Nothing leaves your machine
Runs locally against your own Google Cloud project and credentials. No hosted proxy, no token custody, no account to create with us. You can read every line.
Why AdRails
Hand your agents the wheel.
Hand your agents the wheel.
Keep your hands on the rails.
Agents are great at ad ops: search terms, negatives, budgets, pacing, 24/7. They're also one bad loop away from a burned budget. AdRails turns "the AI can touch my ad account" from a leap of faith into a policy you wrote.
Caps no tool can write
Budget limits, end dates and spend thresholds live in a policy file that no AdRails tool can write. Every real change needs a fresh, single-use plan ID.
No subscription. Ever.
The executor is free and open source. Optional services, like an independent AI second opinion before a commit, are paid per call in sats over Lightning.
How it works
Plan. Prove. Commit.
Every change is a diff against the live account, checked against your policy, then committed exactly once. Reading is free and unlimited; writing walks the rails.
ProposeYour agent asks for a budget, status, end-date or negative-keyword change, with a reason.
ProveAdRails diffs it against the live account and your policy, and issues a single-use, expiring plan ID.
GateChanges that add spend exposure are refused while the scheduled guard isn't running.
CommitGoogle validates first, then it lands exactly once. Ambiguous failures are reconciled, never retried.
The rails
Eight rails, all in code.
Not prompts. Not "please be careful." Each one is enforced by the executor and covered by its test suite: 393 checks today.
01
Caps in a file agents can't write
Max daily budget, end date, daily and lifetime pause thresholds, ops per run.
02
Single-use plan IDs
A commit must quote the exact plan it was shown. Changed, reused or expired plans are refused.
03
Fail closed when nobody's watching
Budget raises, re-enables and end-date extensions are blocked while the guard heartbeat is stale.
04
Pause-only spend guard
A scheduled guard pauses on threshold breach. It can never enable or raise anything.
05
Validate before every commit
Google checks the identical payload in validate-only mode first. Nothing lands if that fails.
06
Reconcile, never blind-retry
If Google times out mid-commit, AdRails re-reads the account and reports what actually landed.
07
Every change has a reason
Agent changes are committed to git with their stated reason, and every call is metered and audited.
08
Protected terms
List the keywords that pay your bills. No negative keyword that would block them gets through.
Read this part
We'd rather lose a sale than sell you a fantasy.AdRails reduces risk. It doesn't remove it. Here's exactly where the edges are, so you can decide with your eyes open. You run it at your own risk; you own your account and your spend.
- A threshold, not a hard spend ceiling. Caps bound what AdRails submits. Google can deliver up to 2× your average daily budget on a given day, and reporting lags.
- The guard only acts when it runs. If your machine sleeps, nothing is watching. Spend increases get blocked, but live spend can continue.
- Local tools can be bypassed. An agent with shell access as the same OS user can edit files or call Google directly. Run the executor as its own user.
- Negatives cut both ways. A wrong negative keyword suppresses traffic you wanted. Protect your core terms.
Pricing
Free to run. Sats when you want more.
No subscriptions, no seats, no account with us. Pay only for the calls your agents actually make, in sats over Lightning.
The executor
AdRails core
$0 forever · Apache-2.0
- All eight rails, every tool
- Runs on your machine, your keys
- Scheduled pause-only guard
- Pairs with Google's official read-only MCP
Optional services
Pay per call COMING SOON
⚡ sats · Lightning (L402) first
- Independent AI second opinion on a plan before it commits ~300–1,500 sats
- Pause alerts to Telegram, Slack or SMS ~20–50 sats
- Audit-log anchoring to Bitcoin ~20–100 sats
- Never touches your Google credentials, and never proxies Google calls
Quickstart
Rails on in five minutes.
- Bring your own Google access
A Google Cloud project with the Google Ads API enabled, and a service account added to your Ads account.
- Write your policy
Caps, end date, pause thresholds, protected terms. This is the file no AdRails tool can write.
- Register the MCP server
Add AdRails to Claude Code (or any MCP client) and schedule the guard from
deploy/. - Let the agent drive
It reads freely and writes through plan → prove → commit. You read the git log.
.mcp.json
{
"mcpServers": {
"adrails": {
"command": "python3",
"args": ["-m", "adsops", "--config", "adrails.json"]
}
}
}
policy.json
{
"customer_id": "123-456-7890", "campaign_id": 9876543210,
"guards": { "max_daily_budget_usd": 25, "max_end_date": "2026-12-31",
"daily_spend_pause_usd": 60, "lifetime_spend_pause_usd": 1000,
"max_ops_per_run": 50 },
"allow_enable": true, "require_plan_id": true, "max_guard_age_min": 30,
"protected_terms": ["your brand", "your best keyword"]
}
FAQ
Straight answers.
What is AdRails?
AdRails is an open-source (Apache-2.0) MCP server that lets AI agents such as Claude Code or Cursor operate Google Ads accounts inside caps that no AdRails tool can change. It runs on your own machine with your own Google credentials.
Is there a Google Ads MCP server that can make changes safely?
Google's official google-ads-mcp server is read-only. AdRails adds guarded writes: budget, status, end-date and negative-keyword changes go through a policy file the agent cannot write, a single-use plan ID, Google validate-only checks and a pause-only scheduled guard. It reduces risk; it does not remove it.
Can AdRails guarantee my agent won't overspend?
No. AdRails caps what it submits, but Google can deliver up to 2x the average daily budget on a given day and reporting is delayed. It is a threshold with automatic pause attempts, not a hard spend ceiling.
Does AdRails host my Google Ads credentials?
No. AdRails runs locally against your own Google Cloud project. There is no hosted proxy and no token custody, which also follows Google's policy that each business uses its own Cloud project and access.
How much does AdRails cost?
The core executor is free forever under Apache-2.0. Optional services, such as an independent AI review of a change plan before it commits, will be paid per call in sats over Lightning. There are no subscriptions.
Which AI clients work with AdRails?
Any MCP client that runs local stdio servers. It's verified with Claude Code and designed for Cursor, Claude Desktop and custom agents.
Let them drive.
Keep the rails.
Open source. Your keys. Your caps. Paid per call in sats.