OAUTH

Meta Ads MCP server, with a policy gate.

Gentkey connects Meta Ads directly through the Marketing API and its own OAuth app, giving every agent read access while campaign delivery and spend stay behind explicit, revocable, rate- and budget-capped grants.

Connect Meta Ads Setup in 3 steps

Your agents connect tohttps://app.gentkey.com/mcpclaude.ai (web & mobile) · Claude Code · Cursor · any MCP client

ACCESS MODEL

What’s free, what needs a grant.

Reads: Account discovery, campaigns, ad sets, ads and creative summaries, performance insights, and interest-targeting search work with no grant. Every call goes directly from Gentkey to Meta's versioned Marketing API.

Writes: Five typed writes create campaigns paused, change campaign/ad-set/ad delivery, or update an existing daily budget. Each write uses Gentkey's dry-run plan/commit boundary; budget deltas are calculated in the ad account's currency before Meta receives the request.

Grant	What it governs
`meta-ads.read`	Accounts, campaign structure, creative summaries, insights, and targeting search — on by default
`meta-ads.campaigns.write`	Creating paused campaigns and pausing or activating campaigns
`meta-ads.adsets.write`	Pausing or activating ad sets
`meta-ads.ads.write`	Pausing or activating ads
`meta-ads.budgets.write`	Campaign and ad-set daily budgets, capped per call in the account's currency

CONSTRAINTS

Bounds the gate enforces with arithmetic.

GRANTEDmeta-ads.budgets.write · max budget delta/call = 50 account-currency units

On a USD account, raising a daily budget from $100 to $130 is allowed; raising it to $500 is denied before Meta receives the request. The same arithmetic uses the actual account currency for non-USD accounts.

SETUP

Connect once, use everywhere.

Sign in at gentkey.com, add Meta Ads (oauth), then point each client at your endpoint. Every client completes a standard OAuth flow and lands in your Gentkey — your connections, nobody else’s.

claude.ai (web & mobile)

Settings → Connectors
Add custom connector
Paste https://app.gentkey.com/mcp and finish the OAuth prompt

Claude Code

claude mcp add --transport http \
  gentkey https://app.gentkey.com/mcp

Cursor

// .cursor/mcp.json
{
  "mcpServers": {
    "gentkey": { "url": "https://app.gentkey.com/mcp" }
  }
}

IN PRACTICE

Things agents do with Meta Ads here.

Which campaigns lost the most ROAS over the last seven days?
Find interest-targeting options related to trail running.
Create a paused campaign for the fall launch with an $80 daily budget.
Pause the three ad sets with the highest cost per result.
Raise this campaign's daily budget from $50 to $65.

SECURITY

Custody, gating, and audit — built in.

aes-256-gcm

The model never sees a credential

Your Meta Ads token is encrypted at rest and injected server-side at call time. Your stored credential never enters a context window.

grants

Writes need a grant

Anything that changes state needs a capability you granted explicitly — revoke it and the next call is denied.

audit_log

A trail you can act on

Every decision is attributed to the agent that made it — allowed, denied, or denied by constraint.

FAQ

Fair questions.

Does Gentkey proxy another Meta Ads MCP service?

No. This connector is implemented in Gentkey and calls Meta's versioned Marketing API directly. OAuth tokens stay encrypted server-side, and every Graph API call carries Meta's appsecret_proof protection.

Can a reporting agent activate campaigns?

Not without meta-ads.campaigns.write. Reporting and targeting discovery work independently, while campaign creation and delivery changes need an explicit grant that can be revoked immediately.

What does the Meta app need?

The deployment configures its own Meta app and requests ads_read and ads_management. Moving beyond app-role test users requires Meta App Review and any business verification Meta requires for those permissions.

What happens when an agent calls a Meta Ads write tool it hasn't been granted?

The call is denied at the gateway — nothing reaches Meta Ads — and the denial is recorded in the audit log along with the grant that would have authorized it, so you can decide deliberately instead of finding out later.

Where are my credentials stored?

Encrypted at rest (AES-256-GCM) on Gentkey's server and injected server-side at call time. No credential you store with Gentkey ever enters a model's context window or an agent's config file.

Can I use this from claude.ai's free plan?

Yes — and it's the strongest case for a gateway: free claude.ai accounts currently get a single custom connector, so pointing that one slot at Gentkey puts every connector you've linked behind it.

How do I revoke an agent's access?

Revoke the grant (the next write is denied) or revoke the agent's tokens entirely in one click. Other agents and their grants are untouched — no shared key to rotate.

Is Gentkey affiliated with Meta Ads?

No. Gentkey is an independent MCP gateway. Trademarks belong to their owners; where an official Meta Ads MCP server exists, Gentkey proxies it and adds custody, gating, and audit on top.

Cut Meta Ads a smaller key.

Create your Gentkey Sign in