mcp-google-ads 1.0.3 → 1.0.5

package/dist/build-info.json

@@ -1 +1 @@
-{"sha":"a78df84","builtAt":"2026-04-09T18:53:13.812Z"}
+{"sha":"82b0bbb","builtAt":"2026-04-09T19:59:25.007Z"}

package/dist/index.js

@@ -17,6 +17,22 @@ try {
 catch {
     // build-info.json not present (dev mode)
 }
+// CLI flags
+const __cliPkg = JSON.parse(readFileSync(join(dirname(new URL(import.meta.url).pathname), "..", "package.json"), "utf-8"));
+if (process.argv.includes("--help") || process.argv.includes("-h")) {
+    console.log(`${__cliPkg.name} v${__cliPkg.version}\n`);
+    console.log(`Usage: ${__cliPkg.name} [options]\n`);
+    console.log("MCP server communicating via stdio. Configure in your .mcp.json.\n");
+    console.log("Options:");
+    console.log("  --help, -h       Show this help message");
+    console.log("  --version, -v    Show version number");
+    console.log(`\nDocumentation: https://github.com/mharnett/mcp-google-ads`);
+    process.exit(0);
+}
+if (process.argv.includes("--version") || process.argv.includes("-v")) {
+    console.log(__cliPkg.version);
+    process.exit(0);
+}
 function loadConfig() {
     // Try config.json first (for multi-client setups)
     const configPath = join(dirname(new URL(import.meta.url).pathname), "..", "config.json");
@@ -64,6 +80,17 @@ function getClientFromWorkingDir(config, cwd) {
     return null;
 }
 // ============================================
+// GAQL SANITIZATION
+// ============================================
+/** Strip non-numeric characters from IDs used in GAQL WHERE clauses. */
+function sanitizeNumericId(id) {
+    return id.replace(/[^0-9]/g, "");
+}
+/** Escape single quotes in strings used in GAQL WHERE clauses. */
+function escapeGaqlString(s) {
+    return s.replace(/'/g, "\\'");
+}
+// ============================================
 // TYPED ERRORS & VALIDATION (extracted to errors.ts)
 // ============================================
 import { GoogleAdsAuthError, GoogleAdsRateLimitError, GoogleAdsServiceError, validateCredentials, classifyError, } from "./errors.js";
@@ -177,7 +204,7 @@ class GoogleAdsManager {
       WHERE ad_group.status != 'REMOVED'
     `;
         if (campaignId) {
-            query += ` AND campaign.id = ${campaignId}`;
+            query += ` AND campaign.id = ${sanitizeNumericId(campaignId)}`;
         }
         query += ` ORDER BY campaign.name, ad_group.name`;
         const result = await withResilience(() => customer.query(query), "listAdGroups");
@@ -203,7 +230,7 @@ class GoogleAdsManager {
       WHERE ad_group_ad.status != 'REMOVED'
     `;
         if (options.campaignId) {
-            query += ` AND campaign.id = ${options.campaignId}`;
+            query += ` AND campaign.id = ${sanitizeNumericId(options.campaignId)}`;
         }
         if (options.adGroupId) {
             query += ` AND ad_group.id = ${options.adGroupId}`;
@@ -281,7 +308,7 @@ class GoogleAdsManager {
         const existing = await withResilience(() => customer.query(`
         SELECT label.resource_name, label.name
         FROM label
-        WHERE label.name = '${labelName}'
+        WHERE label.name = '${escapeGaqlString(labelName)}'
           AND label.status = 'ENABLED'
       `), "ensureLabelExists.query");
         if (existing.length > 0) {
@@ -292,7 +319,7 @@ class GoogleAdsManager {
         if (result.existing) {
             // Race condition: re-query
             const requery = await withResilience(() => customer.query(`
-          SELECT label.resource_name FROM label WHERE label.name = '${labelName}' AND label.status = 'ENABLED'
+          SELECT label.resource_name FROM label WHERE label.name = '${escapeGaqlString(labelName)}' AND label.status = 'ENABLED'
         `), "ensureLabelExists.requery");
