Account scoping
Which advertising accounts a tool can reach, and how that limit is enforced.
Connecting a platform rarely grants access to one account. A Google Ads manager account reaches every client under it, a Meta Business Manager reaches every ad account it administers, and one Google Analytics connection in testing reached fourteen properties.
So the connection is not the permission. In the dashboard you tick the accounts to expose, and that list is the boundary.
Where the check happensLink to this section
Server side, on every call, before the request reaches the platform. It cannot be influenced by the client, because an MCP client composes its own calls and can propose any identifier it likes.
The account parameter each source uses
| Source | Parameter |
|---|---|
| Meta Ads | adAccountId |
| Pinterest Ads | adAccountId |
| Google Ads | customerId |
| TikTok Ads | advertiserId |
| Search Console | siteUrl |
| Google Analytics 4 | propertyId |
The check does not stop at that parameter. Some tools are generic escape hatches that take a free-form body, and an account identifier can sit anywhere inside it. Every argument is walked, at any depth, and every account identifier found is checked against the allowlist.
{
"name": "tiktok_get_read_endpoint",
"args": {
"endpoint": "campaign/get",
"parameters": { "advertiser_id": "an advertiser you did not tick" }
}
}TokensLink to this section
- Refresh and access tokens are encrypted at rest with AES-256-GCM.
- No tool returns a token, and none is written to a log.
- No token reaches the browser.
- Revoking the connection in the dashboard, or at the platform, ends the access immediately.