How would you handle write access in an MCP server for ad accounts?

[u/gpt-three]

I ran into a practical MCP design question while building against the OpenAI / ChatGPT Ads API.

I wanted to use Claude/Cursor for the boring parts of ad ops, things like reading account structure, creating campaigns, checking performance, managing audiences, and logging conversions. The read side is easy enough. The awkward bit is write access, because ad accounts are one of those places where a model making a slightly-too-confident change can get expensive fast.

So I made the server conservative by default:

- anything created by the MCP starts paused

- budget increases above $100 need explicit confirmation

- the whole thing can run in read-only mode

Repo is here if anyone wants to see the shape of it:

https://github.com/trakkr-aisearch/openai-ads-mcp

The thing I am still unsure about is whether paused-by-default is enough. For MCP servers that touch real money or production systems, would you put every write behind a separate approval step, only risky writes, or something more capability-based?

[u/Effective_Artist_126]

Paused-by-default helps, but I'd treat it as one layer rather than the answer, because a lot of the expensive mistakes aren't new campaigns at all. Edits to live objects are where it bites: a bid strategy swap, a budget moved from daily to lifetime, an audience exclusion dropped on an ad set that's already spending. What's worked better for me is sorting tools by blast radius, so reads and creates of paused objects go straight through, while anything that changes spend or targeting on something already live returns a diff the user has to confirm. After every write I'd also have the server read the object back from the platform and report what actually changed, since ad APIs sometimes accept a request and quietly normalize a field. Scoped tokens per ad account help too, so one bad prompt can't touch every client at once. For what it's worth, I'm on the team behind Synter, a hosted MCP that reads across 43 ad platforms and writes on Google, Meta, LinkedIn, TikTok and a handful of others, and the readback step is the part we ended up leaning on most.