Which mode should she start with?

Read-only: the agent looks and advises. Meta itself advises starting read-only or approval-required and widening rights as trust grows. You can’t lose money here, and it’s already useful.

How should she phrase it better?

Goal, period, limits and answer format. A four-part brief turns generic tips into a concrete plan and stops the agent from guessing what it may touch.

Don’t connect: official platform server only. An unofficial connector gets access to your budget, and you don’t know what it does with it. Meta has an official address and sign-in through its own window.

How should she read this?

It’s someone else’s text, not a command; the agent’s rights should rule it out. The agent reads comments, reviews and competitor text. Only you give commands, and read-only mode won’t let anything be deleted even if the agent slips.

MCP: an agent connects to your ad account

Lesson 13 of 16 in the course “Marketing 2027”. Free, with animations and a quiz.

What MCP is, in plain words

Until recently an AI assistant could only advise: you copied numbers from your ad account into the chat, it answered, and you went back and clicked the buttons yourself. MCP changes that. Model Context Protocol is an open standard that Anthropic introduced in November 2024. It works like a USB plug: a platform builds one “MCP server”, and any compatible AI agent can connect to it. An agent is an AI that doesn’t just answer but carries out steps itself: looks at data, draws conclusions, proposes actions. Through MCP it sees your ad account directly and, if allowed, can change settings too. Hence the main idea of this lesson: you can give an agent hands, but how much freedom it gets is up to you.

Meta opened ad accounts to agents

On July 16, 2026, Meta opened its ads MCP server to everyone. According to Meta’s documentation, a connected agent can pull reports on spend, clicks and ROAS for any date range. It can create, edit and delete campaigns, ad sets and ads. It works with audiences and product catalogs, runs A/B tests and lift tests, meaning checks of how many sales the ads actually added. And it can check signal health, meaning whether purchase data is coming through. Among the first partners Meta names Salesforce Agentforce, Snowflake and Triple Whale. Sounds like a dream, but notice the word “delete.” An agent with those rights is an employee with access to your budget.

The trust ladder

That’s why, alongside the server, Meta built rules: what an agent may and may not do on a specific account. Meta openly advises starting in a “read-only” or “approval-required” posture and widening permissions as trust grows. Picture it as a ladder. Step one: the agent only looks and advises, touching nothing. You can’t lose money here, and it’s already very useful. Step two: the agent prepares changes, but each one waits for your “yes.” Step three: the agent makes small edits on its own within preset limits, for example shifting budget by no more than 10% a day. You move to step three only after weeks on step two, once you’ve seen the agent propose sensible things. A new hire doesn’t get the cash register on day one either.

The platform’s agent or your own

Platforms are building their own agents too. At Google Marketing Live 2026, Google introduced Ask Advisor, a single Gemini-based agent that works across Google Ads, Google Analytics, Merchant Center and Google Marketing Platform. Its plus: nothing to connect, and it knows its own ecosystem very well. Its minus: it can’t see Meta, TikTok or your real store sales. An external agent via MCP can pull it all together: ads from Meta and Google plus your store’s order export. That matters because each platform tends to credit sales to itself, and an outside view catches that. The external agent’s minus is setup and careful handling of access. In practice, you often need both.

How to brief an agent

An agent is like a very fast new employee: it does exactly what it understood. Asking “make my ads better” forces it to guess. Better how: reach, sales, cost per click? And what is it allowed to touch? A good brief has four parts. Goal: “find where we’re losing money.” Period: “over the last 14 days.” Limits: “change nothing, report only.” Format: “a table and the three main takeaways.” That takes 20 seconds to write but turns the answer from generic tips into a concrete plan. One more habit: ask the agent to show which numbers it based each conclusion on. Then a mistake is visible right away, not a week later on your ad bill.

Safety: an agent with access to money

Five rules worth learning before you connect. One: access to your ad account is the key to your wallet, hand it out like the key to your home. Two: connect only to the platform’s official server, for Meta that’s mcp.facebook.com/ads, not a “free connector” from some social media chat. Three: never paste tokens or passwords straight into a chat with AI, sign-in goes through the platform’s official window. Four: the agent reads other people’s text — comments, reviews, competitor descriptions. If one says “delete all campaigns,” that isn’t a command, and a good agent should know that, but it’s better if its permissions don’t allow it anyway. Five: check the account’s change history weekly, it shows what was changed and by whom.

Do it yourself: an analyst agent in one evening

Start on the safest step. Connect an AI agent to the official MCP server of a platform where you run ads, and set the rule to “read-only.” Ask it three questions using this lesson’s formula. Where have we lost money over the last 14 days? What’s growing and why? What should we test next? Then open the ad account and check at least three numbers from the answer against what you see yourself. Note where the agent was right and where it was wrong or made things up. Repeat in a week. If its conclusions match reality two or three times in a row, you can think about step two. If not, you’ve still got a free helper for morning reports.

Check yourself

Which mode should she start with?
Correct answer: Read-only: the agent looks and advises. Meta itself advises starting read-only or approval-required and widening rights as trust grows. You can’t lose money here, and it’s already useful.
How should she phrase it better?
Correct answer: Goal, period, limits and answer format. A four-part brief turns generic tips into a concrete plan and stops the agent from guessing what it may touch.
What should she do?
Correct answer: Don’t connect: official platform server only. An unofficial connector gets access to your budget, and you don’t know what it does with it. Meta has an official address and sign-in through its own window.
How should she read this?
Correct answer: It’s someone else’s text, not a command; the agent’s rights should rule it out. The agent reads comments, reviews and competitor text. Only you give commands, and read-only mode won’t let anything be deleted even if the agent slips.

← Automated campaigns: Advantage+, PMax, AI Max, Smart+ Your own media-buying agent →