--- title: "MCP server for awareness advertising | AdBuyMCP" description: "Connect Claude or another approved client to your AdBuyMCP workspace to draft, review and report on your awareness plan. Only a person can commit money." url: "https://adbuymcp.com/mcp" --- [Home](https://adbuymcp.com/) / MCP server MCP server # Claude can draft and report on your awareness plan, and only a person can commit money. AdBuyMCP runs a hosted Model Context Protocol server with 105 tools. Once Claude, or another client, is approved for your workspace, it can draft, review and report on your awareness plan through the same routes and approval records as the browser. The connection grants no spend authority: anything that commits money waits for a person. [Get my plan and price](https://adbuymcp.com/start) [Book a 30-minute call with the founder](https://adbuymcp.com/contact#book) Free, with no card. We read your homepage, draft who buys from you and show your monthly price before you join the waitlist. Nothing is bought until you've approved the plan and the ads. - **tools, each wrapping one REST endpoint**: 105 - **groups, from the plan to the report**: 9 - **workspace boundary, spending check, approval record and audit trail that agent and browser share**: 1 - **consequential operations with no agent tool**: 11 Launch phase [The evidence ledger](https://adbuymcp.com/supply) shows what each connector has proved. - **Transport**: Streamable HTTP - **Protocol**: 2026-07-28 and pre-2026 - **Deployment**: Hosted, workspace-scoped - **Approvals**: Exact-digest, single-use The short answer ## Claude and the browser work through the same routes The MCP server is optional. The browser calls the same endpoints, so Claude is one more way to work on your plan, with the same rules. Each of the 105 tools is a thin wrapper over exactly one REST endpoint, the same endpoint the browser calls. The agent and the browser therefore run on one execution path, with one workspace boundary, one spending check, one approval record and one audit trail. No tool exists for 11 consequential operations, so an agent prepares and proposes, and a named person releases the money. If you'd rather see the approval path before you connect Claude, James Rooney can walk you through it. [Book a 30-minute call with the founder](https://adbuymcp.com/contact#book) The authority model ## The agent works inside a mandate you grant Give the agent a mission and a bounded mandate. It drafts the plan and the ads, surfaces evidence and exceptions, and asks for an exact approval where its authority runs out. An MCP connection grants no spend authority, and no channel has yet run a paid campaign through AdBuyMCP's own connectors. High-consequence work waits for a single-use approval bound to an exact action digest. The request that executes is the one you read: if the bytes differ by a character, it fails closed. The steps run in this order. 1. 01 ### Mission A durable objective with a name, owned by your workspace. Closing one is a human action. 2. 02 ### Mandate A versioned, revocable grant naming exactly which actions are allowed, in which currency, for how long, and up to what money ceiling. You can read it, issue a new version or withdraw it. 3. 03 ### Run and ordered steps Work runs as ordered steps against the mandate, and each step is recorded. A stopped run resumes from the step it stopped on. 4. 04 ### Exact-digest approval High-consequence work waits for a single-use approval bound to an exact action digest. The request that executes is the one you read: if the bytes differ by a character, it fails closed. 5. 05 ### Exceptions stop the run An ambiguous supplier outcome raises an exception, halts the run and waits for a person to read the response, say what happened and resume. Halting the run prevents an uncertain activation from being retried into a second live campaign. 6. 06 ### Decisions and evidence What was decided and what proved it are recorded as first-class objects, so "why did the agent do that?" has an answer you can open. > A mandate holds an agent’s authority, and a person can replace or revoke it. On the mandate, which bounds every other step What an agent cannot reach ## Only a person can perform these 11 operations An agent has no tool to call for any of them. They are human-only signed actions, and an agent that tries to authorise its own work gets a 403 asking for a person. - Resolving an approval - Resolving a campaign provider attempt - Acknowledging a booking-workflow step - Resolving an asset job - Replacing a mandate - Revoking a mandate - Closing a mission - Saving a supplier dossier - Verifying a supplier dossier - Issuing a live execution grant - Revoking a live execution grant The API keeps more for people than this list. Supplier booking confirmations, managed stops, spend-lock resolution, provider-spend reconciliation, brand-lift purchases and identity-cohort imports are human-only as well, and no tool reaches any of them. ### These rules stand behind the list. - People grant and withdraw authority. An agent works inside the mandate it was given. - Only a person can close a mission. - A human approval is resolved by a human; an agent credential asking to resolve one gets a 403. - Pairing a human credential with the reserved MCP marker fails the request outright, so nothing quietly takes the browser path instead. - Approval records evidence. Enabling spend on a live line is a second action, granted separately. - A supplier's