MCP in plain English, then we move on
Model Context Protocol is a standard interface that lets an AI assistant read from and write to an external data source without custom integration code. Think of it as a structured socket: on one side is the AI agent (Claude, ChatGPT, a custom automation); on the other is the platform or database. The agent sends a structured request through the MCP server; the server responds with data or confirms an action. Every connection uses the same handshake regardless of which assistant or which data source is on either end.
That interoperability is the point. Before MCP, connecting an AI assistant to a live ad account or a data warehouse required bespoke integration work per platform, per tool. A single standard dissolves that friction and makes it possible to route queries from multiple agents to multiple platforms through the same pattern.
leapbuzz published a full explainer when Microsoft Advertising opened the first first-party ad-platform MCP server in June 2026. That post covers the specification, authentication models, and governance questions in depth. Read it at The first ad platform to open its data to Claude and ChatGPT via MCP. This post focuses on the shift that happened in July 2026: two more major surfaces opened, and the combined picture now looks less like isolated experiments and more like a converging industry standard.
What changed in July: Meta and Snowflake join the stack
Three developments in a tight window changed the calculation for marketing operations teams.
On 30 June 2026, Meta announced the Developer Tools MCP server. It connects AI coding agents, including Claude, Cursor, Codex, and ChatGPT, to Meta's developer platform. The scope is primarily read-only: app configuration and settings, App Review status, compliance status, API usage and health, webhook topics, and subscriptions are all accessible. The only write capability is webhook subscription management. This server is aimed at developers building on Meta's APIs, not at marketing operators running campaigns, but it signals Meta's willingness to expose its platform surfaces to external agents under a governed protocol.
On 16 July 2026, Meta opened the Ads MCP server to any developer with their own Meta app. This is the operationally significant one. The server, hosted at mcp.facebook.com/ads, gives a connected AI agent access to campaign creation, editing and deletion, custom audience management, catalog management, performance analytics with flexible breakdowns, signal diagnostics, A/B tests and conversion lift studies, and activity logs. Read and write operations are both available.
Agencies managing campaigns on behalf of clients need Advanced Access on the ads_mcp_management permission and must submit for app review. On the same date, Meta added governance rules giving portfolio administrators control over which AI agent permissions are active, down to budget modifications and catalog changes.
The Snowflake managed MCP server was announced in public preview as part of the Cortex AI for Financial Services announcement in October 2025 and reached general availability on 4 November 2025. The server bundles four capabilities in one connection: Cortex Analyst for natural language queries over structured data, Cortex Search for unstructured document retrieval, Cortex Agents for nested agent orchestration across data retrieval tasks, and direct SQL execution with a configurable read-only parameter.
SQL execution defaults to read-only mode, meaning agents can run SELECT queries but cannot write data unless a team explicitly enables write access. For financial services teams, the server connects third-party data from MSCI, Nasdaq eVestment, The Associated Press, and FactSet through the same interface, alongside whatever proprietary data the organisation holds in Snowflake. Agent platforms that can connect include Claude (Anthropic), CrewAI, Cursor, Cognition (Devin), and Windsurf.
The Snowflake MCP server was in public preview at the Cortex AI for Financial Services announcement (October 2025). It reached general availability on 4 November 2025 per Snowflake release notes. As of mid-2026, this is a production-grade connection. Cortex Knowledge Extensions are also generally available; Semantic View Sharing followed shortly after.
Together, these three surfaces, Microsoft Advertising (open pilot since 17 June 2026), Meta Ads, and Snowflake, represent the first cohort of major marketing platforms and data infrastructure providers converging on a common agent interface. Whether that becomes a durable standard depends on adoption and on what Google and other holdouts do next.
