Hardened VK Ads MCP
vk-ads-mcp
A hardened VK Ads MCP fork: read-only by default, mutations gated by VK_ADS_ENABLE_WRITES, and SSRF protection on file uploads
- 0 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- With VK_ADS_ENABLE_WRITES on, it can create, change and delete campaigns and spend ad budget
- File uploads to campaigns reach out to external addresses, even though SSRF protection is in place
Install
- Works in
- Services
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/nikolaymokh-dev-vk-ads-mcpDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- With VK_ADS_ENABLE_WRITES on, it can create, change and delete campaigns and spend ad budget
- File uploads to campaigns reach out to external addresses, even though SSRF protection is in place
This is third-party code. Review the repository files before installing.
What it does
The server manages VK Ads campaigns (myTarget API v2): 24 tools for reading plans, campaigns, ad groups, banners, statistics, remarketing and dictionaries are always available, while 31 mutating tools for creating, changing and deleting objects, uploading files and spending budget are hidden from the tool list until VK_ADS_ENABLE_WRITES=true is explicitly set. This is a fork of lexamarketolog/vk-ads-mcp that adds a safety layer on top of the original tools: blocking file uploads from non-public addresses and local paths with path-traversal protection, locking the API address to ads.vk.com, and protecting user-supplied values that end up in a URL. It installs via uvx with a pinned version tag and uv.lock.
Who it is for. For marketers and agencies who want to give an agent access to VK Ads, but with a guarantee it cannot spend budget without write access explicitly enabled.
Good fit when
- You need read-only access to VK Ads statistics and campaign structure by default
- You need SSRF and path-traversal protection when uploading images and videos to campaigns
- You need a reproducible install pinned to a version tag rather than the main branch
Not a fit when
- You need full write access right away with no separate enable step: VK_ADS_ENABLE_WRITES=true is required
- You need regular VK.com, not VK Ads: the server has no tools for posts or communities
Example request
Show my VK Ads campaign statistics for the week without changing anything in the accountMCP
- Transport
- stdio
- Authentication
- API key
Environment variables
VK_ADS_CLIENT_IDrequired- The VK Ads application client id.
VK_ADS_CLIENT_SECRETrequired, secret- The VK Ads application client secret.
VK_ADS_ENABLE_WRITES- Enables the 31 mutating tools; off by default.
Limitations
The project is young, at version 0.1.1 with alpha status per its PyPI classifiers. The API terminology uses legacy myTarget names that do not match the new ads.vk.com dashboard interface; the README gives a mapping table. Each partner needs their own VK Ads API keys. The fork adds protection but does not change the behavior of the original lexamarketolog/vk-ads-mcp tools.
How to disable. Remove the server from your MCP client configuration, for example claude mcp remove vk-ads.
FAQ
Can the agent change campaigns right away?
No, 31 mutating tools are hidden from the list until the VK_ADS_ENABLE_WRITES=true variable is set.
How is this different from the original lexamarketolog/vk-ads-mcp?
The README lists what was added: read-only by default, SSRF protection on file uploads, an API address lock and path-traversal protection, without changing the tools themselves.
Discussion
No questions or reviews yet.
Related
All VK toolsA VK Ads MCP server built on the myTarget API v2 with 49 to 55 tools: campaigns, remarketing, lookalikes, product feeds and agency access
VK Ads MCP server
VK Реклама MCP
An MCP server for VK Ads: campaigns, groups, banners, statistics and balance through chat, with in-chat account connection instead of manual OAuth
VK Ads MCP server, read-only
vk-ads-mcp
A read-only MCP server for VK Ads: statistics, campaign structure, top objects by metric and CSV export
A VK Ads MCP server with a turnkey installer: 136 tools, VK community research and a skill for several agents at once
full MCP for VK API
full-vk-mcp
MCP server auto-generated from the VK API schema: over 180 tools with filters by read, write, money modes and API sections
A VK API MCP server for business: community shop, posts, ads, stats, messages and lead forms with write confirmation
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Hardened VK Ads MCP (this card) | no | API key | 0 | |
| VK Ads MCP server, read-only | no | API key | 1 | read-only statistics and structure |
| VK Ads MCP All in One | no | API key | 0 | 136 tools |
README in short
The Russian README explains this is a hardened fork of the original VK Ads server, gives a mapping table from legacy myTarget terms to the new dashboard, install instructions for Claude Code and other MCP clients via uvx pinned to a tag, a separate step to enable mutating tools via VK_ADS_ENABLE_WRITES, and a list of the fork's added safety measures with links to docs/SETUP.md and docs/SECURITY.md.