mcp-google-ads 1.0.14 → 1.0.16

package/dist/build-info.json

@@ -1 +1 @@
-{"sha":"1c7a8b2","builtAt":"2026-04-09T23:02:14.294Z"}
+{"sha":"9b25077","builtAt":"2026-04-09T23:18:47.469Z"}

package/dist/index.js

@@ -22,7 +22,13 @@ catch {
 }
 // Version safety: warn if running a deprecated or dangerously old version
 const __minimumSafeVersion = "1.0.5"; // minimum version with GAQL sanitization
-if (__cliPkg.version < __minimumSafeVersion) {
+const __semverLt = (a, b) => { const pa = a.split(".").map(Number), pb = b.split(".").map(Number); for (let i = 0; i < 3; i++) {
+    if ((pa[i] || 0) < (pb[i] || 0))
+        return true;
+    if ((pa[i] || 0) > (pb[i] || 0))
+        return false;
+} return false; };
+if (__semverLt(__cliPkg.version, __minimumSafeVersion)) {
     console.error(`[WARNING] Running deprecated version ${__cliPkg.version}. Minimum safe version is ${__minimumSafeVersion}. Please upgrade.`);
 }
 // CLI flags
@@ -733,13 +739,13 @@ class GoogleAdsManager {
         AND ad_group_criterion.status != 'REMOVED'
     `;
         if (options.keywordTextContains) {
-            query += ` AND ad_group_criterion.keyword.text LIKE '%${options.keywordTextContains}%'`;
+            query += ` AND ad_group_criterion.keyword.text LIKE '%${escapeGaqlString(options.keywordTextContains)}%'`;
         }
         if (options.campaignIds && options.campaignIds.length > 0) {
             query += ` AND campaign.id IN (${options.campaignIds.map(sanitizeNumericId).join(",")})`;
         }
         if (options.adGroupIds && options.adGroupIds.length > 0) {
-            query += ` AND ad_group.id IN (${options.adGroupIds.join(",")})`;
+            query += ` AND ad_group.id IN (${options.adGroupIds.map(sanitizeNumericId).join(",")})`;
         }
         query += ` ORDER BY metrics.cost_micros DESC`;
         const result = await withResilience(() => customer.query(query), "getKeywordPerformance");
@@ -773,13 +779,13 @@ class GoogleAdsManager {
         AND ad_group_criterion.status != 'REMOVED'
     `;
         if (options.keywordTextContains) {
-            query += ` AND ad_group_criterion.keyword.text LIKE '%${options.keywordTextContains}%'`;
+            query += ` AND ad_group_criterion.keyword.text LIKE '%${escapeGaqlString(options.keywordTextContains)}%'`;
         }
         if (options.campaignIds && options.campaignIds.length > 0) {
             query += ` AND campaign.id IN (${options.campaignIds.map(sanitizeNumericId).join(",")})`;
         }
         if (options.adGroupIds && options.adGroupIds.length > 0) {
-            query += ` AND ad_group.id IN (${options.adGroupIds.join(",")})`;
+            query += ` AND ad_group.id IN (${options.adGroupIds.map(sanitizeNumericId).join(",")})`;
         }
         query += ` ORDER BY ad_group_criterion.keyword.text, segments.conversion_action_name`;
         const result = await withResilience(() => customer.query(query), "getKeywordPerformanceWithConversions");
@@ -811,13 +817,13 @@ class GoogleAdsManager {
       WHERE segments.date BETWEEN '${options.startDate}' AND '${options.endDate}'
     `;
         if (options.searchTermContains) {
-            query += ` AND search_term_view.search_term LIKE '%${options.searchTermContains}%'`;
+            query += ` AND search_term_view.search_term LIKE '%${escapeGaqlString(options.searchTermContains)}%'`;
         }
         if (options.campaignIds && options.campaignIds.length > 0) {
             query += ` AND campaign.id IN (${options.campaignIds.map(sanitizeNumericId).join(",")})`;
         }
         if (options.adGroupIds && options.adGroupIds.length > 0) {
-            query += ` AND ad_group.id IN (${options.adGroupIds.join(",")})`;
+            query += ` AND ad_group.id IN (${options.adGroupIds.map(sanitizeNumericId).join(",")})`;
         }
         query += ` ORDER BY metrics.impressions DESC`;
         const result = await withResilience(() => customer.query(query), "getSearchTermReport");
@@ -847,13 +853,13 @@ class GoogleAdsManager {
       WHERE segments.date BETWEEN '${options.startDate}' AND '${options.endDate}'
     `;
         if (options.searchTermContains) {
-            query += ` AND search_term_view.search_term LIKE '%${options.searchTermContains}%'`;
+            query += ` AND search_term_view.search_term LIKE '%${escapeGaqlString(options.searchTermContains)}%'`;
         }
         if (options.campaignIds && options.campaignIds.length > 0) {
             query += ` AND campaign.id IN (${options.campaignIds.map(sanitizeNumericId).join(",")})`;
         }
         if (options.adGroupIds && options.adGroupIds.length > 0) {
-            query += ` AND ad_group.id IN (${options.adGroupIds.join(",")})`;
+            query += ` AND ad_group.id IN (${options.adGroupIds.map(sanitizeNumericId).join(",")})`;
