@getmcpads/meta-ads-mcp-server 1.0.2 → 2.0.0

package/CHANGELOG.md

@@ -0,0 +1,20 @@
+# Changelog
+## 2.0.0 - 2026-09-20
+
+- Use account-scoped creative reads compatible with Graph v26, including bounded historical fallback and ownership verification.
+- Add exact entity configuration and uploaded-video readiness reads.
+- Update campaign creation, budget ownership, schedule validation and post-write verification.
+- Require Node.js 22.12 or newer and check Node 22/24 in CI.
+- Update vulnerable dependencies and regenerate the MCP catalog.
+- No hosted creative UI or MCP Apps integrations.
+
+
+## 1.1.0
+
+- Synchronize applicable platform features with GetMCPAds commit b1471be while retaining local read-only exploration tools and credential configuration.
+- Expose 39 read tools and 23 explicitly enabled write tools.
+- Add MCP annotations, parameter descriptions, structured results, server identity and an offline-generated discovery card.
+- Preserve preview/confirmation boundaries; test provider request construction and errors with mocked APIs.
+- Refuse credential-bearing redirects and document provider-specific limitations.
+
+No live advertiser mutation is performed by the release tests.

package/README.md

@@ -1,34 +1,67 @@
-# meta-ads-mcp-server
+<div align="center">
 
+# Meta Ads MCP server
+
+### Ask better questions about your Meta campaigns.
+
+Compare campaign performance, inspect delivery and prepare changes from your MCP client.
+
+[![Release](https://img.shields.io/github/v/release/getmcpads-com/meta-ads-mcp-server?color=2448e5)](https://github.com/getmcpads-com/meta-ads-mcp-server/releases/latest)
 [![CI](https://github.com/getmcpads-com/meta-ads-mcp-server/actions/workflows/ci.yml/badge.svg)](https://github.com/getmcpads-com/meta-ads-mcp-server/actions/workflows/ci.yml)
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)
-[![Node](https://img.shields.io/badge/node-%E2%89%A518-brightgreen.svg)](package.json)
+[![Node](https://img.shields.io/badge/node-%E2%89%A522.12-brightgreen.svg)](package.json)
+
+[Watch the demo](https://www.getmcpads.com/home/film/get-mcp-ads-film-1080p.mp4) · [What's new](#whats-new) · [Install](#install-this-release) · [Tool reference](#tools) · [Try hosted getmcpads](https://www.getmcpads.com/tools/meta-ads?utm_source=github&utm_medium=readme&utm_campaign=meta-ads)
+
+[![Watch the getmcpads product demo: campaign review in Claude](https://www.getmcpads.com/home/film/poster-rich.webp)](https://www.getmcpads.com/home/film/get-mcp-ads-film-1080p.mp4)
+
+**[Play the 27-second product film](https://www.getmcpads.com/home/film/get-mcp-ads-film-1080p.mp4)**
+
+</div>
+
+The film demonstrates hosted getmcpads with staged data. Its creative galleries and MCP Apps interface belong to the hosted product. This repository provides the standalone native API tools.
+
+**41 read tools** · **23 write tools**, disabled by default.
+
+Run locally with your own platform credentials and a client that supports stdio MCP, such as Claude Desktop, Claude Code or Cursor. Your requests go directly to the platform. For managed connections, including supported ChatGPT setups, use the hosted option.
+
+## What's new
+
+**[v2.0.0: Native tools and security update](https://github.com/getmcpads-com/meta-ads-mcp-server/releases/tag/v2.0.0) · September 20, 2026**
 
-An open-source [Model Context Protocol](https://modelcontextprotocol.io) server for the
-**Facebook (Meta) Ads Marketing API**. It lets Claude, ChatGPT, Cursor or any MCP client
-read and analyse your advertising data, and change it if you choose to.
+- Use account-scoped creative reads compatible with Graph v26, including bounded historical fallback and ownership verification.
+- Add exact entity configuration and uploaded-video readiness reads.
+- Update campaign creation, budget ownership, schedule validation and post-write verification.
+- Require Node.js 22.12 or newer and check Node 22/24 in CI.
+- Update vulnerable dependencies and regenerate the MCP catalog.
 
