Do I have to give my AI assistant my Google Ads password?

No. That is the point of brokering: your organization connects accounts once through OAuth, and the MCP key carries scopes rather than credentials. The assistant never sees a platform credential.

Can an external agent bypass my approval settings?

No. Writes run through the same dispatcher and the same autonomy guardrails as the in-app agent, in strict mode — change caps, protected campaigns, the monthly spend cap and current-value verification all apply regardless of which client made the call.

What is the difference between agent mode and tools mode?

In agent mode you hand over a goal and our planner executes it. In tools mode your own agent does the planning and calls our platform tools directly under your connected accounts. The key's scopes decide which mode it gets.

Update

Run your ad accounts from Claude or Codex — we broker the permissions and keep the audit trail

TL;DR

You already have an agent you like. This release lets it drive your ad stack without you handing it a single platform credential: Agent Planners becomes the permission broker, the guardrail layer and the audit trail, while Claude or Codex does the planning. One endpoint, one API key, and what that key may do is decided by your organization rather than by whoever is prompting.

How it connects

The MCP server speaks Streamable HTTP with JSON-RPC 2.0 at `https://www.agentplanners.com/api/mcp`, authenticated with an `ap_live_…` key on every request. Claude Desktop and Claude Code take it as a URL plus an `Authorization` header; Codex takes the same endpoint in `~/.codex/config.toml` with the key read from an environment variable so it never sits in a config file. Any other MCP host works the same way — nothing here is client-specific.

Two modes, chosen by the key's scopes

Agent mode (`tasks:*` + `accounts:read`) — your agent hands over a whole goal and we plan and execute it: `create_task`, then poll `get_task`. The planning happens on our side.
Tools mode (`tools:read` / `tools:write`) — your agent calls our platform tools directly (`google_ads__search`, `ga4__run_report`, and the rest) under your organization's connected accounts. You bring the agent; we broker credentials and permissions. Paid plans and internal organizations only, and it fails closed.
Raw mode (`tools:raw`) — bring your own tool definitions and we inject the credentials. Read-only by default; a raw *write* queues for a human to approve on the API & MCP page, and as of this release a key can be pre-authorized for raw writes so a trusted integration doesn't stop at every call.
`describe_permissions` is exposed to every key and answers what that key may actually do — its mode, scopes, plan entitlement and connected accounts. An agent that starts there stops guessing.

What lands in the audit log — and what doesn't

Every write through MCP records an audit row with the acting key as the actor (`apikey:<keyId>`), whether it succeeded, failed, or was blocked by a guardrail. So the answer to "who changed this budget" is the same question with the same answer whether the change came from the app, a schedule, or someone's Claude session.

Reads are the honest exception: they are scoped, rate-limited and metered, but not written as individual audit rows. A read-heavy session shows up in your usage rather than as a hundred audit entries — worth knowing before you go looking for one.

The guardrails do not move because the caller changed

The same dispatcher runs the work that the in-app agent uses — not a parallel implementation that could drift.
Writes pass the organization's autonomy guardrails in strict mode: change caps, protected campaigns, the monthly spend cap, and verification of the current value before it is replaced.
Account resolution is exact or it refuses — one match inside your organization and the right platform family, or an error naming the candidates. It never picks one for you.
`idempotencyKey` is accepted on writes, so a retrying agent doesn't double-apply a change.

This is the part that makes handing an external agent access reasonable at all: the permission decision belongs to the organization and the key, not to the prompt. A jailbroken instruction inside a conversation cannot widen a scope it was never granted.

Frequently asked questions

Can I use Agent Planners from Claude or Codex?: Yes — add it as an MCP server. Claude Desktop and Claude Code take the endpoint URL with an Authorization header; Codex takes the same endpoint in ~/.codex/config.toml with the key in an environment variable. Any MCP host works.
Do I have to give my AI assistant my Google Ads password?: No. That is the point of brokering: your organization connects accounts once through OAuth, and the MCP key carries scopes rather than credentials. The assistant never sees a platform credential.
Will I see what the external agent did?: Every write records an audit row with the acting key as the actor, and whether it succeeded, failed or was blocked by a guardrail. Reads are scoped, rate-limited and metered but not individually audited.
Can an external agent bypass my approval settings?: No. Writes run through the same dispatcher and the same autonomy guardrails as the in-app agent, in strict mode — change caps, protected campaigns, the monthly spend cap and current-value verification all apply regardless of which client made the call.
What is the difference between agent mode and tools mode?: In agent mode you hand over a goal and our planner executes it. In tools mode your own agent does the planning and calls our platform tools directly under your connected accounts. The key's scopes decide which mode it gets.