         }
         query += ` ORDER BY search_term_view.search_term, segments.conversion_action_name`;
         const result = await withResilience(() => customer.query(query), "getSearchTermReportWithConversions");
@@ -898,7 +904,7 @@ class GoogleAdsManager {
             query += ` AND campaign.id IN (${options.campaignIds.map(sanitizeNumericId).join(",")})`;
         }
         if (options.adGroupIds && options.adGroupIds.length > 0) {
-            query += ` AND ad_group.id IN (${options.adGroupIds.join(",")})`;
+            query += ` AND ad_group.id IN (${options.adGroupIds.map(sanitizeNumericId).join(",")})`;
         }
         query += ` ORDER BY metrics.impressions DESC`;
         const result = await withResilience(() => customer.query(query), "getAdPerformance");
@@ -941,7 +947,7 @@ class GoogleAdsManager {
             query += ` AND campaign.id IN (${options.campaignIds.map(sanitizeNumericId).join(",")})`;
         }
         if (options.adGroupIds && options.adGroupIds.length > 0) {
-            query += ` AND ad_group.id IN (${options.adGroupIds.join(",")})`;
+            query += ` AND ad_group.id IN (${options.adGroupIds.map(sanitizeNumericId).join(",")})`;
         }
         query += ` ORDER BY ad_group_ad.ad.id, segments.conversion_action_name`;
         const result = await withResilience(() => customer.query(query), "getAdPerformanceWithConversions");
@@ -1240,9 +1246,25 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             }
             case "google_ads_create_campaign": {
                 const customerId = args?.customer_id || "";
+                const daily_budget = args?.daily_budget;
+                // Budget validation: reject $0 and negative budgets
+                if (daily_budget !== undefined && daily_budget <= 0) {
+                    return {
+                        content: [{
+                                type: "text",
+                                text: JSON.stringify({ error: "daily_budget must be positive (in dollars, e.g., 10 = $10/day)" }, null, 2),
+                            }],
+                    };
+                }
+                // Campaign name sanitization: strip HTML tags
+                const rawName = args?.name;
+                const sanitizedName = rawName.replace(/<[^>]*>/g, "");
+                if (sanitizedName !== rawName) {
+                    console.error(`[warning] Stripped HTML from campaign name: "${rawName}" -> "${sanitizedName}"`);
+                }
                 const result = await adsManager.createCampaign(customerId, {
-                    name: args?.name,
-                    budget_amount_micros: args?.daily_budget * 1000000,
+                    name: sanitizedName,
+                    budget_amount_micros: Math.round(daily_budget * 1000000),
                 });
                 return {
                     content: [{
@@ -1260,7 +1282,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 const result = await adsManager.createAdGroup(customerId, {
                     name: args?.name,
                     campaign_id: args?.campaign_id,
-                    cpc_bid_micros: args?.cpc_bid ? args.cpc_bid * 1000000 : undefined,
+                    cpc_bid_micros: args?.cpc_bid ? Math.round(args.cpc_bid * 1000000) : undefined,
                 });
                 return {
                     content: [{
@@ -1337,14 +1359,26 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             }
             case "google_ads_enable_items": {
                 const customerId = args?.customer_id || "";
+                // Validate at least one ID array is provided and non-empty
+                const hasCampaignIds = args?.campaign_ids && args.campaign_ids.length > 0;
+                const hasAdGroupIds = args?.ad_group_ids && args.ad_group_ids.length > 0;
+                const hasAdIds = args?.ad_ids && args.ad_ids.length > 0;
+                if (!hasCampaignIds && !hasAdGroupIds && !hasAdIds) {
+                    return {
+                        content: [{
+                                type: "text",
+                                text: JSON.stringify({ error: "No item IDs provided. Specify at least one campaign, ad group, or ad ID." }, null, 2),
+                            }],
+                    };
+                }
                 const results = {};
-                if (args?.campaign_ids) {
+                if (hasCampaignIds) {
                     results.campaigns = await adsManager.enableCampaigns(customerId, args.campaign_ids);
                 }
-                if (args?.ad_group_ids) {
+                if (hasAdGroupIds) {
                     results.adGroups = await adsManager.enableAdGroups(customerId, args.ad_group_ids);
