What it's for
An agency running twenty client accounts can already see everything in the app — one page at a time. What's hard to see is the portfolio: which client never got CallRail connected, which one has been quietly failing its sync for a fortnight, which is spending against a budget nobody ever set. Those questions span every account at once, which is exactly what a page-by-page dashboard is bad at.
The connector turns them into questions you can just ask:
- "Which clients aren't fully set up?"
- "What changed on Ace Plumbing since last week, and when did anything last run?"
- "Where are we losing money across the portfolio?"
- "Post that summary to the client's Jira issue."
Setting it up
The connector is a standards-based remote Model Context Protocol server with its own OAuth 2.1, so it works in any MCP client that supports remote servers — Claude, ChatGPT, Cursor, VS Code, Windsurf, Zed and others. Most dialogs accept only a URL, so the PPC TNT server drives the rest of the handshake itself. There is no API key to generate, and nothing to configure on the PPC TNT side.
- Open the dialog. In Claude: Settings → Connectors → Add custom connector. In ChatGPT: Settings → Connectors. In an editor such as Cursor, VS Code, Windsurf or Zed: add a remote MCP server in your MCP settings.
- Name it and paste the URL. Call it
PPC TNT, and for the remote MCP server URL enterhttps://betterads-production.up.railway.app/mcp - Leave the OAuth client id and secret blank. The server registers your client automatically over Dynamic Client Registration.
- Click Add, then Connect. A PPC TNT approval screen opens. Sign in if you need to, choose the permissions, and click Allow.
That's the whole setup. You approve on a PPC TNT screen rather than in the connector dialog, because that's where your existing session already lives — so the connector never handles your password.
Permissions
Two scopes are offered on the approval screen, with read pre-checked. Uncheck the other one for a strictly read-only connector.
| Scope | What it allows |
|---|---|
read | Every reporting tool — accounts, performance, daily spend, campaigns, setup audit, activity, change impact, access audit, lead quality, attribution, records, Jira links. Everything except posting to Jira. |
write:jira | post_jira_update only: a comment on a Jira issue already linked to that client. Nothing else in PPC TNT can be written through the connector. |
What it can see
Everything is scoped to you — the PPC TNT user who approved it — using the same access rules as the app itself.
| If you are | You see |
|---|---|
| Agency owner or billing member | Every client workspace under that agency. |
| Another agency member | Only the workspaces you've been explicitly granted. |
| Solo operator | The workspaces you own. |
That scope is re-resolved from the database on every request, not stored in the token at approval time. Remove someone from an agency and their connector loses that account on the next question they ask — there's no stale token to chase down.
The sixteen tools
You don't call these by name — you ask a question and your AI picks. They're listed so you know what's in scope.
| Tool | The question it answers | Writes? |
|---|---|---|
list_client_accounts | What accounts exist, and how each is doing month-to-date. | No |
audit_setup | What's missing or not connected, ranked, per account and portfolio-wide. | No |
find_improvements | Where to improve, ranked by money at stake. | No |
get_performance_report | Pacing vs budget, cost per lead vs target CPA, lead-tracking gap. | No |
get_daily_spend | Day-by-day spend and pacing — when an account started overspending, not just that it did. | No |
get_campaign_performance | Spend, clicks and conversions per campaign. | No |
get_activity_log | When each thing last ran; which accounts have gone quiet. | No |
get_change_impact | What the account did in the days before vs after a change. | No |
get_account_access_audit | Who has been editing the account — and how much of it was the client. | No |
get_lead_quality | Why the leads were bad, by reason and in the caller's own words. | No |
get_gclid_coverage | Whether your leads can be traced back to campaigns at all — measured, rather than assumed. | No |
explain_attribution | Why a particular call or job was, or wasn't, credited. | No |
get_client_account | One account in full detail. | No |
query_records | Specific numbers from calls, jobs, spend, change history. | No |
get_jira_links | What's linked to Jira, and whether comments are landing. | No |
post_jira_update | Post a comment to a linked Jira issue. | Yes |
get_gclid_coverage exists to tell you how far that could ever be fixed for your accounts rather than quietly reporting the fraction that happens to join. Daily spend isn't broken out by campaign either. And get_change_impact compares the whole account and flags every comparison that has other changes inside its window, because four budget edits in a fortnight means no single one of them owns the result.What the setup audit looks for
Ranked critical → warning → suggestion, each with where in the app to fix it.
Critical
- No ad platform connected at all.
- No CRM while ads are running — so nothing attributes spend to revenue.
- Never synced, or the sync is currently failing.
Warning
- No call tracking, so calls never reach Google Ads as conversions.
- Sync going stale.
- Spending with no attributed revenue.
- Google Ads conversion upload switched off.
- No business profile, so the AI tools have no context to work from.
Suggestion
- Budget or target CPA inherited rather than set for that client.
- Not linked to Jira — only raised if your agency uses Jira at all.
What find_improvements adds
The performance half of the same picture: projected over- and underspend against budget, cost per lead above target CPA, a large gap between tracked leads and platform-reported conversions, accounts spending with no Google Ads changes in the last 30 days, and lead volume falling at similar spend. Findings from both halves are ranked together by estimated dollars at stake, so the list starts with what's worth your afternoon.
Posting to Jira
The one write. Ask your AI to post a summary and it will name the issue and wait for you to confirm. It can only post to issues already linked to that client, it needs the write:jira scope, and it goes out through the same Jira outbox the app uses — so a Jira outage queues the comment rather than losing it. See the Jira integration page for linking a client to its issue.
Security
A connector that can read every client's numbers deserves more than an API key pasted into a field. What's actually protecting it:
- Your password is never involved. Consent happens on a PPC TNT screen using your existing session.
- Access is re-checked per request rather than baked into the token.
- Nothing reusable is stored. Authorization codes and tokens are kept only as SHA-256 hashes, codes are single-use, and a replay attempt revokes everything already issued to that client.
- Reads are an allow list.
query_recordsis not a query language — tables, columns and operators are declared up front, and the workspace filter is applied server-side rather than taken from the request. - Small blast radius. Connector tokens aren't your app session. They're scoped to the connector surface, independently revocable, and can't be replayed against the rest of the API.
FAQ
Do I need an OAuth client id and secret?
No — leave both blank. Most connector dialogs only accept a URL, so the server registers your client automatically over Dynamic Client Registration.
Can the connector change anything in my account?
Only one thing: posting a comment to a Jira issue already linked to that client, and only if you granted write:jira. Everything else is read-only. It cannot change budgets, campaigns, tracking pools, workspaces, or any PPC TNT setting.
What happens when someone leaves the agency?
Their connector loses those accounts on the next question they ask. Access is re-resolved per request rather than stored at approval time, so there's no stale token to hunt down.
Will the connector and the Reporting page ever disagree?
No. Both read the same roll-up code, so cost per lead, pacing, and account metrics come from one source rather than two implementations drifting apart.
Who can set this up?
Anyone with a PPC TNT login — the connector simply mirrors your own access. An agency owner gets the whole portfolio; a member with two workspace grants gets those two.
https://betterads-production.up.railway.app/mcp into your AI's Add custom connector dialog, then ask it which of your clients aren't fully set up. The connector overview has the short version.