-You run it. Your token stays on your machine. Nothing is proxied through a third party.
+[Full changelog](CHANGELOG.md) · [Source synchronization details](SOURCE_SYNC.md) · [All releases](https://github.com/getmcpads-com/meta-ads-mcp-server/releases)
+
+### Upgrade notes
+
+Requires **Node.js 22.12 or newer**. CI covers Node 22 and 24. Version 2.0.0 drops Node 18 and 20 support. Read the current tool schemas before reusing saved arguments. Writes remain optional and require explicit confirmation. Hosted creative integrations and MCP Apps UI are outside this release.
+
+## Install this release
+
+This is a GitHub source release. npm and MCP Registry versions are published separately. The commands below select this exact version; unpinned `npx` examples later in this document select the version currently available on npm.
 
 ```bash
-npx -y @getmcpads/meta-ads-mcp-server
+git clone --branch v2.0.0 --depth 1 https://github.com/getmcpads-com/meta-ads-mcp-server.git
+cd meta-ads-mcp-server
+npm ci
+npm run build
 ```
 
-Also listed in the [MCP Registry](https://registry.modelcontextprotocol.io) as **`com.getmcpads/meta-ads`**, so clients that read the registry can install it by name.
-
-> **Prefer not to run it yourself?** [getmcpads.com](https://www.getmcpads.com) is the hosted
-> version of this server, with Meta Ads alongside Google Ads, TikTok Ads, Pinterest Ads, GA4 and
-> Search Console behind a single endpoint, hosted OAuth, and cross-platform reporting.
-> Same tools, same safety model, no setup.
+Configure your MCP client to run `node` with the absolute path to `dist/cli.js` and the platform credentials documented below.
 
----
+> **Prefer a managed connection?** [Use Meta Ads with hosted getmcpads](https://www.getmcpads.com/tools/meta-ads?utm_source=github&utm_medium=readme&utm_campaign=meta-ads). Connect your account, select the data your assistant may access and use the hosted MCP connection. See the site for current features and plans.
 
 ## What you get
 
 | | |
 |---|---|
-| **34 read tools** | Campaigns, ad sets, ads, creatives, audiences, pixels, catalogs, Pages, Instagram, activity logs, A/B tests and lift studies |
-| **10 write tools** | Off by default. Status, budgets, schedules, renames, campaign creation. Each one **previews before it applies** |
+| **41 read tools** | Campaigns, ad sets, ads, creatives, audiences, pixels, catalogs, Pages, Instagram, activity logs, A/B tests and lift studies |
+| **23 write tools** | Off by default. Status, budgets, schedules, renames, campaign creation. Each one **previews before it applies** |
 | **190 metrics** | Including derived ones computed client-side (ROAS, CPA, frequency, hook rate, attribution-window views) |
 | **56 breakdowns · 90 dimensions** | With a compatibility matrix that catches invalid combinations *before* they hit the API |
 | **7 resources** | Live catalogues the model can read: metrics, breakdowns, compatibility rules, 11 workflow recipes |
@@ -46,32 +79,6 @@ one that returns your numbers.
 
