mcp-google-ads 1.0.4 → 1.0.6

package/README.md

@@ -1,6 +1,6 @@
 # MCP Google Ads Server
 
-An MCP (Model Context Protocol) server for the Google Ads API with built-in safeguards for review before changes go live. Production-proven with MCC (Manager Account) support, 35 tools for campaign management, reporting, and optimization.
+An MCP (Model Context Protocol) server for the Google Ads API with built-in safeguards for review before changes go live. Production-proven with MCC (Manager Account) support, 34 tools for campaign management, reporting, and optimization.
 
 ## Features
 
@@ -133,7 +133,7 @@ Restart Claude Code.
 5. Claude enables (requires your approval prompt)
 ```
 
-### Available Tools (35)
+### Available Tools (34)
 
 #### Context & Discovery
 | Tool | Description |

package/dist/build-info.json

@@ -1 +1 @@
-{"sha":"8e7eb9a","builtAt":"2026-04-09T19:36:52.493Z"}
+{"sha":"5a28978","builtAt":"2026-04-09T20:25:53.245Z"}

package/dist/index.js

@@ -80,6 +80,17 @@ function getClientFromWorkingDir(config, cwd) {
     return null;
 }
 // ============================================
+// GAQL SANITIZATION
+// ============================================
+/** Strip non-numeric characters from IDs used in GAQL WHERE clauses. */
+function sanitizeNumericId(id) {
+    return id.replace(/[^0-9]/g, "");
+}
+/** Escape single quotes in strings used in GAQL WHERE clauses. */
+function escapeGaqlString(s) {
+    return s.replace(/'/g, "\\'");
+}
+// ============================================
 // TYPED ERRORS & VALIDATION (extracted to errors.ts)
 // ============================================
 import { GoogleAdsAuthError, GoogleAdsRateLimitError, GoogleAdsServiceError, validateCredentials, classifyError, } from "./errors.js";
@@ -193,7 +204,7 @@ class GoogleAdsManager {
       WHERE ad_group.status != 'REMOVED'
     `;
         if (campaignId) {
-            query += ` AND campaign.id = ${campaignId}`;
+            query += ` AND campaign.id = ${sanitizeNumericId(campaignId)}`;
         }
         query += ` ORDER BY campaign.name, ad_group.name`;
         const result = await withResilience(() => customer.query(query), "listAdGroups");
@@ -219,10 +230,10 @@ class GoogleAdsManager {
       WHERE ad_group_ad.status != 'REMOVED'
     `;
         if (options.campaignId) {
-            query += ` AND campaign.id = ${options.campaignId}`;
+            query += ` AND campaign.id = ${sanitizeNumericId(options.campaignId)}`;
         }
         if (options.adGroupId) {
-            query += ` AND ad_group.id = ${options.adGroupId}`;
+            query += ` AND ad_group.id = ${sanitizeNumericId(options.adGroupId)}`;
         }
         query += ` ORDER BY campaign.name, ad_group.name`;
         const result = await withResilience(() => customer.query(query), "listAds");
@@ -297,7 +308,7 @@ class GoogleAdsManager {
         const existing = await withResilience(() => customer.query(`
         SELECT label.resource_name, label.name
         FROM label
-        WHERE label.name = '${labelName}'
+        WHERE label.name = '${escapeGaqlString(labelName)}'
           AND label.status = 'ENABLED'
       `), "ensureLabelExists.query");
         if (existing.length > 0) {
@@ -308,7 +319,7 @@ class GoogleAdsManager {
         if (result.existing) {
             // Race condition: re-query
             const requery = await withResilience(() => customer.query(`
-          SELECT label.resource_name FROM label WHERE label.name = '${labelName}' AND label.status = 'ENABLED'
+          SELECT label.resource_name FROM label WHERE label.name = '${escapeGaqlString(labelName)}' AND label.status = 'ENABLED'
         `), "ensureLabelExists.requery");
