X launched X Ads MCP on August 24, 2026, a remote Model Context Protocol server built into the company's API gateway that exposes 23 advertising tools to any MCP-capable client. Ten of those tools write to live accounts. Every campaign and line item they create arrives paused.

The server sits at a single endpoint, ads-api.x.com/mcp, and it removes the step that has historically stood between an advertising API and a language model: the custom client code. According to X's developer documentation, any MCP-capable client, whether Grok, Claude Code or a custom agent built on the protocol's software development kits, can connect and immediately use the full tool set with no bespoke Ads API integration. Tool discovery happens automatically through a standard protocol call. The MCP client handles the plumbing.

That framing matters more than the marketing language around it. The announcement, distributed by X on August 24, 2026, describes advertisers describing what they want in plain language inside an AI chat interface: launching a campaign, checking performance, pausing underperforming ads, scaling what works, adjusting creative or budgets. The documentation published alongside it is considerably more specific about what the agent can and cannot touch, and about the exact conditions under which a connection fails.

What the 23 tools actually do

The server organises its capabilities into four categories, and the distribution across them is the clearest signal of how much authority X has handed to external software.

Nine tools sit under accounts and reads: list_ads_accounts, list_campaigns, get_campaign, list_line_items, list_funding_instruments, list_promoted_posts, list_targeting_criteria, list_account_posts and get_active_entities. These are inventory functions. They enumerate what exists in an account and return its current state.

Two tools handle analytics: get_account_stats and get_campaign_reach. The first pulls performance figures, the second returns reach estimates. Two more cover targeting search: search_targeting_interests and search_targeting_locations, which resolve plain-language descriptions into the identifiers the underlying API requires.

The remaining ten are writes. They are create_campaign, update_campaign, activate_campaign, create_line_item, update_line_item, activate_line_item, add_targeting_criterion, remove_targeting, create_ad_post, documented as a nullcast operation, and promote_post. This is the set that changes the state of a live advertising account, and it includes activation, which is the function that starts spending.

The proportion is worth stating plainly. Just under half of the exposed surface can modify an account rather than describe it.

Paused by default

X constrained that write capability with a single structural rule. According to the documentation, campaigns and line items are always created in a paused state, and nothing spends money until it is explicitly activated. The company repeats the constraint at the end of the setup guide, in the section covering the first test of the write flow.

The suggested test itself is instructive about how the system is meant to behave. The documentation proposes asking an agent to create a paused campaign named Test campaign with a daily budget of 10 dollars, then add a paused line item carrying a website clicks objective and a bid of 1 dollar targeting users in the United States. The model chains the required tools itself, moving from a funding instrument lookup to campaign creation to line item creation to targeting, from one plain-English request.

That chaining is the operational point. A media buyer issuing a single sentence triggers a sequence of four distinct API operations, each of which would previously have been a separate call written by a developer or a separate set of clicks in the interface. What the paused default preserves is a human checkpoint at the end of the sequence rather than at each step within it.

Governance postures across advertising MCP implementations diverge sharply, and X has landed between the two established poles. Google and Amazon both launched read-only. Meta shipped write access from the first day in April 2026, allowing agents to create and edit ads, ad sets and full campaigns. Adform scoped its FLOW DSP release to 29 read-only skills in July 2026, stating the limitation repeatedly as a design choice. X grants writes but withholds automatic activation, a middle position that keeps the agent's most consequential action behind a deliberate human step.

Authentication runs on the advertiser's own token

The access model is bounded by the user rather than by the application. According to X, authentication uses the user's own OAuth2 token, so an agent only ever sees the advertising accounts that the person signing in can already access. There is no separate service identity and no broader permission grant that could expose accounts outside the user's existing reach.

Three scopes control what the connection can do. The ads.read scope grants the read and analytics tools. The ads.write scope grants campaign and creative writes. The offline.access scope enables token refresh, and the documentation is direct about the consequence of omitting it: tokens expire in roughly two hours with no way to refresh them.

A read-only agent is therefore a configuration choice rather than a product tier. Dropping ads.write from the scope list produces an agent that can browse and analyse but cannot create or change anything; write tools return authorization errors. Every client recipe in the documentation shows where that decision is made, and the Grok web connector requires an extra step, because Grok pre-fills scope chips from the server's own discovery metadata and the documentation instructs users to delete the pre-filled set and keep only the three named scopes.

Token lifecycle details follow the same pattern of specificity. Access tokens last around two hours. Refresh tokens rotate on use, meaning the newest one must be retained. A 401 response indicates an invalid or expired token; a 403 means the application has not been enrolled for Ads API access.

Setup carries several hard constraints

Registration runs through the X Developer Console, where an application needs read and write permissions and, in the recommended configuration, must be a native app operating as a public client. Confidential clients, meaning web apps, automated apps or bots, work for the Grok command-line build and for manual token minting, provided they authenticate using client_secret_basic. The documentation states that client_secret_post is rejected by X.