 ---
 
-## How this compares to Meta's own MCP server
-
-Meta ships an official MCP server, hosted at `mcp.facebook.com/ads`. It is a good product.
-Here is an honest comparison, because the right choice depends on what you need.
-
-| | Meta's official server | This server | [getmcpads.com](https://www.getmcpads.com) |
-|---|---|---|---|
-| Hosting | Meta-hosted, remote | **You host it.** stdio, local process | Hosted for you |
-| Data path | Through Meta's endpoint | **Direct to the Graph API.** No intermediary | Through our gateway |
-| Auth | Meta Business OAuth, 2 clicks | You bring a token, which is more setup (see below) | Hosted OAuth |
-| Tools | 29 | **44** (34 read + 10 write) | 44, plus 5 other platforms |
-| Writes | Applied directly | **Preview first**, applied only on `confirm: true` | Preview first |
-| Metric compatibility | None | **Query planner splits incompatible requests** | Same planner |
-| Auditable | No | **Yes.** Apache-2.0, read every line | This server, audited |
-| Modifiable | No | **Fork it** | No |
-| Help Center search | ✅ | ❌ | ❌ |
-| Catalog creation | ✅ | ❌ (catalog *reads* are supported) | ❌ |
-
-**Choose Meta's** if you want the fastest possible setup and don't need to see the code.
-**Choose this one** if you need your data to stay on your infrastructure, want to audit or
-extend what the model can do, or want writes that can't fire on the first call.
-**Choose [getmcpads.com](https://www.getmcpads.com)** if you want this server's capabilities
-without running it, or you need more than one ad platform in the same conversation.
-
----
-
 ## Getting a token
 
 This is the one step that takes real effort, and it's worth doing properly.
@@ -171,7 +178,7 @@ npm start
 | Variable | Default | Meaning |
 |---|---|---|
 | `META_ACCESS_TOKEN` | none | **Required.** Your Meta access token |
-| `META_ENABLE_WRITES` | *unset* | Set to `1` to register the 10 write tools |
+| `META_ENABLE_WRITES` | *unset* | Set to `1` to register the 23 write tools |
 | `META_API_VERSION` | `v26.0` | Graph API version. Override to pin another |
 | `LOG_LEVEL` | `info` | `debug`, `info`, `warn`, `error` |
 
@@ -227,73 +234,87 @@ Two further guardrails:
 
 ## Tools
 
-<details>
-<summary><b>34 read tools</b></summary>
-
-### Discovery and health
-| Tool | Purpose |
-|---|---|
-| `meta_health_check` | Validates the token, lists accessible accounts, reports missing scopes |
-| `meta_debug_token` | Token validity, expiry and granted scopes |
-| `meta_list_ad_accounts` | Every ad account the token can reach |
-| `meta_get_account_details` | Currency, timezone, spend cap, status, business info |
-| `meta_get_business_assets` | Businesses, Pages, Instagram accounts, pixels, datasets |
+Every tool is listed below. See [server-card.json](server-card.json) for complete parameter and output schemas.
 
-### Structure
-| Tool | Purpose |
-|---|---|
-| `meta_get_campaigns` / `meta_get_adsets` / `meta_get_ads` | List entities, filterable by parent |
-| `meta_get_campaign_structure` | Full hierarchy: campaigns → ad sets → ads |
-| `meta_search_entities` | Search by name within an account |
-| `meta_get_ad_activity` | Activity log: who changed what, and when |
+<details>
+<summary><b>41 read tools</b></summary>
 
