about: this is not a reporting tool. Meta lists creating and editing ads, ad sets and campaigns among the things it does. It writes. We will come back to what that means for you.
How the AI actually works
This is the part most articles skip, and it is the part that decides whether you trust the thing. It is not complicated. It just has to be said out loud.
The AI is not clicking around Ads Manager
There is no robot moving a mouse. What Meta published is a list of functions. Each one does a specific job: fetch these numbers, create that ad set, update this budget. The AI cannot do anything to your account that is not on that list.
That list is the boundary. It is worth holding on to, because it means the question “what could the AI do to my account” has an actual answer rather than a vague one.
How it learns what it can do
When your AI app connects, it asks the server one question: what have you got? The server sends back every function, and for each one it sends three things.
- A name, like a function in code.
- A description in plain English, saying what the function does and when to use it.
- A schema listing what information the function needs, and which parts are required.
Your AI app collects those and holds them. Now the model knows what is possible.
How it decides which one to use
Here is the important bit. The model reads those descriptions and picks.
You type a sentence. The model compares what you asked for against the descriptions it was given, and chooses the function that looks like the closest match. Then it fills in the required fields from what you said.
Read that again, because it has a consequence people miss. The choice is made by a language model reading English descriptions. It is not a rules engine. It is not a lookup table. It is the same kind of judgement the model uses when it answers a question, applied to picking a function. Usually it picks correctly. It is not guaranteed to.
This is also why the same request can behave differently on different days, and why being specific helps so much. “Pause the bad ones” leaves the model deciding what bad means. “Pause every ad set in campaign X with cost per result above 50 ringgit over the last 7 days” leaves it almost nothing to interpret.
What actually happens when it runs
The model does not reach out to Meta itself. It hands the request back to your AI app, and the app makes the call. Meta does the work, sends back a result, and the app drops that result into the conversation. Then the model reads it and writes your answer.
So the loop is: you ask → the model picks a function → your app calls Meta → Meta acts → the result comes back → the model explains it to you.
Everything the AI tells you about your account came back through that loop. If it says your CPA is 42 ringgit, that number came from Meta a second ago. That is the genuine gain here: the AI is not remembering or guessing your numbers, it is fetching them.
Where you sit in the loop
The protocol has a way for a server to stop and ask you something mid-task — including asking you to confirm an action. It is a real part of the spec.
But be careful about what that guarantees, because it is less than it sounds. Whether you get an “are you sure?” prompt before something changes is decided by your AI app, not by the protocol. Different apps handle it differently, and the same app can handle it differently depending on your settings.
So do not assume a confirmation step exists because it feels like it should. Find out how your app behaves before you point it at a live account. And note the other half of it: there is no undo. A function that changes a budget changes the budget. Nothing in the protocol reverses it.
What it can reach, and what it can change
Meta groups the capabilities like this:
| Area | Reads or changes? |
|---|---|
| Ads creation and editing | Changes |
| Custom audiences | Changes |
| Catalogue creation and management | Changes |
| Comprehensive performance | Reads |
| Signal diagnostics | Reads |
| Help and troubleshooting | Reads |
| A/B tests and conversion lift studies | Both |
On the number of tools. A lot of articles state a specific figure. We are not going to repeat it, because we could not find that number anywhere in Meta’s own material, and Meta’s tool pages would not load for us in a readable form. The count also moves — Meta added capabilities on 16 July 2026, less than three months after launch. Treat any fixed number you read as third-party and probably already stale.
Meta does say the tools are permission-scoped, and that setup needs “no developer credentials, API setup, or coding.” You sign in as yourself. The AI gets what your account already has, which cuts both ways: if you have full control of the portfolio, so does the thing you just plugged in.
Launching a campaign
The realistic version is a conversation, not one instruction.
What works is giving it the things it cannot infer, in one go: objective, budget, audience, the page and pixel to use, and where the traffic lands. What does not work is “make me a campaign for my shop” — not because it will refuse, but because it will fill the gaps itself, and you will not necessarily be told which gaps it filled.
Two habits are worth building from the start.
- Have it build paused. Ask for everything created in a paused state, then read it in Ads Manager before it spends. This is the single cheapest safety net available.
- Make it tell you what it did. Ask it to list back the exact campaign, ad set and ad it created, with the IDs. If it created something in the wrong ad account, this is where you find out, not on the invoice.
If you are building on a new or recently restricted account, the ordering advice in our ad account warm-up guide still applies. An AI agent will happily create a campaign that spends far too fast on a cold account, because nothing in the tool list tells it not to.
