OAuth only
No passwords, no API keys pasted anywhere. You sign in with MegaMCP, Google and Meta directly, and can revoke any of it in one click.
Security
Paranoid by design.
You're handing an AI the keys to your ad accounts. Here's exactly how MegaMCP keeps those keys safe, and keeps the AI on a leash.
Last updated:
Encrypted tokens
Platform tokens are encrypted with AES-256-GCM, with versioned keys for rotation, and bound to the database row they belong to.
Humans approve
Your AI can only propose. Every change is a plan with a diff that waits for a person, and budget bumpers can block it outright.
Undo
Every applied change records how to reverse itself. Undo is its own plan, with its own diff and approval.
Flight recorder
Every tool call, plan, approval, connection and billing event is logged with who did it and from which AI app.
No training
We never use your data or your platform data to train AI models. Report data passes through; we don't keep it.
How your AI connects
- OAuth 2.1 with PKCE (S256 only). Each person signs in to MegaMCP in their browser and picks a workspace. The AI app never sees a password.
- Tokens are scoped to MegaMCP's MCP endpoint (resource indicators, RFC 8707), so a token issued for MegaMCP is useless anywhere else.
- Short-lived access tokens (1 hour) with refresh tokens that rotate on every use (30 days max). If an old refresh token or authorization code is replayed, we treat it as theft and revoke that connection.
- Role checks on every call. Each tool call re-checks the person's membership, role and the workspace's plan. Viewers can't propose or approve changes.
- Origin checks and rate limits on the MCP endpoint to block DNS-rebinding attacks and runaway clients.
- Revoke anytime from Connect AI in the dashboard. It takes effect immediately.
How we connect to Google and Meta
Through each platform's official OAuth flow, protected by a signed, single-use state value (and PKCE where the platform supports it). After you connect, every account starts switched off; your AI only sees the accounts an admin switches on. We request only the scopes MegaMCP's features use:
| Scope | Why |
|---|---|
openid | Identify which Google account you connected. |
email | Show which Google account a connection belongs to. |
adwords | Google Ads API access. Google offers only this one scope; MegaMCP's own approvals decide what actually changes. |
analytics.readonly | Run GA4 reports. |
analytics.edit | Mark events as key events (only after you approve the plan). |
webmasters | Read Search Console performance, inspect URLs, submit sitemaps (after approval). |
tagmanager.readonly | Read and audit Tag Manager containers. |
tagmanager.edit.containers | Create and pause tags in a workspace (after approval). |
tagmanager.edit.containerversions | Create a container version so a workspace can be published. |
tagmanager.publish | Publish a workspace, always as its own approved plan. |
Meta
| Permission | Why |
|---|---|
ads_read | Read campaigns, ad sets, ads and insights. |
ads_management | Make the changes you approve (pause, budgets, duplicate, create paused ads). |
business_management | Find ad accounts owned by your Business Manager. |
Google lets you untick individual permissions on its consent screen. MegaMCP tells you which features a partial grant affects.
Encryption and secrets
- Platform tokens are encrypted at rest with AES-256-GCM. Keys are versioned: new data is encrypted with the newest key while older keys can still decrypt, so keys can be rotated without downtime.
- Row binding. Each ciphertext is bound to the connection and purpose it belongs to (authenticated additional data), so an encrypted token copied into another row simply fails to decrypt.
- We store only hashes of our own secrets. Session cookies, sign-in links and the OAuth tokens we issue to AI apps are stored as SHA-256 hashes. A database leak wouldn't hand anyone a working session.
- In transit, everything is served over HTTPS with HSTS.
- Never logged. Tokens and secrets are kept out of logs, error messages and the flight recorder.
Changes are gated
- Plans, not actions. Write tools read the live state and return a plan with before and after values. They can't touch the platform.
- Human approval, in the dashboard by default. If an admin opts in, a connection can also apply its own plans in chat after an explicit yes, but never workflow plans or uncapped spend increases.
- Budget bumpers are checked when a plan is proposed and again right before it's applied. Blocked plans can't be applied by anyone.
- Applied at most once. A plan flips from pending to applying atomically, so a double click or a retried request can't apply it twice.
- Stops on the first failure, and skips the rest, so you never get half a plan you didn't expect.
- Plans expire after 24 hours, because the live account may have moved on.
- Safe defaults: new Google Ads campaigns and new Meta ads are created paused, and Tag Manager publishing is always its own plan.
Audit log
The flight recorder logs every tool call (with its arguments), plan, approval, rejection, change, undo, connection, team change and billing event, with the person and the AI app behind it. It's searchable in the dashboard and admins can export it as CSV.
Application security
- A strict Content Security Policy: no inline scripts, no third-party scripts, no framing.
- CSRF tokens on every form that changes anything, and
HttpOnly,SameSite,Securecookies. - Parameterized SQL everywhere, and every query scoped to your workspace.
- Rate limits on sign-in, sign-up and the MCP endpoint.
- Stripe webhooks are verified by signature; card details go to Stripe, never to us.
- Automated tests for the security-critical paths: OAuth, encryption, the change engine, guardrails and workspace isolation.
Your data
We don't sell your data and we never use it (or data from Google or Meta) to train AI models. Report data your AI requests is passed through and not stored. Google data is handled under Google's API Services User Data Policy, including the Limited Use requirements. The full story is in our Privacy Policy.
Subprocessors
| Provider | Purpose |
|---|---|
| Railway | Application hosting and managed Postgres database |
| Stripe | Subscription billing and payments |
| Resend | Transactional email (sign-in links, invitations, workflow emails) |
| Google APIs | Google Ads, Analytics, Search Console and Tag Manager, at the customer's direction |
| Meta Platforms | Meta Marketing API, at the customer's direction |
Responsible disclosure
Found a vulnerability? Email security@megamcp.com with what you found, steps to reproduce, and the impact you think it has. We'll acknowledge your report, keep you updated while we fix it, and credit you if you'd like.
Please test only against your own account and workspace, don't access or modify other people's data, don't degrade the service (no denial-of-service or spam), don't use social engineering, and give us reasonable time to fix the issue before disclosing it. If you follow these guidelines in good faith, we won't pursue legal action against you for your research.
Machine-readable contact details: /.well-known/security.txt.
Questions
Can MegaMCP staff see my ad accounts?
We don't browse customer accounts. Platform tokens are encrypted and only used to run the tools you and your AI call. We'd only look at your data with your permission (for example, in a support request), for security investigations, or when the law requires it.
What if my AI app gets tricked by a prompt injection?
It still can't change anything on its own. Write tools only create plans; applying one needs a human approval, budget bumpers still apply, and approvals in chat are off unless an admin turns them on. MegaMCP also tells the AI to treat platform data like search terms and page titles as untrusted, never as instructions.
What happens to my tokens if I disconnect?
They're wiped from our database immediately and we ask Google or Meta to revoke them. The accounts are switched off.
Do you have SOC 2?
Not yet. We're an early-stage company and we'd rather tell you that than wave a badge. Ask us for our security questionnaire answers at security@megamcp.com.
14 days. On the house.
Put Mega to work.
Your soul stays yours. So does your ad budget.
No credit card to start. Every workspace comes with a sandbox ad account, so you can watch the whole ask, diff, approve, undo loop before you connect anything real.