-### Performance
 | Tool | Purpose |
-|---|---|
-| `meta_get_insights` | The main reporting tool. Metrics, breakdowns, attribution windows |
-| `meta_validate_query` | Check a metric/breakdown combination *before* running it |
-| `meta_get_insights_raw` | Native Insights fields, no aliasing |
-| `meta_get_delivery_diagnostics` | Why delivery is limited: statuses and issues |
+| --- | --- |
+| `meta_health_check` | Agent-ready read-only health check: validates token metadata, lists accessible ad accounts, and warns about missing read scopes without exposing the access token. |
+| `meta_get_business_assets` | Discover accessible Meta Business assets read-only: businesses, pages, Instagram accounts, pixels, and datasets when permissions allow. |
+| `meta_get_pages` | List accessible Facebook Pages with id, name, category, tasks, picture, and linked Instagram account references when available. |
+| `meta_get_instagram_accounts` | List Instagram accounts linked to accessible Pages, Business Manager assets, or an ad account when permissions allow. |
+| `meta_get_pixels` | List pixels and datasets from an ad account or Business Manager when accessible, returning actionable warnings for permission-limited edges. |
+| `meta_get_ad_activity` | Read ad account activity logs from /{ad_account_id}/activities with object, event, actor, timestamp, and extra_data fields. |
+| `meta_get_delivery_diagnostics` | Aggregate read-only delivery diagnostics across campaigns, ad sets, and ads using status/effective_status/issues_info where available plus simple delivery insights. |
+| `meta_get_creative_assets` | Return ad-linked creative media with actual ad names, collection covers, all carousel/flexible components, resolved image hashes and video URLs. |
+| `meta_get_audience_details` | Read detailed custom, saved, and lookalike audiences with pagination and rich fields where permissions allow. |
+| `meta_get_catalog_products` | Read Product Catalogs and Product Items when catalog access is available. |
+| `meta_join_product_insights` | Query product-breakdown insights and enrich rows with Product Catalog metadata when catalog access is available. |
+| `meta_get_brand_safety_controls` | Read brand safety, suitability, placement, and context-control signals from ad account/ad set targeting and optional block-list edges. |
+| `meta_interpret_experiment_results` | Read and interpret A/B test or conversion lift study results with confidence guardrails, cells, objectives, and optional cell entities. |
+| `meta_get_organic_content_enrichment` | Read Facebook Page posts and Instagram media with URLs, native periods and optional insights. |
+| `meta_list_ad_accounts` | List all Meta ad accounts accessible with the current token. |
+| `meta_get_account_details` | Get detailed information for a specific Meta ad account: name, currency, timezone, spend cap, status, business info. |
+| `meta_get_campaigns` | List campaigns for a Meta ad account. |
+| `meta_get_adsets` | List ad sets for a Meta ad account, optionally filtered by campaign. |
+| `meta_get_ads` | List ads for a Meta ad account, optionally filtered by ad set. |
+| `meta_get_insights` | Query Meta Ads performance insights. |
+| `meta_get_campaign_structure` | Get hierarchical campaign structure: campaigns -> ad sets -> ads. |
+| `meta_get_creatives` | Get ad creative content: text, images, videos, links, call-to-action. |
+| `meta_get_audiences` | List custom, saved, and lookalike audiences for a Meta ad account. |
+| `meta_get_ad_studies` | List conversion lift studies and A/B tests (Ad Studies) for an ad account. |
+| `meta_get_study_results` | Get detailed results for a conversion lift or A/B test study. |
+| `meta_validate_query` | Validate a metric/breakdown combination BEFORE executing. |
+| `meta_get_page_posts` | Read published Facebook Page posts using a Page token resolved from the connected user. |
+| `meta_debug_token` | Check the current access token validity, expiration, and granted scopes. |
+| `meta_search_entities` | Search campaigns, ad sets, or ads by name within an ad account. |
+| `meta_get_node_fields` | Read arbitrary flat fields from one Meta Graph node. |
+| `meta_list_edge_raw` | List an allowlisted read-only Meta Graph edge with caller-selected flat fields, filters, and cursor pagination. |
+| `meta_get_insights_raw` | Query the Meta Insights edge with validated native field names, breakdowns, action breakdowns, attribution windows, filters, sort, summary, and pagination. |
+| `meta_search_targeting_options` | Search Meta's read-only targeting metadata for interests, validated interests, geographies, locales, countries, cities, regions, markets, or postal codes. |
+| `meta_get_ad_preview` | Get the read-only preview markup for an existing Meta ad in a requested placement format. |
+| `meta_list_ad_images` | List the ad account image library (/adimages): hash, name, dimensions, status, a permanent publicly served display URL (permalink_url), short-lived CDN URLs, and optionally the creatives using each image. |
+| `meta_list_ad_videos` | List the ad account video library (/advideos): title, duration, processing status, and publicly served thumbnails (preferred and largest sizes). |
+| `meta_get_video_sources` | Resolve fresh download URLs (source) and thumbnails for specific ad videos. |
+| `meta_get_entity_configuration` | Read a specific entity in its ad account for reconciliation. |
+| `meta_get_uploaded_video` | Check video processing and membership in the selected account library. |
+| `meta_get_adset_configuration` | Read an existing ad set, its parent campaign budget/objective and account currency before preparing an edit. |
+| `meta_get_catalog_batch_status` | Read the completion and per-item errors for a catalog batch handle. |
 