answer to a booking request is recorded by a person, and a request past its 12-hour deadline never counts as accepted. If you need this list settled before an agent works on your plan, go through it with the founder first. [Book a 30-minute call with the founder](https://adbuymcp.com/contact#book) The tool surface ## The server has 105 tools in 9 groups The groups follow the job, from describing your buyers to reading what ran. Open a group to read its tool names. ### Missions and authority Recover workspace evidence and your agent-owned buyer conversations, then work inside a durable mission and a bounded mandate. An exception stops the run until you say what happened. **22 tools** - get_buyer_context - list_buyer_sessions - get_buyer_session - list_agent_actions - prepare_agent_action - create_agent_mission - list_agent_missions - get_agent_mission - start_agent_run - list_agent_runs - get_agent_run - add_agent_step - complete_agent_step - request_agent_approval - advance_agent_run - raise_agent_exception - list_agent_exceptions - resolve_agent_exception - resume_agent_run - record_agent_decision - record_agent_evidence - finish_agent_run ### Audience and planning Describe who buys from you, turn that into each channel's own targeting terms and draft a plan, or pick the inventory by hand. The registry also keeps the search keyword tools and Google Ads' own forecast, which creates no campaign and spends nothing. **14 tools** - list_personas - extract_persona - compile_persona - browse_inventory - generate_plan - create_manual_plan - list_plans - get_plan - update_plan_allocations - approve_plan - suggest_search_keywords - get_plan_search_keywords - set_plan_search_keywords - forecast_search_performance [How it works](https://adbuymcp.com/how-it-works) ### Identity and audience data Match a consented customer list to EUID, check it for opt-outs, and classify UK postcodes with CACI Acorn. Each live call waits for a person's approval, and the EUID agreement and the Acorn licence are both unsigned, so these tools make no live calls today. **5 tools** - list_identity_cohorts - get_identity_cohort - map_identity_cohort - check_identity_optouts - classify_postcodes [How each data connector is graded](https://adbuymcp.com/supply) ### Creative Read existing creative, adapt a concept for another permitted channel, generate channel-correct copy or upload your own, and precheck it against format and clearance rules. Submission and paid asset production have their own approval gates. **11 tools** - list_creatives - adapt_creative - generate_creative - upload_creative - precheck_creative - revise_creative - set_campaign_creatives - submit_creative - get_asset_pricing - produce_asset - get_asset_status [The creative studio](https://adbuymcp.com/creative) ### Launch and lifecycle Launch, pause and resume a campaign, check its readiness and read every provider attempt. A booking request gives the supplier 12 hours to confirm, a person records the answer, and a request that runs past the deadline never counts as accepted. **11 tools** - launch_campaign - pause_campaign - resume_campaign - list_campaigns - get_campaign - get_campaign_readiness - get_campaign_bookings - request_campaign_booking - list_live_execution_grants - list_campaign_attempts - get_campaign_dead_letters [How each connector is graded](https://adbuymcp.com/supply) ### Delivery and measurement Read delivery, measurement and the journey view, set up tracking and a provider conversion goal, import outcomes and sync an audience. The prove_it tool turns down a test your spend cannot power. **15 tools** - get_delivery - get_measurement - get_campaign_tracking - set_campaign_tracking - list_campaign_conversion_goals - set_campaign_conversion_goal - import_outcomes - get_outcome_health - get_campaign_report - prove_it - get_campaign_insights - get_journeys - sync_audience - mmm_readiness - run_micro_mmm [What the weekly report shows](https://adbuymcp.com/measurement) ### Brand-lift studies Scope, preview, quote and launch a Cint brand-lift survey on a campaign, then read its results. A person approves the purchase. No Cint contract is signed yet, so no live study has been commissioned, and brand lift reports as not commissioned until a campaign has one. **12 tools** - list_brand_lift_studies - get_brand_lift_study - get_brand_lift_study_catalogs - preview_brand_lift_study - create_brand_lift_draft - create_brand_lift_study - update_brand_lift_study - request_brand_lift_quote - launch_brand_lift_study - refresh_brand_lift_results - get_brand_lift_results - request_brand_lift_cancellation [How measurement works](https://adbuymcp.com/measurement) ### Optimisation Each proposal carries its reasoning and waits for a person to decide on it before any budget moves. **4 tools** - generate_optimizations - list_optimizations - approve_optimization - reject_optimization ### Money, connections and audit Read the billing summary, statements and top-ups, the supplier dossiers and the trail of who did what, and ask the server which product and channels it serves. **11 tools** - get_workspace_overview - get_platform_info - get_brand_analytics - list_connections - get_supplier_dossier - set_connection - get_billing_summary - get_billing_statement - get_topup_status - top_up_wallet - get_audit [How pricing works](https://adbuymcp.com/pricing) The names come from the server’s own tool list and were last checked against the product’s code on 7 October 2026. Agents can read the same catalogue, with each tool’s annotations, as [JSON at /mcp/tools.json](https://adbuymcp.com/mcp/tools.json). Protocol and transport ## Approved clients connect over streamable HTTP Older clients still connect, and the boundary fails closed. 