The Amazon Ads MCP Server gives an AI agent 110 documented tools in 18 groups, from campaign_management-update_campaign_budget to user_permissions-update_user_permissions. Amazon opened it as a beta on February 2, 2026, for Amazon Ads partners with active API credentials, at https://advertising-ai.amazon.com/mcp for North America and at -eu and -fe endpoints for the other regions.
The limits for an agent on that server often live in its system prompt: "never set a daily budget above 500", "only touch Acme campaigns". A system prompt is text the model reads before it acts. It makes some tool calls more likely than others, and nothing between the model and Amazon checks the call that comes out.
What the server accepts
MCP, the Model Context Protocol, is a common format in which an AI model calls outside functions as named tools with structured arguments. A call to Amazon's server carries an Amazon-Ads-ClientId header and a bearer token from the agency's Login with Amazon app; OAuth 2.1 has been supported since July 6, 2026. Since September 29, 2026 a Lite endpoint at /mcp/lite exposes three tools, search_tools, describe_tools and invoke_tool, and the last one carries the name and arguments of the real operation.
Write tools take lists. update_campaign_budget takes body.campaigns[] and update_target_bid takes body.targets[], so a single call can change many campaigns at once. A budget entry has a recurrenceTimePeriod of DAILY, LIFETIME or MONTHLY and may carry a separate value per marketplace.
Amazon's documentation shows a disabledTools list in the configuration of one MCP client, which hides tools from the model on the client side. The docs we read describe no server-side policy and no approval step that would stop a call the token is allowed to make.
Where a prompt fails
These four mistakes happen with a model that is trying to follow its prompt:
- A typo. The agent writes 5000 where the plan says 500, and the campaign has ten times its budget for as long as nobody looks.
- A wrong ID. The context holds campaign IDs of two clients, and the agent picks one from the other client's list.
- A wrong tool. Asked to pause a campaign, the agent calls
delete_campaign. - Text in the data. A product title or search term in a report reads like an instruction, and the model follows it.
A sentence in the prompt cannot stop any of these, because the prompt has already been read when the tool call is formed. The check has to run after the model and before Amazon, on the call itself.
A check per call
A per-call check needs a written mandate for each ad account. The mandate names the tools the agent may call by exact name, the account IDs and brands, a daily cap per campaign, a cap on the sum of daily budgets across the account, a maximum bid and a maximum change per bid, the amount above which a person has to approve, and the window in which the mandate is valid. Anything the mandate does not name is refused.
Each check has three outcomes. On allow, the call goes to Amazon. A hold stops it until a person named in the mandate signs it, and forbid stops it for good and names the limit it broke.
Batch calls are split. A call that changes five campaigns becomes five checks, and the strictest result decides: one forbidden item stops the whole call, and one item above the approval threshold holds it.
Unknown values end in forbid. A campaign the check cannot assign to a brand, a missing current bid or an amount it cannot read counts as outside the mandate. On the Lite endpoint the check unpacks invoke_tool and judges the inner tool; Amazon does not document the wrapper's argument names yet, so anything the check cannot read is refused.
The check fails closed. If the service that gives the verdict cannot be reached, the call does not run. An agent that stops for a few minutes during an outage costs less than an agent that runs unchecked during the same minutes.
Tools that change who can act on an account, such as user_permissions-update_user_permissions, invitations and manager account links, should not be grantable at all. An agent that can add a user can hand the account to someone else.
What it looks like in code
MolTrust publishes such a check for Python. The wrapper takes the agent's intended call, asks for a verdict and then runs the agency's own function that talks to Amazon:
pip install "moltrust-enforce[client]>=0.7"
from moltrust_enforce import EnforceClient
from moltrust_enforce.adapters.amazon_ads import AmazonAdsGuard, Forbidden, HoldRequired
guard = AmazonAdsGuard(EnforceClient("https://api.moltrust.ch", api_key=KEY), profile)
try:
guard.call(tool, args, send_to_amazon, context=account_state)
except HoldRequired as e:
approval_queue.put(e.outcome) # a person signs, then the call runs
except Forbidden as e:
log.warning(e.outcome.reason) # e.g. daily_budget 5,000.00 outside 0.00..500.00send_to_amazon is the agency's own MCP client with its own Login with Amazon token. MolTrust holds no Amazon credentials, sees no Amazon data and never calls Amazon. Per check it receives the tool name, the kind of change, the account ID, the brand and the few numbers the mandate limits. account_state holds the current budgets, bids and brand per campaign, and it should come from the agency's reporting store. A value taken from the model's own text would let the model state the numbers it is checked against.
Every verdict comes with a record that binds the mandate, the change and the result. Anyone can recompute it offline with the open-source verifier moltrust-verify, without a MolTrust account.
Limits
The check keeps no state. Current budgets, current bids and the time of the decision come from the caller, so a caller that reports wrong numbers gets verdicts on wrong numbers. The guard covers the calls that pass through it, and a second path to Amazon without the guard is not covered; the engineering team has to make the guard the only route. Amazon's server is in beta, and tool names can change.
Free covers one ad account and 1,000 checks a month. Pro costs USD 49 per ad account per month and can be cancelled in any month.
Next step
Clone the example repository and run quickstart.py. It checks four calls against a sample mandate and prints one allow, one hold and two forbid, without sending anything to Amazon. The quickstart page lists every mandate field, and the Agent Liability Check estimates what one wrong budget would cost on your accounts.
MolTrust is an independent service provider and is not affiliated with or endorsed by Amazon. Amazon Ads is a trademark of Amazon.com, Inc. or its affiliates.