Three MCP surfaces compared
The table below covers the three ad-platform and data-infrastructure MCP surfaces available to marketing teams as of late July 2026. A fourth, Google Ads, has no published first-party MCP server at the time of writing; Google's investment has gone into in-platform AI tools rather than external agent connectors.
| Surface | Read scope | Write scope | Access path | Maturity |
|---|---|---|---|---|
| Microsoft Advertising MCPLaunched 17 Jun 2026 | Campaign performance metrics, spend, impressions, clicks, campaign status, audience data | None (read-only pilot) | Microsoft Advertising account + MCP-compatible agent (M365 Copilot, Claude, ChatGPT) | Open pilot |
| Meta Developer Tools MCPLaunched 30 Jun 2026 | App configuration, App Review status, compliance status, API usage, webhook topics and subscriptions | Webhook subscription management only | Meta app credentials + MCP-compatible coding agent; developer-facing (not ad-management) | Open |
| Meta Ads MCPOpened to third parties 16 Jul 2026 | Campaign performance, signal diagnostics, activity logs, audience lists, catalog data, A/B test results | Campaign creation, editing, deletion; audience management; catalog management; conversion lift studies; portfolio governance rules | Developer app with ads_mcp_management permission; agencies need Advanced Access + app review. Server: mcp.facebook.com/ads | Open (third-party) |
| Snowflake managed MCPGenerally available since Nov 2025; announced as part of Cortex AI for Financial Services (Oct 2025) | Cortex Analyst (NL-to-SQL on structured data); Cortex Search (unstructured retrieval); Cortex Agents (nested orchestration); SQL SELECT with read_only=true (default) | SQL write operations if read_only explicitly disabled; Cortex Agent actions within configured scope | Snowflake account with Cortex features enabled; agent platforms: Claude (Anthropic), CrewAI, Cursor, Cognition (Devin), Windsurf, others | Generally available (since Nov 2025) |
Two things stand out in this comparison. First, the maturity picture has shifted: Microsoft and Meta Ads are live and accessible; Snowflake's managed MCP server reached general availability in November 2025, making all three production-grade connections as of mid-2026. Second, the write scope diverges sharply. Microsoft's pilot is deliberately locked at read-only. Meta Ads ships with full write capabilities on day one. Snowflake defaults to read-only SQL but can be enabled for write. These are not equivalent governance situations, and treating them as interchangeable in a team's risk framework is the fastest path to an unintended campaign modification at scale.
Pre-connection governance checklist
Run through this before connecting any MCP surface to an account with live spend or production data. The checklist applies regardless of which platform you are connecting. Items marked as critical apply with particular force to write-capable connections.
Before you connect: 10 governance questions
Work through each item with the relevant stakeholder before the connection goes live. Write-capable connections require items 1-10. Read-only connections can defer items 5 and 6, but not skip them.
-
Start read-only. Can you accomplish the first use case with a read-only connection? If yes, lock it there until you have validated the read-only integration end-to-end. Do not enable write access speculatively.
-
Minimum-privilege credentials. Does the service account or developer app used for the MCP connection hold only the permissions strictly required? Remove admin or broad account access before connecting. For Meta: does the app need Advanced Access on ads_mcp_management, or can the initial use case work with standard access?
-
Which accounts and warehouses are in scope. List explicitly which ad accounts, Snowflake databases, or platform accounts the agent is permitted to access. State which accounts are permanently out of scope (for example, regulated-product accounts, accounts holding sensitive audience lists, high-spend accounts above a budget threshold).
-
Audit logging cadence. Where does the platform log agent-initiated actions? Who reviews that log, on what cadence, and against what baseline? If no baseline exists, define one before the connection goes live.
-
Human approval boundaries for write actions. Which write actions require a human approval step before the agent executes them? Budget changes above a threshold, audience list creation, campaign launches, and catalog modifications are candidate boundaries. Define them in writing before connecting.
-
Regulated-sector compliance check. If the connected account runs financial products, health, or insurance advertising in Singapore, Australia, Canada, or the US, does the agent's write capability interact with any content or audience that requires local regulatory sign-off before changes go live? If yes, the human approval boundary in item 5 must cover that category explicitly.
-
Data residency and training-data confirmation. When the agent queries campaign data or warehouse data via MCP, where does the AI assistant process that data? Does your subscription confirm data is not used to train models? For PDPA (Singapore), the Australian Privacy Act, PIPEDA (Canada), or GLBA (US), does the processing location meet your obligations?
-
Blast-radius limit. If the agent executes an erroneous write action, what is the maximum spend or data impact before someone notices? Is there a platform-level budget cap, a daily spend limit, or an audience-list size limit that bounds the damage? If not, add one before enabling write access.