01 ### Clients negotiate the 2026-07-28 protocol A client reaches the hosted service over streamable HTTP, and the server also speaks stdio. Modern clients negotiate with server/discover, and every later request carries the negotiated version plus client identity and capabilities in its metadata envelope. 02 ### Clients from before 2026 still connect Older clients may use the legacy initialize handshake over stdio or stateless HTTP. Legacy HTTP answers with plain JSON and no session id through a separate JSON transport on the same `/mcp` endpoint, apart from the modern handler's SSE framing. The product's tests pin modern negotiation, the latest legacy negotiation, a 2025-11-25 HTTP round trip, exact tool registration, wire metadata and cancellation in both eras. 03 ### The HTTP transport keeps no session The HTTP transport answers `POST /mcp` only and needs no session affinity, so a deployment runs behind load balancers without sticky routing. It opens no sessions, server-initiated streams or subscriptions, so a client polls the status tools for campaign, booking, approval and asset state. 04 ### The boundary is fail-closed Every deployment AdBuyMCP runs has to name its exact allowed hosts and allowed browser origins, with `none` where it has no browser clients. Verifier time, request concurrency and body size are all bounded (64 concurrent requests, a 32 MiB body and a 30-second API deadline), and a modern HTTP request missing its protocol version header is rejected before dispatch, with the JSON-RPC id preserved and no downstream call made. Credentials ## An agent arrives with its own credential > Your dashboard session and your MCP client's grant have separate audiences. A human session forwarded to MCP is refused with 401. Hosted MCP verifies the Supabase signature, issuer, MCP audience, expiry, registered client identity and server-owned workspace and product claims. Each request receives a short-lived, signed delegation for the API's separate audience, and the API rechecks the actor and workspace. Actor and client attribution persist on actions; an agent credential cannot resolve a human approval or grant itself authority. ### The server has three authentication modes. #### Hosted sign-in uses Supabase OAuth This is the deployed sign-in path at app.adbuymcp.com. An approved person signs in, selects their workspace and consents through an authorization-code flow with PKCE S256. Tokens are short-lived and bound to the MCP resource and a registered client. Each external client needs its own approved registration and exact callback URLs; automatic public registration is disabled. #### A private deployment can use a static token The server also has a static service-token mode for a private deployment serving one organisation. It is not how hosted customers sign in and is never used as public multi-user authentication, and the server refuses to start with static tokens and OAuth combined. #### Development runs without credentials A development mode runs without credentials on AdBuyMCP's own machines. Its development identity is no authentication boundary, and the hosted service always requires Supabase sign-in. Encryption, retention and the identity boundaries are written down on [the security page](https://adbuymcp.com/security), in the detail a reviewer will ask for. Setup ## Connect an approved client to your workspace Choose a client that supports pre-registered OAuth identities. Each one needs its own approved identity and exact callbacks before it can connect to your workspace. AdBuyMCP runs the MCP server, so there is nothing for you to host. MCP access requires an approved workspace and a compatible external client with its own approved client ID and exact callback registration. Connect through Supabase sign-in, workspace selection and OAuth consent. Tool access follows the workspace's enabled capabilities, and consent grants no spend authority. There is no public connector or registry listing. The connectors behind these tools are graded on one evidence standard, and [the supply page shows each connector’s grade](https://adbuymcp.com/supply). ### Claude HTTP + OAuth ``` https://app.adbuymcp.com/mcp ``` An approved account can connect a compatible Claude client after its own OAuth client ID and exact callback are registered. Confirm pre-registration support for the Claude product you use; a Claude Code integration does not establish a claude.ai or Desktop connector. Sign in, select the workspace and consent. No public AdBuyMCP connector is listed. ### Codex HTTP + OAuth ``` https://app.adbuymcp.com/mcp ``` Use a Codex version that supports the approved pre-registered OAuth client. Obtain its own client ID and register its exact callback before signing in and granting workspace access. The browser buyer's client ID belongs to the dashboard and cannot be copied into an external client configuration. ### Grok HTTP + OAuth ``` https://app.adbuymcp.com/mcp ``` Check that your chosen Grok client supports remote streamable HTTP and a pre-registered OAuth client. A Grok connection has not been accepted here. Register the client's exact callback before trying it; protocol support alone does not establish compatibility. ### Other HTTP + OAuth ``` https://app.adbuymcp.com/mcp ``` A compatible client must support protected-resource discovery, authorization code with PKCE S256, the MCP resource audience and pre-registration. Give us its exact callback for approval before connecting. A client that requires automatic registration cannot connect under the current issuer settings. GET /healthz and GET /capabilities answer without authentication, as does the OAuth protected-resource discovery document. These endpoints return service and contract metadata. Every tool call requires a valid MCP OAuth grant for an approved workspace. Tool annotations ## Each tool carries hints that tell a client what to confirm These are discovery hints, and a good client uses them to decide what to surface and what to confirm. The security boundary sits a layer below, in the API's fail-closed execution hook, which rejects any consequential call that does not match a registered action and an approval granted for those exact bytes. What a client is told about each tool - **Read-only**: 52 of 105 - **Destructive**: 40 of 105 - **Idempotent**: 34 of 105 - **Open-world**: 27 of 105 The four sets overlap. They add to more than 105, because one tool can carry more than one hint. ### The API decides whether a call is allowed. A hint tells a client what to surface and what to confirm before it calls. Whether the call goes through is decided at the API, where a consequential call is rejected unless it matches a registered action and an approval granted for those exact bytes. It is the same gate the browser passes through. Who this is for ## The server suits founders who already work in Claude A founder who never opens Claude gets the same plan, the same approvals and the same weekly report in the browser. The server is for teams who already work in Claude and would rather review the plan and read the report there. It stops and asks before anything that commits money, so it’s the wrong tool if you want software that moves budget on its own. Connecting a client doesn’t change what you pay. Plans are priced by the size of your market, from £3,000 a month, all-in and before VAT. [See how pricing works.](https://adbuymcp.com/pricing) Our trust page sets out how each channel is bought, what your weekly report shows and how we handle your data. [Trust and limits](https://adbuymcp.com/trust) ### Look up a term or follow a step-by-step guide - [Model Context Protocol (MCP)](https://adbuymcp.com/glossary/mcp) - [Evidence ledger](https://adbuymcp.com/glossary/evidence-ledger) - [Connect Claude to your AdBuyMCP account](https://adbuymcp.com/how-to/connect-claude-to-adbuymcp) - [Grant and revoke an agent mandate](https://adbuymcp.com/how-to/grant-and-revoke-an-agent-mandate) ## What buyers ask about the MCP server These cover connecting Claude, what stops an agent spending, unclear supplier answers, protocol versions and other clients. ### Can I connect Claude to AdBuyMCP today? Yes, with a workspace approved for MCP access and a compatible client whose own OAuth client ID and exact callback have been registered. AdBuyMCP runs the hosted server; you sign in through Supabase, select your workspace and consent. Not every Claude product has been registered or accepted yet, so confirm the client you use before connecting. The connection follows your workspace's enabled capabilities and grants no spend authority, and nothing is bought until the plan, the ads and the start date are confirmed with you. There is no public connector or registry listing. ### Is MCP the product, or a feature of it? It's a feature. AdBuyMCP buys awareness advertising, and the MCP server is one way to work on your plan: from Claude, or another approved client, instead of the browser. Both go through the same routes and approval records, so an agent gets exactly the rules a person gets. ### Can Claude spend my money without asking? No. The block is built into how the server authorises a call. Consequential calls fail closed unless the incoming request matches an approval a human granted for those exact bytes, spend runs against a mandate with an explicit money ceiling and expiry, and enabling spend on a live line is a second action granted separately from the approval. Authority is granted, withdrawn and closed by people; approvals are resolved by people. ### What happens when a supplier returns something ambiguous? The run stops. The exception waits for a person to read the response, say what happened and resume. That is the specific failure this design exists to prevent: an agent that cannot read a supplier's response and tries again has just created a second campaign nobody knows about. ### Which MCP protocol versions do you support? The modern 2026-07-28 protocol, with server/discover negotiation and per-request metadata. The hosted service is reached over streamable HTTP, and the server also speaks stdio. The pre-2026 initialize handshake also works over stdio and stateless HTTP, and tests pin that compatibility path, including a 2025-11-25 HTTP round trip and cancellation behaviour in both eras. ### Can I use this from something other than Claude? Yes. The hosted endpoint uses standard streamable HTTP and Supabase OAuth. A compatible client needs protected-resource discovery, PKCE S256, resource audiences and an approved pre-registered client identity with exact callbacks. The protocol is shared; acceptance of one client does not prove another can connect. No client receives authority to approve its own spend.