mcp-google-ads 1.0.13 → 1.0.15

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 drak-marketing
+Copyright (c) 2026 drak-marketing
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -54,6 +54,8 @@ npm install
 npm run build
 ```
 
+**Security:** Never share your `.mcp.json` file or commit it to git -- it may contain API credentials. Add `.mcp.json` to your `.gitignore`.
+
 ### 3. Configure
 
 ```bash

package/dist/build-info.json

@@ -1 +1 @@
-{"sha":"00a842b","builtAt":"2026-04-09T22:23:35.553Z"}
+{"sha":"d46fcf9","builtAt":"2026-04-09T23:11:30.041Z"}

package/dist/index.js

@@ -1240,9 +1240,25 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             }
             case "google_ads_create_campaign": {
                 const customerId = args?.customer_id || "";
+                const daily_budget = args?.daily_budget;
+                // Budget validation: reject $0 and negative budgets
+                if (daily_budget !== undefined && daily_budget <= 0) {
+                    return {
+                        content: [{
+                                type: "text",
+                                text: JSON.stringify({ error: "daily_budget must be positive (in dollars, e.g., 10 = $10/day)" }, null, 2),
+                            }],
+                    };
+                }
+                // Campaign name sanitization: strip HTML tags
+                const rawName = args?.name;
+                const sanitizedName = rawName.replace(/<[^>]*>/g, "");
+                if (sanitizedName !== rawName) {
+                    console.error(`[warning] Stripped HTML from campaign name: "${rawName}" -> "${sanitizedName}"`);
+                }
                 const result = await adsManager.createCampaign(customerId, {
-                    name: args?.name,
-                    budget_amount_micros: args?.daily_budget * 1000000,
+                    name: sanitizedName,
+                    budget_amount_micros: Math.round(daily_budget * 1000000),
                 });
                 return {
                     content: [{
@@ -1260,7 +1276,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 const result = await adsManager.createAdGroup(customerId, {
                     name: args?.name,
                     campaign_id: args?.campaign_id,
-                    cpc_bid_micros: args?.cpc_bid ? args.cpc_bid * 1000000 : undefined,
+                    cpc_bid_micros: args?.cpc_bid ? Math.round(args.cpc_bid * 1000000) : undefined,
                 });
                 return {
                     content: [{
@@ -1337,14 +1353,26 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             }
             case "google_ads_enable_items": {
                 const customerId = args?.customer_id || "";
+                // Validate at least one ID array is provided and non-empty
+                const hasCampaignIds = args?.campaign_ids && args.campaign_ids.length > 0;
+                const hasAdGroupIds = args?.ad_group_ids && args.ad_group_ids.length > 0;
+                const hasAdIds = args?.ad_ids && args.ad_ids.length > 0;
+                if (!hasCampaignIds && !hasAdGroupIds && !hasAdIds) {
+                    return {
+                        content: [{
+                                type: "text",
+                                text: JSON.stringify({ error: "No item IDs provided. Specify at least one campaign, ad group, or ad ID." }, null, 2),
+                            }],
+                    };
+                }
                 const results = {};
-                if (args?.campaign_ids) {
+                if (hasCampaignIds) {
                     results.campaigns = await adsManager.enableCampaigns(customerId, args.campaign_ids);
                 }
-                if (args?.ad_group_ids) {
+                if (hasAdGroupIds) {
                     results.adGroups = await adsManager.enableAdGroups(customerId, args.ad_group_ids);
                 }
-                if (args?.ad_ids) {
+                if (hasAdIds) {
                     results.ads = await adsManager.enableAds(customerId, args.ad_ids);
                 }
                 return {
@@ -1360,14 +1388,26 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             }
             case "google_ads_pause_items": {
                 const customerId = args?.customer_id || "";
+                // Validate at least one ID array is provided and non-empty -- nothing to pause otherwise
+                const hasCampaignIds = args?.campaign_ids && args.campaign_ids.length > 0;
+                const hasAdGroupIds = args?.ad_group_ids && args.ad_group_ids.length > 0;
+                const hasAdIds = args?.ad_ids && args.ad_ids.length > 0;
+                if (!hasCampaignIds && !hasAdGroupIds && !hasAdIds) {
+                    return {
+                        content: [{
+                                type: "text",