That single line has a direct consequence for one of the named clients. Claude Code sends client_secret_post, so it requires a public client. X documents the exact command to register the server, the callback port and the client identifier, and notes that there is no command-line flag for scopes: by default Claude Code requests whatever the server advertises, and narrowing to read-only requires editing a configuration file to supply a space-separated scope string.

Callback registration differs per client, and the differences are not cosmetic. Grok on the web uses a hosted exchange URL. The Grok command-line build requires the loopback address 127.0.0.1 on port 8080, and the documentation specifies that localhost will not work in that position. Claude Code and the manual token flow both use localhost on the same port. The Grok build configuration adds a further trap: the OAuth keys must be written in camelCase, because snake_case keys are silently ignored.

One constraint has organisational rather than technical consequences. X keeps a single live OAuth grant per application and user pair, which means signing in from a second client revokes the first client's tokens. The documented workaround is one client per X application, with a separate application created for each client an organisation wants to run simultaneously. An agency running a read-only analyst agent alongside a write-capable execution agent on the same credentials would find the first knocked offline by the second.

Manual token minting, for teams whose client only supports a static authorization header, carries its own timing constraint. After authorization, the browser lands on a dead callback page, and the code in the address bar must be exchanged within roughly 30 seconds.

A competitor's coding agent in X's own documentation

The press announcement names Grok and, generically, other MCP-compatible agents. The documentation is less circumspect. Claude Code, built by Anthropic, receives a dedicated setup section with its own registration command, its own callback URL and a specific note about the authentication method X rejects. The page title itself invites connections from Grok, Claude Code and other AI tools.

Anthropic created the Model Context Protocol in November 2024 and later donated it to the Linux Foundation. The standard's neutrality is the mechanism by which a platform owned by one AI company ends up publishing a working recipe for a rival AI company's agent, and the same dynamic has played out elsewhere: Meta's April 2026 connectorswere built for Claude and ChatGPT, and Amazon's server supported Claude, ChatGPT, Amazon Q and Amazon Bedrock from its closed beta in November 2025.

Transport details and the specification rewrite

The Ads MCP server uses Streamable HTTP transport. All requests are HTTP POST carrying JSON-RPC payloads, and responses are framed as server-sent events. Tools are discovered automatically through a tools/list call, and the documentation supplies a curl command that verifies both token validity and connectivity without any client at all; a successful response enumerates the server's tools.

The transport choice places the server on the current side of a protocol change that has forced work across the sector. The 2026-07-28 MCP specification removed protocol-level sessions entirely, replacing sticky-session routing with self-contained requests, and hardened OAuth handling against a class of mix-up attack the maintainers described as more prevalent in the protocol's one-client-many-servers deployment pattern than in ordinary single-server authentication. Platforms that had been running sticky-session, shared-store infrastructure faced a rebuild. A server launched in late August 2026 arrives after that reckoning rather than into it.

Where the announcement and the documentation part company

Two details in the source material do not align, and both are worth recording.

The press announcement identifies Monique Pintarelli as Head of Global Advertising at SpaceXAI. Prior coverage of X's advertising organisation, including the April 30, 2026 platform rebuild, identified her as Head of Global Advertising at xAI, the title she also held when she stated at CES in January 2026 that 97 of the top 100 advertisers had returned to the platform. The corporate entity naming has shifted; the role has not.

The second gap concerns measurement. The announcement says the capability lets advertisers create, manage, optimise and measure campaigns. The documented tool set contains exactly two analytics functions, get_account_stats and get_campaign_reach. Account statistics and reach estimates are performance reporting rather than measurement in the attribution or incrementality sense, and no conversion, attribution or lift tool appears in the published capability table. That gap echoes a question raised under the April 2026 Ads Manager rebuild announcement, where a commenter asked specifically about a server-side conversions API and received no answer in the announcement itself.

The quotes

Pintarelli described the release in terms of workflow relocation rather than new capability. According to the announcement, the server brings "full-funnel campaign management directly into the AI tools they already use". She added that advertisers can now "optimize faster, reduce friction, and build more advanced AI-driven workflows".

No performance data, pricing information, availability window or advertiser count accompanies those statements. The documentation carries no rollout schedule, no regional restrictions and no beta designation. The endpoint is live, the scopes are published, and enrolment runs through the existing Ads Project access flow in the developer console.

Context: the adoption curve reaches X

X arrives late to a pattern that has been building for more than a year. Google's Ads API team floated the idea of an MCP server in July 2025 and released an open-source read-only implementation on October 7, 2025. Amazon Ads opened a closed beta on November 13, 2025 and moved to open beta on February 2, 2026. TikTok launched an Ads MCP server and developer toolkit at TikTok World on May 13, 2026. Meta opened its ads MCP server to any developer holding a Meta app on July 16, 2026, removing the build step rather than adding a feature, and separately shipped a read-only Developer Tools server whose single write capability is webhook subscription management. Snap opened its ads platform to third-party agents through the same protocol.