-
Incident response path. If an agent makes an unintended change, who is the first call, what is the rollback procedure, and how quickly can you disconnect the MCP server? Document this before the first write-capable connection goes live, not after an incident.
-
Forward-governance plan. MCP server capabilities will expand. Microsoft's read-only pilot will eventually offer write access. Snowflake's preview will reach GA. Meta will extend the tool set. Decide now whether your governance framework needs to be updated each time a new capability is added, and assign ownership of that update process.
Why governance is now the bottleneck, not the technology
For most marketing teams, the constraint is no longer whether the connection exists. It exists. The constraint is whether the team has answered the questions that should precede a connection.
An AI agent with read access to a live ad account can do useful things with no human in the loop: pull performance summaries, flag anomalies against a threshold, compare periods, surface signals the analyst would have caught on Monday morning. That is low-stakes. The same agent with write access can pause campaigns, adjust budgets, create audiences, modify catalogs, and run creative variations. Done well, that is genuine operating leverage. Done without controls, it is a multi-thousand-dollar mistake that might take 48 hours to discover in reporting.
The governance gap that most teams are walking into is not malice or carelessness. It is speed. MCP connections can be set up in minutes on some platforms. The governance framework to support a write-capable agent typically takes days to design and longer to operationalise. Teams that connect first and govern later will find that the agent's blast radius arrives before the controls do.
Three structural issues need attention before connecting any MCP surface with write capabilities:
Credential scope
MCP connections authenticate with whatever permissions the developer app or service account holds. If that account has admin access, the agent has admin access. Minimum-privilege credential design is not optional; it is the first line of defence against both error and misuse.
Audit trails
Activity logs exist on the platform side (Meta's Ads MCP exposes them; Microsoft Advertising logs API calls in the platform). But those logs are only useful if someone reviews them on a cadence and if the organisation has established a baseline for what normal AI-agent activity looks like. Without a baseline, anomaly detection is aspirational.
Human approval boundaries
For marketing teams in regulated sectors in Singapore, Australia, Canada, or the US, some campaign decisions require documented human approval before execution. An AI agent that can create audiences or modify budgets without a human checkpoint does not eliminate that requirement; it shifts it to a process control that must be enforced outside the platform.
The Snowflake financial services variant adds a data-layer version of the same question. When an agent can run NL-to-SQL against MSCI or Nasdaq eVestment data alongside proprietary client data, the question is not whether the query returns accurate results. The question is whether the organisation has established which data the agent is permitted to query, in what combinations, and under which authorisation framework.
There is also a vendor-maturity question that marketing teams underweight at this stage of MCP adoption. The Meta Ads MCP server is backed by Meta's own infrastructure and has been through Meta's internal security review. Snowflake's managed MCP server sits on Snowflake's infrastructure and benefits from Snowflake's existing enterprise security controls.
These are not the same as third-party MCP connectors built by tool vendors or individual developers and offered as plugins or integrations. When evaluating any MCP connection, ask one question first: who hosts the server? First-party servers keep the data residency and authentication logic under the platform's own controls. Third-party connectors introduce an additional intermediary whose security posture and data-handling commitments require independent evaluation. Different trust problem. Different diligence.
For marketing teams in Singapore and Malaysia managing campaigns on behalf of financial services clients, the intersection of MCP write capabilities and MAS TRM (Technology Risk Management) guidelines is worth flagging. MAS TRM requires that banks and licensed financial institutions assess third-party systems that process or have access to material data.
An MCP server connection that touches campaign data linked to a financial institution's customer acquisition activity may fall within that assessment scope. The appropriate question to resolve, before connecting, is whether the MCP server and the AI assistant it connects to have been assessed under the institution's TPRM framework. This is not a prohibition. It is a process gate that needs to be in place before production connections go live.
What marketing operations can actually do with this now
Read-only connections are where to start, and the use cases are not trivial. A connected agent that can query live campaign data from Microsoft Advertising or pull Cortex Analyst NL-to-SQL results from a Snowflake data warehouse eliminates a substantial amount of manual reporting work. Morning performance summaries, anomaly flags against defined thresholds, cross-channel spend pacing checks, and pre-meeting briefing documents are all tasks that can move from analyst hours to agent minutes with a read-only MCP connection.
