MCP Server for Z.AI - A Model Context Protocol server that provides AI capabilities
Nothing to run from here
AdRails (2) is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
94/100
trust score
82
downloads a day
local
runs on your machine
93
downloads in 30d
What it does
Guarded Google Ads MCP for AI agents: plan/validate/commit, approvals, audit log, AEO, direct mail
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user adrails-2-mcp '--' uvx --from adrails adsops-mcp
# 2 — ask your agent for something these tools do
# adsops_campaigns, adsops_status, adsops_terms and 79 more
AdRails (2) costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
ADAll 2 servers
adrails2 servers
2 categories
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts AdRails (2) as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.
Claude Codedeclared by this listing
This is a public server: you run it yourself and this marketplace is not in the path. You need uv (docs.astral.sh/uv): uvx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. The '--' is in quotes so that PowerShell passes it on.
claude mcp add --scope user adrails-2-mcp '--' uvx --from adrails adsops-mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it writes
One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.
What you approve
82 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Read from its source code. A server that builds its tool list when it starts can list more tools than this.
List the campaigns this server may operate (keys, accounts, state files).
No parameter schema on file.
Live read: status, end date, daily budget, spend today/lifetime, negative count;
No parameter schema on file.
Clicked search terms over the last N days (term, matched keyword, clicks, cost).
No parameter schema on file.
Diff the committed desired-state file against live (budget, status, end date, negatives,
No parameter schema on file.
Apply the desired-state file. Validate-only unless commit=true (needs a clean,
No parameter schema on file.
Change budget / status / end date / negatives. Checked against the state file's guards
No parameter schema on file.
Spend guard: PAUSE the campaign if a daily or lifetime cap is crossed. Never enables.
No parameter schema on file.
Per-tool usage counts from the metering ledger (billing-ready, no prices).
No parameter schema on file.
Read-only. Can AI answer engines reach this site? Checks robots.txt rules for 18 AI and search
No parameter schema on file.
Read-only. Answer-readiness of one page: answer-first paragraph, question headings, FAQ, structured
No parameter schema on file.
Read-only. Validate a site's /llms.txt (llmstxt.org format), or build one: pass pages
No parameter schema on file.
Pure. Generate valid JSON-LD for a page: kind = faq (qas [[q,a]...]), software (name,url,
No parameter schema on file.
Record an AI share-of-answer panel. YOU (the calling agent) ask each engine the prompts and
No parameter schema on file.
Tell Bing, Yandex, Seznam and Naver (IndexNow) that URLs changed. Checks the key file at
No parameter schema on file.
Read-only. Measure AI-driven traffic from a local web-server log (nginx combined or JSON lines):
No parameter schema on file.
Read-only. The ads-to-answers bridge: turn the campaign's real paid search terms into the questions
No parameter schema on file.
Read-only. Audit conversion tracking for the campaign's account: primary goals, dead tags,
No parameter schema on file.
Read-only PPC diagnostics bundle for one campaign: wasted spend (zero-conversion search terms),
No parameter schema on file.
Pure check, no account access. Validate a Responsive Search Ad draft against Google's limits
No parameter schema on file.
Read-only. Evaluate the automation rules in the campaign's POLICY file (founder-owned, agents
No parameter schema on file.
Read-only. Run monitors (CPA spike, pacing over/under, month forecast, zero impressions,
No parameter schema on file.
Read-only. A short markdown brief across every configured campaign: spend today, conversions,
No parameter schema on file.
Read-only. Fleet view across every configured account and campaign: spend, budget, conversions and
No parameter schema on file.
Read-only. Recommend moving daily budget from weak campaigns to budget-limited strong ones
No parameter schema on file.
Read-only. Who changed the account outside AdRails? Reads Google's change history for the last N
No parameter schema on file.
Read-only. Keyword Planner ideas (searches, competition, top-of-page bid range) for seed
No parameter schema on file.
Build (never send) an offline / enhanced conversion upload from CRM rows. Emails, phones
No parameter schema on file.