Optimising
This is where it earns its keep, and it is mostly because of how fast it reads.
Pulling a week of performance broken down three ways, then explaining what changed, is genuinely quicker than doing it by hand. Questions that work well:
- Which ad sets got worse this week compared with last, and by how much.
- Where the spend actually went versus where the results came from.
- Which ads are carrying a campaign and which are along for the ride.
Then there is the acting-on-it half, which needs more care. Editing is exactly where an agent can quietly cost you money, and the reason has nothing to do with AI — it is how Meta’s delivery system works. Significant edits restart the learning phase. An agent asked to “optimise” may make ten sensible-looking changes and reset ten ad sets in the process.
The sources disagree on the exact threshold that counts as significant, and we go through that disagreement in why Facebook ads stop spending. The practical rule holds either way: change one thing, then wait. That is the opposite of what an agent will do if you let it.
It is also worth knowing that spend can stop for reasons no amount of optimising will fix, such as a limit you or Meta set. Our page on the ad account spending limit covers which limits exist and who controls them.
Monitoring
Monitoring is the safest use of the whole thing, because most of it only reads.
Two areas are genuinely useful. Performance, where you can ask for a breakdown in words instead of building it in the UI. And signal diagnostics, where it can pull the health of your pixel and datasets — the sort of thing that quietly degrades for weeks before anyone opens the right screen.
If you want one habit from this article, make it a standing read-only check: ask it every Monday what changed and what looks wrong. No write access needed, and it catches the slow problems.
The guardrails, and their limits
On 16 July 2026, less than three months after launch, Meta added ads MCP server rules. In Meta’s words, these give anyone with full control of a business portfolio the ability to govern what AI agents can do on their ad account, “from budget changes to catalog updates.”
That is the most important sentence for anyone running client accounts. Governance sits at the portfolio level, so it belongs with whoever owns the business portfolio, not with whoever happens to be chatting to the AI.
So there are three separate controls, and they are easy to confuse:
- Your Meta permissions. The agent inherits what you can already do. It cannot exceed you.
- MCP server rules. Set by the portfolio owner. Governs what agents may do regardless of who is asking.
- Your AI app’s own behaviour. Whether it pauses to ask before acting. This one is not Meta’s and not the protocol’s.
Only the first two are Meta’s. The third is the one people assume is stronger than it is.
Where it goes wrong
Not theory. These are the failure modes that follow directly from how the system works.
- The wrong ad account. If you have access to several, the model picks one from context. It can pick wrong, and a campaign built in the wrong account looks completely normal until you check. Name the account explicitly.
- Confident numbers that answer a slightly different question. The figure is real and came from Meta, but the date range or breakdown may not be the one you meant. If a number will drive a decision, ask which range it covers.
- Over-editing. Covered above, and the most expensive one, because the damage shows up a week later as worse delivery rather than as an error.
- Assuming a confirmation step. Believing the app will ask before it acts, when it will not.
- Treating a beta as settled. This changed materially between April and July. It will change again.
None of these mean don’t use it. They mean use it with write access understood rather than assumed.
Writing requests the model cannot misread
Everything in the failure list above traces back to one property: the model chooses a function by reading English, so ambiguity in your sentence becomes a decision it makes on your behalf. That is fixable, and it is cheaper than any other control here because it costs nothing.
The pattern is the same every time. Name the account. Bound the data. Define the threshold. State the end state. A request missing one of those has handed that piece to the model.
| Leaves a decision to the model | Does not |
|---|---|
| “Pause the bad ad sets” | “In ad account 123, pause every ad set in campaign X with cost per result above 50 ringgit over the last 7 days” |
| “How did last week go?” | “For ad account 123, spend and cost per result by campaign, 11 to 17 August, compared with the 7 days before” |
| “Increase the budget on the winners” | “Raise the daily budget on ad set 456 from 100 to 120 ringgit. Change nothing else.” |
| “Set up a campaign for the new offer” | “Create, paused, in ad account 123: objective, daily budget, audience, page, pixel and destination URL, then list the IDs you created” |
Three habits worth adding to that:
- Ask for a plan before a change. “Tell me what you would change and why, do not change anything yet” turns a write into a read, and you keep the analysis.
- End editing requests with a scope limit. “Change nothing else” is a real constraint on a model that is otherwise happy to be helpful.
- Ask what it did, not whether it worked. “List every object you created or modified with its ID” produces something you can check. “Did that work?” produces a sentence.