The more interesting near-term use case is the combination layer. An agent connected to Snowflake can query first-party audience data and warehouse analytics in natural language. The same agent, connected to Meta Ads MCP in read mode, can pull campaign performance on the same audiences. The synthesis of those two data streams, without anyone manually exporting CSVs or writing SQL, is a meaningful compression of the analysis cycle. This is the use case leapbuzz associates with the broader shift toward agentic marketing operations.
Write-capable connections require more than just technical confidence. The marketing teams that will use Meta Ads MCP's full write capabilities well are those that have already done the governance work: defined which agents can touch which accounts, established budget caps and change-log review procedures, and confirmed that their agent tool subscriptions include appropriate data-handling commitments. Teams in regulated sectors in Singapore, Australia, Canada, or the US have additional questions to answer before any agent-initiated campaign change can proceed without human review.
The agent-run campaign in the sense of fully autonomous campaign management from brief to flight, with no human approval loop, is still speculative for most organisations. The agent-assisted campaign, in which agents handle reporting, anomaly detection, and draft optimisation recommendations that a human confirms, is real today. The gap between those two descriptions is exactly the governance gap this post is about.
For teams operating across the five markets leapbuzz serves, the practical constraint to resolve first is usually data residency. An agent processing Singapore campaign data through a US-hosted AI assistant raises PDPA questions. An agent touching Australian financial-product campaign data raises Privacy Act questions. Neither of these is a blocker, but both require documented answers before connecting production accounts. The same applies to Canadian PIPEDA obligations and US GLBA requirements for financial-sector clients.
One pattern worth building toward is staged connection rollout. Start with a single, non-critical account on a read-only MCP connection. Spend two to four weeks logging what the agent actually queries, validating the data it returns against manual pulls, and understanding where it surfaces value versus where it surfaces noise.
That validation cycle is cheap when the account is small and the connection is read-only. It is expensive when skipped and the connection is write-capable on a high-spend account. Teams that rush to production write access on the grounds that "the technology is ready" usually discover that their internal processes were not.
The Snowflake connection deserves separate treatment for teams using it for marketing analytics rather than financial services data. A Snowflake data warehouse holding first-party customer data, media spend, and attribution results is a high-value target for an NL-to-SQL agent precisely because the queries that analysts want to run are complex and time-consuming to write manually.
The Cortex Analyst natural-language interface significantly lowers the barrier to running those queries. But it also means that whoever controls the agent prompt can effectively query any data the agent has access to, in natural language, without writing a line of SQL. Role-based access control within Snowflake becomes the primary enforcement mechanism for what the agent can see, and that access design needs to be as deliberate as it would be for a human analyst.
What to watch as this matures
Three developments will determine whether MCP becomes the dominant agent interface for marketing operations or stays a niche tool for technically sophisticated teams. The July 2026 cohort of announcements is not a ceiling; it is a starting point. What matters is the trajectory.
The first is Google. Google Ads has no first-party MCP server. Google's investment is in in-platform AI, with tools like AI Max operating within the Ads UI rather than exposing data to external agents. If AI assistants consolidate as the primary work interface for marketing operations over the next 12 to 18 months, the absence of a Google Ads MCP server becomes a structural disadvantage for operators who want a unified agent interface across platforms. Watch for a Google announcement in the 6 to 12 month window.
The second is Microsoft's write upgrade. The current Microsoft Advertising MCP pilot is read-only by design. The read-only constraint is correct for a pilot: it limits blast radius while the industry learns what the connection is useful for. A write-capable Microsoft Advertising MCP would change the competitive dynamics and add a second high-volume ad platform to the write-capable stack alongside Meta. See the Microsoft Advertising MCP post for a fuller treatment of what to expect.
The third is Snowflake integration maturity. The managed MCP server reached general availability in November 2025, so the API surface is now stable for production integrations. The near-term focus for teams using it is validating the financial services data-partner integrations, specifically MSCI, Nasdaq eVestment, FactSet, and AP, on real query workloads and confirming that Snowflake role-based access controls are scoped correctly before connecting production agent workflows.
For the broader question of AI governance in marketing data systems, the LLM marketing data risks post covers the structural issues that apply beyond MCP specifically. The AI marketing stack audit provides a framework for mapping where these connections fit within an existing marketing technology architecture before connecting them.