A hosted MCP server is an always-on remote service that exposes ad platform, analytics and CRM data and actions to AI agents through the Model Context Protocol. For a marketer, it lets an assistant inspect connected accounts and request supported changes without running the integration on your laptop.
You're probably already moving between an ad dashboard, an analytics report and a CRM to explain why lead costs have climbed. Giving an agent access can shorten that investigation, but it also raises a harder question: who controls what the agent can change?
Table of Contents
- What a Hosted MCP Server Is and Why It Exists
- How Hosts, Clients and Servers Talk to Each Other
- Ad, Analytics and CRM Connectors You Can Expect
- Security, Permissions and Approval-Gated Changes
- Benefits and Use Cases for Performance Marketers
- How to Set Up a Hosted MCP Server Step by Step
- Choose a Plan and Confirm Your First Change
What a Hosted MCP Server Is and Why It Exists
Think of a hosted MCP server as a hotel concierge desk. Staff hold the keys and check which guest may enter which room, rather than handing every guest a master key. In a marketing workspace, those rooms are ad accounts, analytics properties and CRM records.
The analogy has a limit: putting the keys behind a desk doesn't make the desk secure. The operator still needs to verify identity, restrict access and record what happens.
Anthropic's MCP launch announcement introduced and open-sourced the protocol on November 25, 2024, establishing a common interface between AI applications and external systems. Instead of building a separate integration for every assistant, a provider can expose capabilities through a shared protocol.
Local versus hosted MCP server at a glance
| Factor | Local server | Hosted server |
|---|---|---|
| Where it runs | On the user's own machine as a local process | Online, as a remote service |
| Clients served | Usually one client on one machine | Many clients and workspaces through one endpoint |
| Setup | Install and update a process on each machine | Add a server URL and sign in |
| Credential handling | Stored on each machine | Centralised by the provider, with OAuth or workspace tokens |
| Latency | Lowest, with no network hop | Adds network round trips and needs timeout and retry policies |
| Best fit | Local files, desktop control, offline work | Shared cloud APIs such as ad platforms |
The most important decision isn't installation convenience. It's where the server's authority belongs.
The MCP Blog's local-versus-remote guide distinguishes machine-bound work from shared cloud access. Local files, desktop control, localhost services and attached hardware generally belong near the machine; shared cloud APIs are stronger hosted candidates because an operator can enforce identity, allowlists, credential policies and audit trails at a common entry point.
A hosted server isn't just a website with a login. It's a service that can exercise delegated authority over business systems.
Practical rule: Hosting moves risk from individual laptops to a shared service. Judge that service by its approval gates, logs and recovery controls, not just its availability.
How Hosts, Clients and Servers Talk to Each Other
A restaurant offers a useful way to separate the roles. The host is the dining room where you sit, meaning the AI application. The client is the waiter assigned to a kitchen, meaning a connector inside that application. The server is the kitchen that handles requests for data or actions.
The terminology can be confusing because people often call the whole AI application a client. In the protocol architecture, the client is specifically the connection component inside the host.
The diagram shows the request and response path.
The MCP specification defines the host-client-server architecture, uses JSON-RPC 2.0 for messages, and gives each client one direct, stateful session with one server. A host can maintain multiple clients, allowing an assistant to reach specialised services within the same workspace.
What the server exposes
MCP distinguishes several kinds of capability. For a performance marketer, the practical differences are:
- Prompts: Templates the user selects, such as a structured campaign-review request.
- Resources: Context the application can supply, such as a campaign list or a report. Think of these as reference material rather than instructions to change an account.
- Tools: Executable functions the model can call, such as retrieving daily spend or requesting an ad-set pause.
A tool isn't necessarily a write action. A spend lookup is also a tool, so a provider's tool count tells you little about its operational risk. Inspect what each function can do.
During connection setup, the client and server negotiate supported capabilities. The host also needs to present those capabilities appropriately; a server exposing a feature doesn't guarantee every interface will display it identically. Our client configuration reference covers the connection choices.
Following an account question
Suppose you ask why yesterday's search spend looked wasteful. The host passes the request through its client, and the server runs an authorised read tool against the account.
The response returns with search terms, spend and conversion context. The assistant can then explain which terms deserve investigation in the same chat.
For remote connections, Streamable HTTP carries client messages through HTTP POST and can optionally stream responses through Server-Sent Events. That transport connects the pieces; it doesn't decide whether a recommended campaign change is sensible or authorised.
Ad, Analytics and CRM Connectors You Can Expect
Start with connector families rather than a long integration directory. Paid media explains where money went, search and analytics explains discovery and on-site behaviour, and CRM adds lead quality and pipeline outcomes.
Google Ads and Meta Ads are operational systems where an agent may both inspect performance and request changes. GA4 and Google Search Console usually play a diagnostic role in a marketing workflow. A CRM such as GoHighLevel helps distinguish cheap leads from useful leads.
