Remote MCP instance · Google Ads

BIFROST

A hosted, invite-only instance of the official Google Ads MCP server. Your agents get one endpoint; every user signs in with their own Google account and sees only the Ads accounts they already have access to.

Request an invite Read the spec

official google-ads-mcpstreamable-httpper-user Google OAuthread-only surface

01 — Endpoint

Point your client at one URL.

No local process, no credential files. Add the endpoint to Claude, Cursor or any MCP client that speaks OAuth — the browser opens, you sign in with Google, and the server uses your token for every Ads API call it makes on your behalf.

// mcp.json

{
  "mcpServers": {
    "bifrost": {
      "url": "https://bifrost.5pm.ai/mcp"
    }
  }
}

OAuth 2.1 · PKCE · dynamic client registration — no manual tokens to copy.

02 — Surface

Three tools. Zero mutations.

The upstream server is read-only by construction — reporting, account discovery and schema metadata. Nothing on this surface can change a campaign.

search_searchread-only

Builds and runs a GAQL query (SearchStream) against a customer: pick a resource, fields, optional conditions, orderings and a row limit.

customers_list_accessible_customersread-only

Lists the Google Ads customer IDs your signed-in Google account can access. Access follows Google Ads user roles — direct or via a linked manager account.

metadata_get_resource_metadataread-only

Describes a GAQL resource: which fields are selectable, filterable and sortable. Useful before composing a search.

resource · discovery-documentresource · metricsresource · segmentsresource · release-notes

03 — Access control

Two gates on every call.

1 · The allowlist

Bifrost is invite-only. An admin approves every member by name and phone number; the console is gated by a one-time SMS code and an httpOnly session cookie. No allowlist entry, no tool calls — even with a valid Google login.

2 · Your Google account

Every MCP session authenticates with the caller's own Google identity over OAuth 2.1. The server queries the Ads API with your token — you can only ever read accounts Google Ads already lets you read.

04 — Telemetry

Every tool call leaves a trace.

Full call record

Tool, arguments, result preview, duration and outcome retained per invocation.

Caller identity

Google identity, MCP client name and version, session and request IDs on every row.

Denials recorded

Calls from accounts outside the allowlist are blocked and logged.

05 — Access

Cross the bridge.

Access is invite-only. Tell us who you are and an admin will review your request.

Already a member? Sign in to the console