-### Creatives
-| Tool | Purpose |
-|---|---|
-| `meta_get_creatives` | Text, images, videos, links, CTAs |
-| `meta_get_creative_assets` | Normalised asset metadata, media URLs, asset feeds |
-| `meta_get_ad_preview` | Rendered preview markup for a placement |
+</details>
 
-### Audiences and targeting
-| Tool | Purpose |
-|---|---|
-| `meta_get_audiences` / `meta_get_audience_details` | Custom, saved and lookalike audiences |
-| `meta_search_targeting_options` | Interests, geographies, locales, cities, postal codes |
-| `meta_get_brand_safety_controls` | Suitability, placement and context controls |
+<details>
+<summary><b>23 write tools</b></summary>
 
-### Commerce and organic
-| Tool | Purpose |
-|---|---|
-| `meta_get_catalog_products` | Product catalogs and items |
-| `meta_join_product_insights` | Product-breakdown insights enriched with catalog metadata |
-| `meta_get_pixels` | Pixels and datasets |
-| `meta_get_pages` / `meta_get_page_posts` | Pages and their recent posts |
-| `meta_get_instagram_accounts` | Linked Instagram accounts |
-| `meta_get_organic_content_enrichment` | Media URLs, permalinks, counts for organic content |
-
-### Experiments
-| Tool | Purpose |
-|---|---|
-| `meta_get_ad_studies` | Conversion lift studies and A/B tests |
-| `meta_get_study_results` | Detailed study results |
-| `meta_interpret_experiment_results` | Results with confidence guardrails |
+Disabled by default. Calls preview unless explicitly confirmed. Check the configuration and exact schema before use.
 
-### Escape hatches
 | Tool | Purpose |
-|---|---|
-| `meta_get_node_fields` | Read flat fields from any Graph node |
-| `meta_list_edge_raw` | List an allowlisted Graph edge with your own field selection |
-
-These last two exist so a new Graph field doesn't require a new release. The edge allowlist
-deliberately **excludes lead records**, which carry personal data.
+| --- | --- |
+| `meta_create_campaign` | Create a PAUSED Meta campaign with either ad set budgets (omit campaign budget), a daily campaign budget, or a lifetime campaign budget. |
+| `meta_update_adset_budget` | Change an ad set daily or lifetime budget after checking its parent budget and existing schedule. |
+| `meta_update_adset_schedule` | Change start and/or end time using ISO 8601 with an explicit offset. |
+| `meta_update_campaign_budget` | Change an existing campaign-owned budget after verifying currency and ownership. |
+| `meta_create_adset` | Create a PAUSED Meta ad set with explicit targeting, optimization, placements, attribution, bidding and schedule. |
+| `meta_update_adset_configuration` | Update targeting, optimization, placements, attribution, bidding, budget or schedule. |
+| `meta_duplicate_adset` | Duplicate a known-good ad set within the selected account, preserving complex native configuration. |
+| `meta_create_adcreative` | Create an ad creative from an existing post or an explicit object_story_spec and optional asset_feed_spec. |
+| `meta_create_ad` | Create a PAUSED ad using an existing ad set and creative from the selected account. |
+| `meta_update_ad_creative` | Replace an ad’s creative with another existing creative from the same account. |
+| `meta_upload_ad_image` | Upload an image into the selected ad account using base64 bytes (up to 5 MiB decoded). |
+| `meta_upload_ad_video` | Import a video from a publicly reachable HTTPS URL or base64 MP4 bytes (up to 5 MiB decoded). |
+| `meta_create_custom_audience` | Create a website, engagement, customer-list container or lookalike audience. |
+| `meta_update_custom_audience` | Update an existing custom audience name, description, retention or complete rule. |
+| `meta_create_product_set` | Create a filtered product set in a catalog owned by the same Business as the selected ad account. |
+| `meta_update_product_set` | Replace a product set filter or rename it. |
+| `meta_batch_catalog_items` | Create or update up to 50 catalog products by retailer_id. |
+| `meta_update_campaign_status` | Pause or reactivate a Meta campaign. |
+| `meta_update_adset_status` | Pause or reactivate a Meta ad set. |
+| `meta_update_ad_status` | Pause or reactivate a Meta ad. |
+| `meta_rename_campaign` | Rename a Meta campaign. |
+| `meta_rename_adset` | Rename a Meta ad set. |
+| `meta_rename_ad` | Rename a Meta ad. |
 
