mcp-google-ads 1.6.0 → 1.7.0

package/README.md

@@ -32,13 +32,36 @@ You need:
 
 #### Getting a Refresh Token
 
-Use the Google OAuth playground or run:
+Bring your own OAuth client (the `client_id` / `client_secret` from the step
+above) and run the bundled helper. It runs Google's installed-app loopback flow
+**with PKCE (S256)** and prints your refresh token. It reads nothing from your
+home directory and needs no shared OAuth keyfile.
 
 ```bash
-pip install google-ads
-google-ads-auth
+export GOOGLE_ADS_CLIENT_ID="YOUR_CLIENT_ID.apps.googleusercontent.com"
+export GOOGLE_ADS_CLIENT_SECRET="YOUR_CLIENT_SECRET"
+node get-refresh-token.cjs
 ```
 
+Your browser opens for Google sign-in; approve as the Google account that owns
+the Ads data. On success the helper prints one line to stdout:
+
+```
+GOOGLE_ADS_REFRESH_TOKEN=1//0a...
+```
+
+Set that value in your environment (or `config.json`, below). The OAuth scope
+requested is read from `config.json` (`oauth.scope`), falling back to
+`config.example.json`, so the helper and the running server always request the
+same scope. This MCP requests only the minimum scope it needs:
+`https://www.googleapis.com/auth/adwords`.
+
+> Do not run this with stdout redirected to a shared log file — the refresh
+> token is printed to stdout by design.
+
+Note: `GOOGLE_ADS_DEVELOPER_TOKEN` is a separate Google Ads API credential, not
+an OAuth scope — set it independently (see Environment Variables below).
+
 ### 2. Install
 
 ```bash
@@ -66,6 +89,9 @@ Edit `config.json` with your credentials:
 
 ```json
 {
+  "oauth": {
+    "scope": "https://www.googleapis.com/auth/adwords"
+  },
   "google_ads": {
     "developer_token": "YOUR_DEVELOPER_TOKEN",
     "client_id": "YOUR_CLIENT_ID.apps.googleusercontent.com",

package/config.example.json

@@ -1,4 +1,7 @@
 {
+  "oauth": {
+    "scope": "https://www.googleapis.com/auth/adwords"
+  },
   "google_ads": {
     "developer_token": "YOUR_DEVELOPER_TOKEN",
     "client_id": "YOUR_CLIENT_ID.apps.googleusercontent.com",

package/dist/auth-cli.d.ts

@@ -1,2 +1,11 @@
 #!/usr/bin/env node
+export declare const OAUTH_SCOPE: string;
+export declare function buildAuthUrl(clientId: string, redirectUri: string, state: string, codeChallenge: string): string;
+export declare function buildTokenExchangeBody(opts: {
+    code: string;
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+    codeVerifier: string;
+}): string;
 export declare function run(argv?: string[]): Promise<void>;

package/dist/auth-cli.js

@@ -13,8 +13,17 @@ import {
 import { classifyError, GoogleAdsAuthError } from "./errors.js";
 import { findFreeLoopbackPort, openBrowser } from "./platform.js";
 import { logger, withResilience } from "./resilience.js";
+import { dirname, join } from "path";
+import { loadOAuthScopeFromFile } from "./oauthScope.js";
+import {
+  generateCodeVerifier,
+  computeCodeChallenge,
+  buildLoopbackRedirectUri
+} from "./pkce.js";
 const prompts = promptsImport.default ?? promptsImport;
-const OAUTH_SCOPE = "https://www.googleapis.com/auth/adwords";
+const OAUTH_SCOPE = loadOAuthScopeFromFile(
+  join(dirname(fileURLToPath(import.meta.url)), "..", "config.json")
+);
 const OAUTH_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
 const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
 function parseArgs(argv) {
@@ -46,7 +55,7 @@ function printHelp() {
     ].join("\n")
   );
 }
-function buildAuthUrl(clientId, redirectUri, state) {
+function buildAuthUrl(clientId, redirectUri, state, codeChallenge) {
   const params = new URLSearchParams({
     client_id: clientId,
     redirect_uri: redirectUri,
@@ -54,7 +63,10 @@ function buildAuthUrl(clientId, redirectUri, state) {
     scope: OAUTH_SCOPE,
     access_type: "offline",
     prompt: "consent",
-    state
+    state,
+    code_challenge: codeChallenge,
+    // PKCE (RFC 7636)
+    code_challenge_method: "S256"
   });
   return `${OAUTH_AUTH_URL}?${params.toString()}`;
 }
@@ -161,19 +173,25 @@ function renderAuthCompletePage(title, body) {
 function escapeHtml(s) {
   return s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 }
-async function exchangeCodeForTokens(code, clientId, clientSecret, redirectUri) {
+function buildTokenExchangeBody(opts) {
+  return new URLSearchParams({
+    code: opts.code,
+    client_id: opts.clientId,
+    client_secret: opts.clientSecret,
+    // confidential Desktop client — PKCE is additive
+    redirect_uri: opts.redirectUri,
+    grant_type: "authorization_code",
+    code_verifier: opts.codeVerifier
+    // PKCE proof — sent on exchange
+  }).toString();
+}
+async function exchangeCodeForTokens(code, clientId, clientSecret, redirectUri, codeVerifier) {
   return withResilience(async () => {
-    const body = new URLSearchParams({
-      code,
-      client_id: clientId,
-      client_secret: clientSecret,
-      redirect_uri: redirectUri,
-      grant_type: "authorization_code"
-    });
+    const body = buildTokenExchangeBody({ code, clientId, clientSecret, redirectUri, codeVerifier });
     const res = await fetch(OAUTH_TOKEN_URL, {
       method: "POST",
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: body.toString()
+      body
     });
     const json = await res.json();
     if (!res.ok || json.error) {
@@ -348,13 +366,15 @@ async function run(argv = process.argv.slice(2)) {
     process.exit(2);
   }
   const port = await findFreeLoopbackPort();
-  const redirectUri = `http://127.0.0.1:${port}`;
+  const redirectUri = buildLoopbackRedirectUri(port);
   const state = randomState();
-  const authUrl = buildAuthUrl(clientId, redirectUri, state);
+  const codeVerifier = generateCodeVerifier();
+  const codeChallenge = computeCodeChallenge(codeVerifier);
+  const authUrl = buildAuthUrl(clientId, redirectUri, state, codeChallenge);
   process.stderr.write("\n=== mcp-google-ads authentication ===\n");
   const { code } = await waitForAuthorizationCode(port, state, authUrl);
   process.stderr.write("Authorization code received. Exchanging for tokens...\n");
-  const tokens = await exchangeCodeForTokens(code, clientId, clientSecret, redirectUri);
+  const tokens = await exchangeCodeForTokens(code, clientId, clientSecret, redirectUri, codeVerifier);
   if (!tokens.refresh_token) {
     throw new GoogleAdsAuthError(
       "Google did not return a refresh token. This can happen if you previously granted consent to this app \u2014 revoke access at https://myaccount.google.com/permissions and try again."
@@ -419,6 +439,9 @@ if (isMain) {
   });
 }
 export {
+  OAUTH_SCOPE,
+  buildAuthUrl,
+  buildTokenExchangeBody,
   run
 };
 //# sourceMappingURL=auth-cli.js.map

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "sha": "7d2b185",
-  "builtAt": "2026-05-27T23:45:13.595Z",
+  "sha": "95e7b7c",
+  "builtAt": "2026-07-09T13:47:57.357Z",
   "embeddedSecrets": true
 }