Is my ad data safe with an MCP server?

Where your data actually travels

Most security pages in this category answer the question about writes: can it break something. This is the other question. Who ends up holding your numbers?

• The ad platform, which already has it.
• The MCP server, which requests it on your behalf and passes it on. Whether anything is stored in between is a question worth asking directly.
• Your AI client's context window. Every tool result is returned into the conversation, because that is how the assistant answers you.
• Your model provider, because the context window is sent to the model. This is unavoidable in any connected setup, including the first-party servers.
• Your conversation history, which persists in the client under whatever retention and training settings your account has.

That last one is the one people have not thought about. Connecting an MCP server is a decision about your chat history as much as about your ad account.

The risks that are real

• Over-broad grants. An OAuth scope covering every account in your Business Manager has a far larger blast radius than one covering the account you meant. Read the consent screen, not the marketing page.
• Retention you did not ask about. Some servers cache results to cut API calls. Reasonable engineering, and also a copy of your data somewhere new. Ask how long, and whether it is encrypted at rest.
• Prompt injection as an exfiltration route. Assistants read landing pages, ad copy and competitor material, and text pulled into context can carry instructions. A narrow tool surface with no outbound calls is much harder to abuse.
• Training and history settings. Whether your conversations can be used to improve a model is a setting in your AI client, not something an MCP vendor controls. Check it in your own account instead of assuming a default.
• Pasted tokens. Any tool asking you to paste a long-lived access token into a chat window has already failed. Close the tab.

The questions to ask any vendor

• What exactly does the OAuth scope cover, and can I restrict it to named accounts?
• Do you store ad data at rest, and for how long?
• Who are your subprocessors?
• Can I revoke, and what happens to anything stored when I do?
• Is there a read-only tier I can evaluate on before write capability exists on my connection at all?

A vendor who cannot answer these quickly is telling you something. So is one who answers them in adjectives.

How Muze handles it, including the part that is not reassuring

Connection is OAuth. Muze never asks for platform passwords, there is no developer account, and there is no token for you to mint or rotate. Access is scoped to the accounts you authorize and you can revoke it, both from Muze and from the ad platform's own security settings, which is the version that does not depend on us.

Retention specifics are in the privacy policy. If your own policy has a hard requirement, get the answer in writing before you connect rather than afterwards.

The part that is not reassuring, and it is true of every connected setup including the first-party servers: tool results enter your AI client's context and go to your model provider. We cannot make that not happen, because it is how the assistant answers. What you control is which accounts are reachable, and your client's own data settings.

If you want the strictest version

Read-only removes the write risk entirely and reduces the data question to ordinary reporting access. Google's official MCP server is read-only and first-party, so no third party sits in the credential path at all. Meta's first-party server is free during its beta.

If your requirement is that nobody else's infrastructure touches the data, self-hosted open source is the category that fits, and the price is that you now run and patch it. GoMarble is the example worth looking at.

Muze's free tier is 25 read-only tool calls a month with no card, which is enough to watch the whole data flow on a low-stakes account before you connect the one that matters. The write-side safety model is covered separately in is it safe to connect AI to ad accounts.

Related questions

Does my ad data get used to train an AI model?

That depends on your AI client's settings rather than on the MCP server. Consumer and business tiers have different defaults and those defaults change. Check the data controls in your own account rather than taking anyone's word for it, including ours.

Is a self-hosted MCP server safer?

For data residency, yes: nothing leaves your infrastructure except what goes to the model provider. For everything else it is a trade. You now own patching, credential storage and whether the code does what it says. Self-hosting moves the risk rather than deleting it.

Can I limit which accounts are visible?

Yes. Authorization is per account, so grant only the accounts you want reachable. This is the single most effective control on the list and it takes about ten seconds.

Does the AI see my ad platform password?

No. OAuth means the platform authenticates you directly and hands back a scoped token. Any tool that asks for your platform password is the wrong tool.

What should I do if I stop using a connected tool?

Revoke the OAuth grant at the ad platform, not just in the vendor's dashboard. An unused grant is the one nobody remembers to check, which is exactly what makes it worth checking.

Keep reading

Other answers

See every answer