             return requery[0].label.resource_name;
         }
@@ -695,7 +722,7 @@ class GoogleAdsManager {
             query += ` AND ad_group_criterion.keyword.text LIKE '%${options.keywordTextContains}%'`;
         }
         if (options.campaignIds && options.campaignIds.length > 0) {
-            query += ` AND campaign.id IN (${options.campaignIds.join(",")})`;
+            query += ` AND campaign.id IN (${options.campaignIds.map(sanitizeNumericId).join(",")})`;
         }
         if (options.adGroupIds && options.adGroupIds.length > 0) {
             query += ` AND ad_group.id IN (${options.adGroupIds.join(",")})`;
@@ -735,7 +762,7 @@ class GoogleAdsManager {
             query += ` AND ad_group_criterion.keyword.text LIKE '%${options.keywordTextContains}%'`;
         }
         if (options.campaignIds && options.campaignIds.length > 0) {
-            query += ` AND campaign.id IN (${options.campaignIds.join(",")})`;
+            query += ` AND campaign.id IN (${options.campaignIds.map(sanitizeNumericId).join(",")})`;
         }
         if (options.adGroupIds && options.adGroupIds.length > 0) {
             query += ` AND ad_group.id IN (${options.adGroupIds.join(",")})`;
@@ -773,7 +800,7 @@ class GoogleAdsManager {
             query += ` AND search_term_view.search_term LIKE '%${options.searchTermContains}%'`;
         }
         if (options.campaignIds && options.campaignIds.length > 0) {
-            query += ` AND campaign.id IN (${options.campaignIds.join(",")})`;
+            query += ` AND campaign.id IN (${options.campaignIds.map(sanitizeNumericId).join(",")})`;
         }
         if (options.adGroupIds && options.adGroupIds.length > 0) {
             query += ` AND ad_group.id IN (${options.adGroupIds.join(",")})`;
@@ -809,7 +836,7 @@ class GoogleAdsManager {
             query += ` AND search_term_view.search_term LIKE '%${options.searchTermContains}%'`;
         }
         if (options.campaignIds && options.campaignIds.length > 0) {
-            query += ` AND campaign.id IN (${options.campaignIds.join(",")})`;
+            query += ` AND campaign.id IN (${options.campaignIds.map(sanitizeNumericId).join(",")})`;
         }
         if (options.adGroupIds && options.adGroupIds.length > 0) {
             query += ` AND ad_group.id IN (${options.adGroupIds.join(",")})`;
@@ -854,7 +881,7 @@ class GoogleAdsManager {
         AND ad_group_ad.status != 'REMOVED'
     `;
         if (options.campaignIds && options.campaignIds.length > 0) {
-            query += ` AND campaign.id IN (${options.campaignIds.join(",")})`;
+            query += ` AND campaign.id IN (${options.campaignIds.map(sanitizeNumericId).join(",")})`;
         }
         if (options.adGroupIds && options.adGroupIds.length > 0) {
             query += ` AND ad_group.id IN (${options.adGroupIds.join(",")})`;
@@ -897,7 +924,7 @@ class GoogleAdsManager {
         AND ad_group_ad.status != 'REMOVED'
     `;
         if (options.campaignIds && options.campaignIds.length > 0) {
-            query += ` AND campaign.id IN (${options.campaignIds.join(",")})`;
+            query += ` AND campaign.id IN (${options.campaignIds.map(sanitizeNumericId).join(",")})`;
         }
         if (options.adGroupIds && options.adGroupIds.length > 0) {
             query += ` AND ad_group.id IN (${options.adGroupIds.join(",")})`;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mcp-google-ads",
   "mcpName": "io.github.mharnett/google-ads",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "MCP server for Google Ads API with MCC support, 35 tools for campaign management, reporting, and optimization. Safe by default — all changes created PAUSED.",
   "main": "dist/index.js",
   "bin": {