Read-only. Git history of the campaign's desired-state file: every change agents or lanes made,
No parameter schema on file.
Undo: build the desired state as of an earlier commit (guards, account and campaign ids are never
No parameter schema on file.
Ask a human to approve a plan before it can be committed (when config approvals.mode is on).
No parameter schema on file.
Record a human decision using a signed approve/reject token. Forged, expired or reused tokens
No parameter schema on file.
List approval requests (newest first), optionally by status.
No parameter schema on file.
Verify the tamper-evident audit chain of every mutating call (hash-linked entries). Returns ok,
No parameter schema on file.
The last N audit-chain entries (redacted), newest first.
No parameter schema on file.
Supply-chain manifest of this AdRails install: a CycloneDX 1.5 SBOM and a SHA-256 manifest of every
No parameter schema on file.
This server's identity and controls: version, principal and roles (RBAC), approval mode, audit chain
No parameter schema on file.
Clean a mailing list before you pay to print and post it: normalises addresses (USPS abbreviations, ZIP+4),
No parameter schema on file.
Give every mail piece a unique tracking code (no 0/1/I/L/O/U, with a check character that catches every
No parameter schema on file.
Print-exact label sheets (Avery 5160/8160, 5163, 5164, 5167) as HTML that prints to PDF from any browser, with an
No parameter schema on file.
Make a QR code for any URL (pure-Python encoder, verified against an independent decoder). Returns SVG text and
No parameter schema on file.
Count real scans of your mail tracking codes from your own web-server access logs: unique visitors per code,
No parameter schema on file.
Honest direct-mail response rates by any column (batch, segment, variant...): scans, leads, clients, with 95%
No parameter schema on file.
How many pieces (and how big a no-mail holdout) you need to prove direct mail works: sample size for a
No parameter schema on file.
Is variant A really better than B? Two-proportion test with a difference interval (e.g. two postcard designs, or
No parameter schema on file.
Cost per lead and per client across every channel on ONE ruler: Google Ads, ChatGPT Ads, direct mail, lead vendors,
No parameter schema on file.
Unit economics of a mail piece: cost per piece (print + postage + other) and the response rate you need to break
No parameter schema on file.
Read-only. Classify the campaign's recent search terms (renter, job, HOA/condo, vacation, DIY/software,
No parameter schema on file.
Read-only. The AdRails Intel weekly report from the FREE sources: Auction Insights already imported
No parameter schema on file.
Import a Google Ads Auction Insights export (CSV/TSV text) or a pasted table into the local intel
No parameter schema on file.
Read-only. Per ad group: Google's quality-score components (expected CTR, ad relevance, landing page
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
Free
$0 forever
- Every tool, no call limit
- No card, and mcprush charges nothing for it
- Source published under Apache-2.0
- Runs on your machine — nothing of it reaches our gateway
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install AdRails (2) or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATrust score 94 / 100
Release 0.6.1 · scanned 6 Nov 2026
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score94
Findings11 threat · 0 capability
Capabilityhigh
Coveragesource
Verificationsource
Surface digestb37636a36d9df0a31a0d610546c5ef19444b7c62f5c405a880a501f239829444
Score vectorthreat 100 → client 94
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | high | capability blast radius (high) — client exposure if the model is manipulated | −6 |
| verification-discount | source | publisher verification (provenance) — cryptographic build provenance ties the artifact to its source | −0 |
| coverage-honesty | source | inspection depth (source) — how much of the target the scan could see | −0 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
Tool surfaceread
Implementation sourceread
Package metadataread
Live transportnot available
Tools were statically extracted from the published source (83 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
7 of the 83 recovered tools are registered only when not any(a.get("platform") == "openai_ads" for a in cfg.get("accounts", [])) is false (adsops/oai_tools.py:155) — typically when a key or option is configured. They are part of the server's surface and were analysed; a server started without that configuration exposes only the other 76.
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.