Connector families and what agents can read or change
The write controls below are evaluation requirements, not a promise that every MCP provider implements them.
| Connector | Typical reads | Typical writes | Approval needed |
|---|---|---|---|
| Google Ads | Spend, search terms, keywords, budgets | Negative keywords, budget changes | Yes, with a diff before the change |
| Meta Ads | Campaign and ad set performance, learning status | Pausing ad sets, moving budgets | Yes, with a diff before the change |
| GA4 | Traffic, conversions, realtime data | None in typical setups | Not applicable |
| Google Search Console | Queries, click-through rate, index coverage | None in typical setups | Not applicable |
| GoHighLevel CRM | Lead and pipeline context | Only actions explicitly exposed by the connector | Yes, if a write tool is exposed |
A useful connector reads the account when you make the request, rather than answering from an old spreadsheet. Live reads still inherit the platform's reporting delays, attribution rules and data availability. Today's query doesn't guarantee that every conversion has already arrived.
Say a search-term report contains loosely matched queries that spend without producing qualified leads. An agent can organise those terms and draft negative keywords, but a marketer still needs to inspect intent before excluding them.
CRM context matters here. Before extending a workflow into lead routing or follow-up, it can help to compare sales automation software using LeadBeast's guide, so you distinguish the system that owns the sales workflow from the connector that exposes it.
Evaluate the permission boundary
For any connector, establish:
- Read scope: Which accounts, properties, fields and reporting periods can it access?
- Write scope: Which objects can it create, edit, pause or delete?
- Approval rule: Does the reviewer approve the precise action, or a broad instruction?
- Logging: Can an account owner reconstruct what was requested and what happened?
A platform logo in an integration directory doesn't answer any of those questions.
Security, Permissions and Approval-Gated Changes
A successful connection isn't proof of production readiness. In a December 2025 survey of 300 senior technical leaders across software, financial services and retail, 41% of organisations ran MCP servers in limited or broad production, while security was the leading obstacle, according to Stacklok's State of MCP in Software report.
For live advertising work, the rule should be direct: an agent shouldn't change an account until a reviewer can inspect the exact proposed change. Permission to analyse performance must not become permission to move money.
Protect credentials and separate permissions
In our credential model, the MCP client stores a workspace bearer token, and upstream platform credentials are never sent to tools. That keeps the agent-facing connection separate from the underlying ad-platform credentials.
The workspace token still needs protection. Don't paste it into campaign notes, shared prompts or support screenshots, and remove access when someone leaves the team.
Grant read permissions first. Then enable only the write capabilities the operator needs, scoped to the appropriate accounts. Agency access should preserve client boundaries rather than treating every connected account as a shared pool.
The approval process should make the human decision visible.
Make approval specific
- Propose the change. The agent drafts an action, such as adding a negative keyword or moving budget between campaigns. Its explanation should connect the recommendation to the account evidence.
- Display the diff. Show the account, campaign or ad set, affected field, current value and proposed value. For a keyword exclusion, include its match type and destination list.
- Approve only that proposal. A reviewer's acceptance shouldn't authorise additional edits that weren't visible. If the proposal changes, it needs fresh review.
- Execute and record the result. Log the actor, timestamp, approved request and platform outcome. Distinguish a successful request from a confirmed account change.
- Provide a recovery action. One-call undo should restore supported settings, with a clear record of the reversal. Ad platforms may take time to propagate it.
Our safety reference is the place to inspect the approval and recovery behaviour before enabling operational access.
Undo can restore a setting. It can't recover spend already incurred or recreate auction opportunities missed while an ad was paused.
Test the awkward cases
Disconnect the client while a proposal is pending. The service should preserve a clear state, not interpret silence as consent.
Check partial failures too. If an operation affects several objects and only some succeed, the result must identify which changed and whether the service can reverse them safely. Don't accept an ambiguous success message.
Retries need idempotency, meaning that repeating the same approved request doesn't accidentally apply it again. This matters particularly for relative budget adjustments.
Finally, inspect tenant isolation, regional data handling and access revocation. OAuth identifies and authorises a connection; it doesn't by itself prove that every tool enforces the correct account boundary.
Benefits and Use Cases for Performance Marketers
It's Monday, and cost per lead has climbed before the team meeting. You need to explain whether the cause is irrelevant search traffic, weaker landing-page conversion or a change in the quality of leads reaching sales.
Without a connected workflow, you export reports and reconcile campaign names across dashboards. With an agent, you can request the relevant account evidence in a single working session and spend more attention on the diagnosis.
That work still requires a marketer's judgement.
Where connected analysis helps
- CPL diagnosis: Pull search terms, keyword performance and budget context, then rank suspected waste by spend at risk. Check whether conversion tracking or lead qualification changed before blaming targeting.
- Agency account reviews: Produce a prioritised fix list for each client without mixing their account context. Review the underlying evidence before sending recommendations.
- Scheduled reviews: Our Google Ads weekly review can run through OpenClaw or any agent runtime that supports scheduled MCP calls. Schedule diagnosis and draft preparation, not unattended approval.