+                                text: JSON.stringify({ error: "No item IDs provided. Specify at least one campaign, ad group, or keyword ID." }, null, 2),
+                            }],
+                    };
+                }
                 const results = {};
-                if (args?.campaign_ids) {
+                if (hasCampaignIds) {
                     results.campaigns = await adsManager.pauseCampaigns(customerId, args.campaign_ids);
                 }
-                if (args?.ad_group_ids) {
+                if (hasAdGroupIds) {
                     results.adGroups = await adsManager.pauseAdGroups(customerId, args.ad_group_ids);
                 }
-                if (args?.ad_ids) {
+                if (hasAdIds) {
                     results.ads = await adsManager.pauseAds(customerId, args.ad_ids);
                 }
                 return {
@@ -1555,6 +1595,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             // REPORTING HANDLERS
             // ============================================
             case "google_ads_keyword_performance": {
+                // Future date validation
+                const today_kp = new Date().toISOString().slice(0, 10);
+                if (args?.start_date && args.start_date > today_kp) {
+                    return { content: [{ type: "text", text: JSON.stringify({ error: `start_date "${args.start_date}" is in the future. Reports only cover historical data.` }, null, 2) }] };
+                }
                 const customerId = args?.customer_id || "";
                 const result = await adsManager.getKeywordPerformance(customerId, {
                     startDate: args?.start_date,
@@ -1571,6 +1616,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 };
             }
             case "google_ads_keyword_performance_by_conversion": {
+                const today_kpbc = new Date().toISOString().slice(0, 10);
+                if (args?.start_date && args.start_date > today_kpbc) {
+                    return { content: [{ type: "text", text: JSON.stringify({ error: `start_date "${args.start_date}" is in the future. Reports only cover historical data.` }, null, 2) }] };
+                }
                 const customerId = args?.customer_id || "";
                 const result = await adsManager.getKeywordPerformanceWithConversions(customerId, {
                     startDate: args?.start_date,
@@ -1587,6 +1636,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 };
             }
             case "google_ads_search_term_report": {
+                const today_str = new Date().toISOString().slice(0, 10);
+                if (args?.start_date && args.start_date > today_str) {
+                    return { content: [{ type: "text", text: JSON.stringify({ error: `start_date "${args.start_date}" is in the future. Reports only cover historical data.` }, null, 2) }] };
+                }
                 const customerId = args?.customer_id || "";
                 const result = await adsManager.getSearchTermReport(customerId, {
                     startDate: args?.start_date,
@@ -1604,6 +1657,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 };
             }
             case "google_ads_search_term_report_by_conversion": {
+                const today_strbc = new Date().toISOString().slice(0, 10);
+                if (args?.start_date && args.start_date > today_strbc) {
+                    return { content: [{ type: "text", text: JSON.stringify({ error: `start_date "${args.start_date}" is in the future. Reports only cover historical data.` }, null, 2) }] };
+                }
                 const customerId = args?.customer_id || "";
                 const result = await adsManager.getSearchTermReportWithConversions(customerId, {
                     startDate: args?.start_date,
@@ -1621,6 +1678,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 };
             }
             case "google_ads_ad_performance": {
+                const today_ap = new Date().toISOString().slice(0, 10);
+                if (args?.start_date && args.start_date > today_ap) {
+                    return { content: [{ type: "text", text: JSON.stringify({ error: `start_date "${args.start_date}" is in the future. Reports only cover historical data.` }, null, 2) }] };
+                }
                 const customerId = args?.customer_id || "";
                 const result = await adsManager.getAdPerformance(customerId, {
                     startDate: args?.start_date,
@@ -1636,6 +1697,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 };
             }
             case "google_ads_ad_performance_by_conversion": {
+                const today_apbc = new Date().toISOString().slice(0, 10);
+                if (args?.start_date && args.start_date > today_apbc) {
+                    return { content: [{ type: "text", text: JSON.stringify({ error: `start_date "${args.start_date}" is in the future. Reports only cover historical data.` }, null, 2) }] };