Stated plainly: this section is ours. Neither Meta nor Anthropic publishes prompt guidance for this server. It follows from the documented architecture rather than from testing we can show you.
Meta’s server vs third-party ones
Third-party Meta ads MCP servers existed before Meta shipped its own, and they still exist. They are built on the same Marketing API underneath.
The difference that matters is where your access lives. With Meta’s own server you authorise through Meta and the connection is between you and Meta. With a third-party server, a company sits in the middle. That may be a fine trade for features they add on top — but it is a decision to make deliberately, and on a client’s ad account it is a decision to make in writing.
We would start with Meta’s own and add a third party only for something it genuinely cannot do.
FAQ
Can I connect Claude to my Meta ads account?
Yes. Meta’s ads MCP server is at https://mcp.facebook.com/ads and Meta says it works with any MCP-compatible AI agent. You sign in with your own Meta account; Meta states no developer credentials or coding are required. Setup is the subject of our next article.
Can the AI actually create and change ads, or only read reports?
It creates and changes. Meta lists creating and editing ads, ad sets and campaigns, plus custom audiences and catalogues, alongside the read-only reporting. Treat it as a tool with write access from day one.
Will it ask me before it changes something?
Maybe, and that is the honest answer. The protocol allows a server to ask for confirmation, but whether you actually see a prompt is decided by your AI app rather than by Meta or by the protocol. Check how yours behaves before pointing it at a live account.
How does the AI decide what to do?
It reads a list of functions Meta publishes, each with a plain-language description, and picks the one that best matches what you asked. That is a language model making a judgement from text, not a rules engine, which is why specific instructions work better than vague ones.
How many tools does the Meta ads MCP server have?
Meta does not publish a count that we could verify, and the set is growing — capabilities were added on 16 July 2026. Any specific number you see is third-party. Meta’s own material describes capability areas instead, which we list above.
Is it safe to give an AI agent access to a client ad account?
It can be, with the portfolio-level MCP server rules configured first, permissions limited to what the work needs, and the client told. The agent inherits whatever you can do, so an unrestricted user means an unrestricted agent.
Can I undo something the AI changed?
Not through the agent. A function that changes a budget changes it, and nothing in the protocol reverses that. Whatever recovery exists is whatever Meta’s own interface offers for that object, which is why building paused and asking for a list of IDs afterwards are worth more here than they would be with a tool that had an undo.
What is the ads MCP server actually for, if I already have Ads Manager?
The gain is reading speed, not clicking speed. Pulling a week of performance broken down several ways and having the differences explained is genuinely faster in a sentence than in the interface, and signal diagnostics surface the kind of decay that goes unnoticed for weeks. The writing half is available from day one, but it is not where the reliable value is.
Does it work with ChatGPT, or only Claude?
Any MCP-compatible agent, in Meta’s wording. The examples here use Claude because that is where the questions come from. What differs between apps is whether you are asked to confirm before a write, since that is the app’s decision rather than Meta’s or the protocol’s.
Is this out of beta?
Unclear, and we would rather say so. Meta’s April announcement calls it open beta, its July developer post says it is now available for developers, and Meta’s own MCP hub page lists a different server as generally available without listing this one. Plan for a product still moving.
Sources
- Meta for Business — Introducing Meta Ads AI Connectors. Source of the 29 April 2026 open beta announcement, the four capability descriptions, the “no developer credentials, API setup, or coding required” wording, and the 16 July 2026 update including ads MCP server rules and the “from budget changes to catalog updates” quote.
- Meta for Developers — Ads MCP Server overview. Source of the
https://mcp.facebook.com/adsendpoint, the “works with any MCP-compatible AI agent” wording, and permission-scoped tools. - Meta for Developers — Meta’s ads MCP server is now available for developers (16 July 2026). Source of the capability areas listed in the table and the OAuth authentication model.
- Model Context Protocol — Architecture overview. Source of everything in “How the AI actually works”: the client-server design, tools carrying a name, description and input schema, the model selecting a tool and the application executing it, and the confirmation mechanism being available to servers rather than guaranteed by the protocol.
Checked on 14 August 2026. Two things we could not verify and have labelled rather than guessed: the number of tools, which Meta does not appear to publish and whose category pages did not render in readable form for us, and whether the ads MCP server is still formally in beta, where Meta’s own pages disagree. This is a product that changed within three months of launch, so check the source pages before acting on anything dated here.
Setting it up is covered separately, in how to connect Claude to Meta Ads Manager. If you would rather this was run for you, we manage paid social accounts, or get in touch.