- Growth and demand generation: Compare paid traffic, organic queries and CRM outcomes. Investigate whether an apparent acquisition win produces qualified opportunities.
- Marketing operations: Reuse a standard integration interface across compatible assistants instead of maintaining a bespoke connector for each application.
Channel knowledge still matters. If your investigation extends into community-led acquisition, Bazzly's Reddit marketing guide offers channel-specific context that account metrics alone won't provide.
A connected agent can organise evidence, but it shouldn't infer causation merely because trends move together. Check landing-page changes, attribution windows and sales follow-up before approving a targeting fix.
For a complementary walkthrough, use the video below.
The benefit grows with account complexity, reporting load and change frequency, not simply with how often someone opens an AI chat.
A small account with stable campaigns may gain little from another operational layer. If a dashboard already answers the question quickly, keep the simpler workflow.
How to Set Up a Hosted MCP Server Step by Step
First, confirm that your AI client supports remote MCP connections over Streamable HTTP. Compatible interfaces include Claude Desktop or Web, Claude Code, Codex and Cursor, although configuration screens and authentication flows differ.
The MCP architecture documentation describes Streamable HTTP as the remote transport, while local stdio avoids the network overhead of a hosted connection. For a hosted service, timeouts and retries need deliberate handling rather than repeated clicks.
Connect and verify
Choose the host. Open its MCP configuration or connector directory. We work with MCP-compatible command-line clients and don't offer a separate official NotFair CLI package, so configuring your chosen client is the installation step.
Use the current connection domain. New connections use the non-www domain. Existing connections using either domain remain supported, so there's no need to replace a working connection just to remove the prefix.
Add the server connection. Use the Google Ads MCP server address in your client configuration. In Claude Desktop or Web, you can instead install the published connector from the directory and complete sign-in.
Connect the correct accounts. Add them to the workspace and grant read access first. Confirm the account identity before requesting reports, especially when an agency workspace contains similarly named clients.
Run a read-only diagnostic. Request campaign spend and leading search terms, then compare sample values with the platform interface. Align date range, account timezone, currency and conversion definitions before treating a mismatch as a connector fault.
Test rejection. Request a negative-keyword draft, inspect the proposed diff and reject it. Verify that the account remains unchanged.
Prove recovery. Approve a low-risk, reversible test change, inspect its history entry and run undo. Confirm the restored state in the advertising platform rather than relying only on the chat response.
The setup flow is easiest to follow when connection and verification remain separate tasks.
Fix authentication before changing permissions
An expired sign-in can produce an authentication error; reconnect the client to renew access. If an account is missing, check the workspace connection and read grant before requesting broader permissions.
A timeout after a write is different. Inspect the action history and platform state before retrying, because a lost response doesn't prove that execution failed.
Choose a Plan and Confirm Your First Change
Choose a plan around the work you expect to run after evaluation, not the activity you can generate during a trial. The cost drivers are operation volume, connected ad accounts, shared access and whether you need someone to manage the advertising work alongside the software.
Our self-serve Growth plan is intended for businesses that want to run the tools themselves, while the Free plan includes community support. Use the current NotFair pricing page to confirm billing terms, allowances and support eligibility before committing.
NotFair plans compared
| Plan | Price | Operations | Ad account spots |
|---|---|---|---|
| Free | No charge | Confirm the current trial and ongoing allowance | Confirm the current account allowance |
| Growth, monthly | Confirm the current monthly rate | Confirm platform coverage and operation terms | Confirm the shared-account allowance |
| Growth, annual | Confirm the current annual rate | Confirm platform coverage and operation terms | Confirm the shared-account allowance |
Don't assume annual billing is cheaper. Compare the annual total with the equivalent monthly payments, and choose it only when the terms suit your expected use.
Also establish what counts as an operation. A campaign review might involve several reads, an analysis request and a proposed edit; a short conversation isn't necessarily a small workload. Confirm how failed requests, retries and scheduled reviews count.
Buy around a verified workflow
Before choosing a paid tier, run a representative account review. Record the calls required for useful diagnosis, the number of accounts involved and who needs to approve the resulting work.
Use that exercise to answer practical buying questions:
- Capacity: Does the allowance cover your recurring reviews as well as investigations?
- Access: Can the right colleagues inspect proposals without sharing credentials?
- Support: Which tier includes the help and setup resources your team needs?
- Control: Can your reviewer understand the diff and verify recovery without developer assistance?
A higher allowance won't fix an unclear permission model. Neither will a managed service remove your responsibility to decide which business actions require approval.
Make the purchase decision after the read diagnostic succeeds, the approval rule is clear and a controlled undo test works. Your first routine live change should be a deliberate operational decision, not an experiment in whether the connection is safe.
NotFair provides hosted MCP connections for advertising, analytics and CRM workflows, with live reads and approval-gated changes supported by visible diffs, history and one-call undo. Visit NotFair to connect your preferred MCP client and begin with a read-only account diagnostic before enabling writes.