+                }
                 const customerId = args?.customer_id || "";
                 const result = await adsManager.getAdPerformanceWithConversions(customerId, {
                     startDate: args?.start_date,
@@ -1696,6 +1761,15 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 const campaignId = args?.campaign_id;
                 const dailyBudget = args?.daily_budget;
                 const createNew = args?.create_new_budget || false;
+                // Budget validation: reject $0 and negative budgets
+                if (dailyBudget <= 0) {
+                    return {
+                        content: [{
+                                type: "text",
+                                text: JSON.stringify({ error: "Budget must be positive (in dollars, e.g., 10 = $10/day)" }, null, 2),
+                            }],
+                    };
+                }
                 const result = await adsManager.updateCampaignBudget(customerId, campaignId, dailyBudget, createNew);
                 return {
                     content: [{
@@ -1710,6 +1784,16 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             case "google_ads_gaql_query": {
                 const customerId = args?.customer_id || "";
                 const query = args?.query;
+                // Block mutation statements -- GAQL query tool is read-only
+                const upperQuery = query.toUpperCase().trim();
+                if (upperQuery.startsWith("INSERT") || upperQuery.startsWith("UPDATE") || upperQuery.startsWith("DELETE") || upperQuery.startsWith("CREATE") || upperQuery.startsWith("DROP")) {
+                    return {
+                        content: [{
+                                type: "text",
+                                text: JSON.stringify({ error: "GAQL query tool is read-only. Mutation statements (INSERT, UPDATE, DELETE) are not allowed. Use the dedicated create/update tools instead." }, null, 2),
+                            }],
+                    };
+                }
                 const result = await adsManager.executeGaql(customerId, query);
                 return {
                     content: [{
@@ -1721,6 +1805,15 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             case "google_ads_keyword_volume": {
                 const customerId = args?.customer_id || "";
                 const keywords = args?.keywords;
+                // Enforce max 20 keywords per request
+                if (keywords.length > 20) {
+                    return {
+                        content: [{
+                                type: "text",
+                                text: JSON.stringify({ error: `Too many keywords (${keywords.length}). Maximum is 20 per request. Split into multiple calls.` }, null, 2),
+                            }],
+                    };
+                }
                 const geoTargetConstants = args?.geo_target_constants;
                 const language = args?.language;
                 const result = await adsManager.keywordVolume(customerId, keywords, geoTargetConstants, language);
@@ -1759,11 +1852,13 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         else {
             response.details = rawError.errors || rawError.stack;
         }
+        // Size-limit error responses through safeResponse to prevent oversized payloads
+        const safeErrorResponse = safeResponse(response, "error");
         return {
             isError: true,
             content: [{
                     type: "text",
-                    text: JSON.stringify(response, null, 2),
+                    text: JSON.stringify(safeErrorResponse, null, 2),
                 }],
         };
     }

package/dist/resilience.js

@@ -31,6 +31,10 @@ export function safeResponse(data, context) {
         const sizeBytes = Buffer.byteLength(jsonStr, "utf-8");
         if (sizeBytes <= MAX_RESPONSE_SIZE)
             return current;
+        // Deep clone on first truncation pass to avoid mutating the original object
+        if (pass === 0 && typeof current === "object" && current !== null) {
+            current = JSON.parse(JSON.stringify(current));
+        }
         logger.warn({ sizeBytes, maxSize: MAX_RESPONSE_SIZE, context, pass }, "Response exceeds size limit, truncating");
         if (Array.isArray(current)) {
             current = current.slice(0, Math.max(1, Math.floor(current.length * 0.5)));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mcp-google-ads",
   "mcpName": "io.github.mharnett/google-ads",
-  "version": "1.0.13",
+  "version": "1.0.15",
   "description": "MCP server for Google Ads API with MCC support, 34 tools for campaign management, reporting, and optimization. Safe by default -- all changes created PAUSED.",
   "main": "dist/index.js",
   "bin": {