             return requery[0].label.resource_name;
         }
@@ -711,7 +722,7 @@ class GoogleAdsManager {
             query += ` AND ad_group_criterion.keyword.text LIKE '%${options.keywordTextContains}%'`;
         }
         if (options.campaignIds && options.campaignIds.length > 0) {
-            query += ` AND campaign.id IN (${options.campaignIds.join(",")})`;
+            query += ` AND campaign.id IN (${options.campaignIds.map(sanitizeNumericId).join(",")})`;
         }
         if (options.adGroupIds && options.adGroupIds.length > 0) {
             query += ` AND ad_group.id IN (${options.adGroupIds.join(",")})`;
@@ -751,7 +762,7 @@ class GoogleAdsManager {
             query += ` AND ad_group_criterion.keyword.text LIKE '%${options.keywordTextContains}%'`;
         }
         if (options.campaignIds && options.campaignIds.length > 0) {
-            query += ` AND campaign.id IN (${options.campaignIds.join(",")})`;
+            query += ` AND campaign.id IN (${options.campaignIds.map(sanitizeNumericId).join(",")})`;
         }
         if (options.adGroupIds && options.adGroupIds.length > 0) {
             query += ` AND ad_group.id IN (${options.adGroupIds.join(",")})`;
@@ -789,7 +800,7 @@ class GoogleAdsManager {
             query += ` AND search_term_view.search_term LIKE '%${options.searchTermContains}%'`;
         }
         if (options.campaignIds && options.campaignIds.length > 0) {
-            query += ` AND campaign.id IN (${options.campaignIds.join(",")})`;
+            query += ` AND campaign.id IN (${options.campaignIds.map(sanitizeNumericId).join(",")})`;
         }
         if (options.adGroupIds && options.adGroupIds.length > 0) {
             query += ` AND ad_group.id IN (${options.adGroupIds.join(",")})`;
@@ -825,7 +836,7 @@ class GoogleAdsManager {
             query += ` AND search_term_view.search_term LIKE '%${options.searchTermContains}%'`;
         }
         if (options.campaignIds && options.campaignIds.length > 0) {
-            query += ` AND campaign.id IN (${options.campaignIds.join(",")})`;
+            query += ` AND campaign.id IN (${options.campaignIds.map(sanitizeNumericId).join(",")})`;
         }
         if (options.adGroupIds && options.adGroupIds.length > 0) {
             query += ` AND ad_group.id IN (${options.adGroupIds.join(",")})`;
@@ -870,7 +881,7 @@ class GoogleAdsManager {
         AND ad_group_ad.status != 'REMOVED'
     `;
         if (options.campaignIds && options.campaignIds.length > 0) {
-            query += ` AND campaign.id IN (${options.campaignIds.join(",")})`;
+            query += ` AND campaign.id IN (${options.campaignIds.map(sanitizeNumericId).join(",")})`;
         }
         if (options.adGroupIds && options.adGroupIds.length > 0) {
             query += ` AND ad_group.id IN (${options.adGroupIds.join(",")})`;
@@ -913,7 +924,7 @@ class GoogleAdsManager {
         AND ad_group_ad.status != 'REMOVED'
     `;
         if (options.campaignIds && options.campaignIds.length > 0) {
-            query += ` AND campaign.id IN (${options.campaignIds.join(",")})`;
+            query += ` AND campaign.id IN (${options.campaignIds.map(sanitizeNumericId).join(",")})`;
         }
         if (options.adGroupIds && options.adGroupIds.length > 0) {
             query += ` AND ad_group.id IN (${options.adGroupIds.join(",")})`;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mcp-google-ads",
   "mcpName": "io.github.mharnett/google-ads",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "MCP server for Google Ads API with MCC support, 35 tools for campaign management, reporting, and optimization. Safe by default — all changes created PAUSED.",
   "main": "dist/index.js",
   "bin": {