 </details>
 
@@ -335,14 +356,20 @@ Full policy and reporting instructions: [SECURITY.md](SECURITY.md).
 
 ## Looking for a managed, multi-platform version?
 
-This server does one platform, on your machine, with your token. That is on purpose.
+[Try hosted Meta Ads](https://www.getmcpads.com/tools/meta-ads?utm_source=github&utm_medium=readme&utm_campaign=meta_ads_hosted) if you want to use this source without operating a local server.
+getmcpads also connects advertising, Search Console and GA4 through one MCP URL.
+Source availability and plan limits are listed on the site; connecting an account is still required.
 
-If you'd rather not run it yourself, or you need Facebook Ads **alongside Google Ads,
-TikTok Ads, Pinterest Ads, GA4 and Search Console** behind one endpoint, with hosted OAuth
-and cross-platform reporting, that's what we build at **[getmcpads.com](https://www.getmcpads.com)**.
+1. Follow the [Meta Ads connection guide](https://www.getmcpads.com/guides/sources/meta-ads).
+2. Select the account or property your assistant may read.
+3. Connect [Claude](https://www.getmcpads.com/guides/setup/claude),
+   [ChatGPT](https://www.getmcpads.com/guides/setup/chatgpt) or
+   [Codex](https://www.getmcpads.com/guides/setup/codex).
+4. Try a read-only review: “Compare campaign results and investigate frequency alongside CTR. State missing data and do not change anything.”
 
-Same philosophy, less plumbing. This project stays open source and independently useful
-either way.
+See the [current hosted tool catalogue](https://www.getmcpads.com/tools/meta-ads)
+and [pricing](https://www.getmcpads.com/pricing) before choosing a paid plan.
+This Apache 2.0 adapter remains independently useful with your own credentials.
 
 ---
 
@@ -358,3 +385,15 @@ Please read [SECURITY.md](SECURITY.md) before reporting anything security-relate
 Facebook, Meta, Instagram and the Meta Marketing API are trademarks of Meta Platforms, Inc.
 **This project is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc.**
 It is an independent client of a public API.
+
+## MCP contracts and desktop bundle
+
+Every tool declares read/write annotations, parameter descriptions and a structured output schema. Successful calls expose the payload as `structuredContent.result`; errors retain `isError: true`. The generated [server card](server-card.json) contains definitions only.
+
+Run `npm run bundle -- /path/to/output` to build a `.mcpb` desktop bundle from the current catalog. Credentials are entered locally during installation. Write tools remain disabled unless explicitly enabled.
+
+## More from getmcpads
+
+[Google Ads](https://github.com/getmcpads-com/google-ads-mcp-server) · [Google Analytics 4](https://github.com/getmcpads-com/google-analytics-mcp-server) · [Google Search Console](https://github.com/getmcpads-com/google-search-console-mcp-server) · [TikTok Ads](https://github.com/getmcpads-com/tiktok-ads-mcp-server) · [Pinterest Ads](https://github.com/getmcpads-com/pinterest-ads-mcp-server) · [X Ads](https://github.com/getmcpads-com/x-ads-mcp-server)
+
+Maintained by **Emmanuel** at [getmcpads](https://www.getmcpads.com). Questions: [hello@getmcpads.com](mailto:hello@getmcpads.com).