Google Ads MCP 0.0.6 exposed mutation tools by default despite a read-only description

A previous account of the Google Ads MCP adapter described it as read-only. Version 0.0.6 introduced tools that can create or mutate campaign-related configuration and exposed them in the ordinary default tool set. A user or approval policy that had previously trusted the server identity for querying reports might discover that the same named integration now advertises write-capable operations. That is a change in the available tool surface; it is not proof a model secretly gained privileges at the Google Ads API level.

The actual Google Ads OAuth credential must already permit the requested mutation, and real authorization checks continue to apply. The upstream release documents the added tools, but not a measured malicious edit, user bypass or compromise. A defensible finding concerns persistent client trust and the mismatch between a read-only safety assumption and subsequently expanded tool descriptors.

Google Ads MCP release 0.0.6 when clients automatically expose or authorize the newly introduced write operations; requires a credential with corresponding Google Ads API permissions.

The release alone cannot establish unauthorized user effects, privilege escalation or a vulnerability in Google Ads. Tool exposure and successful API mutation have separate preconditions.

The November 2 release is a vendor feature change, not an observed attack. Pull request #139 added creation of advertising assets, video uploading and label management, with mutation tools enabled by default in tools_config.yaml. It also specifies a validateOnly=true proposal before an explicit user confirmation of each actual mutation. That second stage is central to the security interpretation: exposure of write tools does not by itself show that the tool made an unapproved advertising change.

Risk depends on what an agent host does with refreshed tool declarations. A client that treats the MCP server's old read-only reputation as a permanent approval could present those tools without adequately reviewing the new mutation types; the Google Ads API still requires a token with write authority. Operator testing should verify that the proposed account, target object and change preview match the final executed API request, and that denial or an expired approval cannot be bypassed through a replay.