76 tools are registered unconditionally · 7 more only when not any(a.get("platform") == "openai_ads" for a in cfg.get("accounts", [])) is false (adsops/oai_tools.py:155) — typically when a key or option is configured. All 83 are in the table below and were analysed; the conditional ones are marked.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| aeo_site_audit | no tags | |
| aeo_page_audit | no tags | |
| aeo_llms_txt | no tags | |
| aeo_schema_generate | no tags | |
| aeo_visibility_record | no tags | |
| aeo_indexnow | no tags | |
| aeo_ai_traffic | no tags | |
| aeo_content_gaps | no tags | |
| adsops_apply | no tags | |
| adsops_conv_audit | no tags | |
| adsops_diagnostics | no tags | |
| adsops_rsa_validate | no tags | |
| adsops_rules_check | no tags | |
| adsops_monitor_check | no tags | |
| adsops_brief | no tags | |
| adsops_fleet | no tags | |
| adsops_realloc_suggest | no tags | |
| adsops_drift | no tags | |
| adsops_keyword_ideas | no tags | |
| adsops_offline_conv_plan | no tags | |
| adsops_history | no tags | |
| adsops_rollback | no tags | |
| adsops_approval_request | no tags | |
| adsops_approval_decide | no tags | |
| adsops_approvals | no tags | |
| adsops_audit_verify | no tags | |
| adsops_audit_tail | no tags | |
| adsops_sbom | no tags | |
| adsops_whoami | no tags | |
| adsops_local_profile | no tags | |
| adsops_local_plan | no tags | |
| adsops_leads | no tags | |
| adsops_leads_due | no tags | |
| adsops_local_schema | no tags | |
| adsops_local_nap | no tags | |
| adsops_local_area_page | no tags | |
| adsops_reviews | no tags | |
| adsops_lsa_leads | no tags | |
| adsops_lsa_report | no tags | |
| adsops_lsa_dispute | no tags | |
| adsops_lsa_readiness | no tags | |
| mail_list_clean | no tags | |
| mail_codes_assign | no tags | |
| mail_labels | no tags | |
| mail_qr | no tags | |
| mail_scans | no tags | |
| mail_response | no tags | |
| mail_holdout_plan | no tags | |
| mail_compare | no tags | |
| channel_cac | no tags | |
| mail_breakeven | no tags | |
| adsops_openai_upload_image | no tags | |
| adsops_openai_brand_update | no tags | |
| adsops_openai_conversions_setup | no tags | |
| adsops_openai_test_event | no tags | |
| adsops_openai_ad_check | no tags | |
| adsops_openai_draft_campaign | no tags | |
| adsops_openai_ab_report | no tags | |
| adsops_openai_send_conversions | no tags | |
| adsops_openai_audience | no tags | |
| adsops_openai_account conditional | no tags | |
| adsops_openai_status conditional | no tags | |
| adsops_openai_insights conditional | no tags | |
| adsops_openai_geo_lookup conditional | no tags | |
| adsops_openai_plan conditional | no tags | |
| adsops_openai_apply conditional | no tags | |
| adsops_openai_guard conditional | no tags | |
| adsops_negatives_suggest | no tags | |
| adsops_competitors_report | no tags | |
| adsops_auction_insights_import | no tags | |
| adsops_lp_diagnose | no tags | |
| echo | no tags | |
| plain | no tags | |
| boom | no tags | |
| crash | no tags | |
| t | no tags | |
| adsops_campaigns | no tags | |
| adsops_status | no tags | |
| adsops_terms | no tags | |
| adsops_plan | no tags | |
| adsops_set | no tags | |
| adsops_guard | no tags | |
| adsops_usage | no tags |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.
Supply chain and provenance
Integrityfirst-seen
Surface digestb37636a36d9df0a3
Scanned2026-11-06
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
Always latest — the install command names no version, so it installs the newest release when it runs; the current release on file is 0.6.1. Pin a release below and the command asks for exactly that one.
0.6.1
6 Nov 2026
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish AdRails (2) can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.