google_ads.query · Ads MCP: Risk & Policy

WHAT IT DOES

What google_ads.query does on Ads

AI agents invoke google_ads.query to trigger actions in Ads. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why google_ads.query needs a policy

Although the tool is documented as read-focused, the ability to 'run' arbitrary GAQL queries against Google Ads systems qualifies as Execute rather than Read because it involves executing a query language that could potentially be misused to perform unintended operations. The severity is high due to access to sensitive advertising account data and campaign information, though financial impact is indirect.

From the tool's definition Tool description states 'Run a GAQL query against Google Ads' and explicitly describes it as enabling arbitrary queries via GAQL. While primarily a read operation ('Use this for any read'), GAQL is a full query language that can execute complex operations.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

google_ads.query Rate-limited

google_ads.query stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "google_ads.query": {
      "limits": [
        {
          "counter": "google_ads.query_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Ads, so you can run agents against it safely.

FAQ

Questions about google_ads.query

What does the google_ads.query tool do? +

Run a GAQL query against Google Ads. Returns the raw response envelope (results, fieldMask, nextPageToken). Use this for any read; the GAQL reference is at developers.google.com/google-ads/api/docs/query/overview. It is categorised as a Execute tool in the Ads MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on google_ads.query? +

Register the Ads MCP server in PolicyLayer and add a rule for google_ads.query: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Ads. Nothing to install.

What risk level is google_ads.query? +

google_ads.query is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit google_ads.query? +

Yes. Add a rate_limit block to the google_ads.query rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block google_ads.query completely? +

Set action: deny in the PolicyLayer policy for google_ads.query. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides google_ads.query? +

google_ads.query is provided by the Ads MCP server (manlikemuneeb/ads-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.