                 }
-                if (args?.ad_ids) {
+                if (hasAdIds) {
                     results.ads = await adsManager.enableAds(customerId, args.ad_ids);
                 }
                 return {
@@ -1360,14 +1394,26 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             }
             case "google_ads_pause_items": {
                 const customerId = args?.customer_id || "";
+                // Validate at least one ID array is provided and non-empty -- nothing to pause otherwise
+                const hasCampaignIds = args?.campaign_ids && args.campaign_ids.length > 0;
+                const hasAdGroupIds = args?.ad_group_ids && args.ad_group_ids.length > 0;
+                const hasAdIds = args?.ad_ids && args.ad_ids.length > 0;
+                if (!hasCampaignIds && !hasAdGroupIds && !hasAdIds) {
+                    return {
+                        content: [{
+                                type: "text",
+                                text: JSON.stringify({ error: "No item IDs provided. Specify at least one campaign, ad group, or keyword ID." }, null, 2),
+                            }],
+                    };
+                }
                 const results = {};
-                if (args?.campaign_ids) {
+                if (hasCampaignIds) {
                     results.campaigns = await adsManager.pauseCampaigns(customerId, args.campaign_ids);
                 }
-                if (args?.ad_group_ids) {
+                if (hasAdGroupIds) {
                     results.adGroups = await adsManager.pauseAdGroups(customerId, args.ad_group_ids);
                 }
-                if (args?.ad_ids) {
+                if (hasAdIds) {
                     results.ads = await adsManager.pauseAds(customerId, args.ad_ids);
                 }
                 return {
@@ -1555,6 +1601,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             // REPORTING HANDLERS
             // ============================================
             case "google_ads_keyword_performance": {
+                // Future date validation
+                const today_kp = new Date().toISOString().slice(0, 10);
+                if (args?.start_date && args.start_date > today_kp) {
+                    return { content: [{ type: "text", text: JSON.stringify({ error: `start_date "${args.start_date}" is in the future. Reports only cover historical data.` }, null, 2) }] };
+                }
                 const customerId = args?.customer_id || "";
                 const result = await adsManager.getKeywordPerformance(customerId, {
                     startDate: args?.start_date,
@@ -1571,6 +1622,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 };
             }
             case "google_ads_keyword_performance_by_conversion": {
+                const today_kpbc = new Date().toISOString().slice(0, 10);
+                if (args?.start_date && args.start_date > today_kpbc) {
+                    return { content: [{ type: "text", text: JSON.stringify({ error: `start_date "${args.start_date}" is in the future. Reports only cover historical data.` }, null, 2) }] };
+                }
                 const customerId = args?.customer_id || "";
                 const result = await adsManager.getKeywordPerformanceWithConversions(customerId, {
                     startDate: args?.start_date,
@@ -1587,6 +1642,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 };
             }
             case "google_ads_search_term_report": {
+                const today_str = new Date().toISOString().slice(0, 10);
+                if (args?.start_date && args.start_date > today_str) {
+                    return { content: [{ type: "text", text: JSON.stringify({ error: `start_date "${args.start_date}" is in the future. Reports only cover historical data.` }, null, 2) }] };
+                }
                 const customerId = args?.customer_id || "";
                 const result = await adsManager.getSearchTermReport(customerId, {
                     startDate: args?.start_date,
@@ -1604,6 +1663,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 };
             }
             case "google_ads_search_term_report_by_conversion": {
+                const today_strbc = new Date().toISOString().slice(0, 10);
+                if (args?.start_date && args.start_date > today_strbc) {
+                    return { content: [{ type: "text", text: JSON.stringify({ error: `start_date "${args.start_date}" is in the future. Reports only cover historical data.` }, null, 2) }] };
+                }
                 const customerId = args?.customer_id || "";
                 const result = await adsManager.getSearchTermReportWithConversions(customerId, {