The protocol layer above these servers remains contested. The Ad Context Protocol launched on October 15, 2025 with six founding members and 23 additional launch participants, built on MCP, and drew immediate scepticism about its media buying applications. IAB Tech Lab's competing Agentic Advertising Management Protocol overlaps with AdCP on thirteen functions, a count published on August 20, 2026. X's server sidesteps that argument entirely by speaking plain MCP, the general-purpose plumbing that some buyers have adopted directly without any advertising-specific layer.

Why this matters for media buyers

The change is narrower than the phrase AI agent suggests, and narrower is not the same as trivial.

Nothing about delivery, bidding or pacing on X changes because of this release. The Ads API remains the execution surface. What moves is the interface: a set of operations that previously required either the Ads Manager interface or custom integration code now answers to natural language from a client the buyer may already have open. For agencies running many accounts, the saving is concentrated in the repetitive reporting and setup work rather than in strategy.

The paused-by-default rule bounds the downside of a misinterpreted instruction, but it does not eliminate it. An agent with ads.write can still update an existing campaign, adjust targeting on a running line item and activate what it created. Activation is a tool, not a manual step outside the agent's reach; the constraint is that activation must be requested rather than inferred. The distinction between a human approving each change and a human approving a batch of chained changes is precisely where oversight concerns have concentrated across the sector, and it is the reason PubMatic built guardrails to block agents from unapproved inventory rather than relying on instruction quality alone.

Audit trails present the harder problem. When an analyst connects a personal assistant directly to an advertising MCP endpoint rather than through a governed path, the record of a campaign change sits with the platform rather than with the buyer. Cloudflare shipped gateway controls in August 2026 aimed at exactly that pattern, and security researchers flagged validation weaknesses in MCP implementations as early as July 2025. X's single-grant-per-application rule pushes in an unhelpful direction here, because the workaround it prescribes, one X application per client, multiplies the number of registered credentials an organisation must track.

Token economics add a further consideration that has only recently become visible. Draft Digital collapsed twelve MCP calls into one buyer agent to stop token burn, a reminder that each chained tool call in a natural-language workflow carries a metered cost. A single sentence that triggers a funding instrument lookup, a campaign creation, a line item creation and a targeting call is four operations against the model's context as well as four against the API.

For buyers weighing whether to connect, the specific facts that determine risk are already published: ten write tools, activation among them, scope-level control over whether any of them load, a two-hour access token, rotating refresh tokens, and one live grant per application and user. The unpublished facts are the ones that will matter over the next quarter. There is no stated rate limit, no disclosed logging behaviour on the platform side and no indication of whether X plans to extend the analytics category beyond account statistics and reach.

X's advertising business has spent 2026 rebuilding. The Ads Manager was replaced from the ground up in a phased rollout beginning in April, described as the most significant overhaul in the platform's twenty-year history, and Grok was deployed as a pre-bid brand safety scoring tool alongside expanded third-party measurement coverage. That rebuild has run in parallel with unresolved trust questions, including the December 2025 Grok image generation failure and the finding that brands avoiding X can purchase its inventory inadvertently through Google Ads extensions. An agent interface lowers the cost of running campaigns on X. It does not alter any of the reasons a brand might have decided not to.

Timeline

Summary

Who: X, the social platform whose advertising organisation is led by Monique Pintarelli, identified in the announcement as Head of Global Advertising at SpaceXAI. The intended users are advertisers, media buyers and agencies running campaigns on X, plus developers building custom agents on the Model Context Protocol.

What: X Ads MCP, a remote Model Context Protocol server exposing 23 X Ads tools across four categories: nine account and read functions, two analytics functions, two targeting search functions and ten write functions. Authentication uses the advertiser's own OAuth2 token across three scopes. Campaigns and line items are always created paused, and nothing spends until explicitly activated.

When: Announced on August 24, 2026. No rollout schedule, beta designation or availability window accompanies the release; the endpoint and setup documentation are published and live.

Where: The server runs at ads-api.x.com/mcp, inside X's API gateway, using Streamable HTTP transport with JSON-RPC requests and server-sent event responses. Documented client recipes cover Grok on the web, the Grok command-line build, Claude Code and manual token minting for custom agents.

Why: The release removes the custom integration layer between AI agents and the X Ads API, allowing campaign creation, management and reporting to happen inside chat interfaces advertisers already use. It places X alongside Google, Amazon, Meta, TikTok and Snap in a sector-wide shift toward agent-accessible advertising infrastructure, and it stakes out a middle governance position: write access granted, automatic activation withheld.