                     startDate: args?.start_date,
@@ -1621,6 +1684,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 };
             }
             case "google_ads_ad_performance": {
+                const today_ap = new Date().toISOString().slice(0, 10);
+                if (args?.start_date && args.start_date > today_ap) {
+                    return { content: [{ type: "text", text: JSON.stringify({ error: `start_date "${args.start_date}" is in the future. Reports only cover historical data.` }, null, 2) }] };
+                }
                 const customerId = args?.customer_id || "";
                 const result = await adsManager.getAdPerformance(customerId, {
                     startDate: args?.start_date,
@@ -1636,6 +1703,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 };
             }
             case "google_ads_ad_performance_by_conversion": {
+                const today_apbc = new Date().toISOString().slice(0, 10);
+                if (args?.start_date && args.start_date > today_apbc) {
+                    return { content: [{ type: "text", text: JSON.stringify({ error: `start_date "${args.start_date}" is in the future. Reports only cover historical data.` }, null, 2) }] };
+                }
                 const customerId = args?.customer_id || "";
                 const result = await adsManager.getAdPerformanceWithConversions(customerId, {
                     startDate: args?.start_date,
@@ -1696,6 +1767,15 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 const campaignId = args?.campaign_id;
                 const dailyBudget = args?.daily_budget;
                 const createNew = args?.create_new_budget || false;
+                // Budget validation: reject $0 and negative budgets
+                if (dailyBudget <= 0) {
+                    return {
+                        content: [{
+                                type: "text",
+                                text: JSON.stringify({ error: "Budget must be positive (in dollars, e.g., 10 = $10/day)" }, null, 2),
+                            }],
+                    };
+                }
                 const result = await adsManager.updateCampaignBudget(customerId, campaignId, dailyBudget, createNew);
                 return {
                     content: [{
@@ -1710,6 +1790,16 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             case "google_ads_gaql_query": {
                 const customerId = args?.customer_id || "";
                 const query = args?.query;
+                // Block mutation statements -- GAQL query tool is read-only
+                const upperQuery = query.toUpperCase().trim();
+                if (upperQuery.startsWith("INSERT") || upperQuery.startsWith("UPDATE") || upperQuery.startsWith("DELETE") || upperQuery.startsWith("CREATE") || upperQuery.startsWith("DROP")) {
+                    return {
+                        content: [{
+                                type: "text",
+                                text: JSON.stringify({ error: "GAQL query tool is read-only. Mutation statements (INSERT, UPDATE, DELETE) are not allowed. Use the dedicated create/update tools instead." }, null, 2),
+                            }],
+                    };
+                }
                 const result = await adsManager.executeGaql(customerId, query);
                 return {
                     content: [{
@@ -1721,6 +1811,15 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             case "google_ads_keyword_volume": {
                 const customerId = args?.customer_id || "";
                 const keywords = args?.keywords;
+                // Enforce max 20 keywords per request
+                if (keywords.length > 20) {
+                    return {
+                        content: [{
+                                type: "text",
+                                text: JSON.stringify({ error: `Too many keywords (${keywords.length}). Maximum is 20 per request. Split into multiple calls.` }, null, 2),
+                            }],
+                    };
+                }
                 const geoTargetConstants = args?.geo_target_constants;
                 const language = args?.language;
                 const result = await adsManager.keywordVolume(customerId, keywords, geoTargetConstants, language);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mcp-google-ads",
   "mcpName": "io.github.mharnett/google-ads",
-  "version": "1.0.14",
+  "version": "1.0.16",
   "description": "MCP server for Google Ads API with MCC support, 34 tools for campaign management, reporting, and optimization. Safe by default -- all changes created PAUSED.",
   "main": "dist/index.js",
   "bin": {