Find the last step that actually worked
Your assistant says it is connected to Meta Ads, but it cannot find the campaign. Reconnecting everything might help, or it might hide the real problem. First identify the last step with visible evidence.
There are different questions: can the client reach the server, can it authenticate, can the signed-in identity access the requested asset, and can the selected tool return the requested data? A successful login answers only one of them.
This guide diagnoses the official Meta-hosted Ads MCP server. A third-party server may use a different endpoint, authentication flow and tool set. Record which implementation you are using before applying instructions from another guide.
Check the endpoint and setup path
Meta's official overview identifies https://mcp.facebook.com/ads as its hosted Ads MCP endpoint. Its setup documentation describes OAuth, user access tokens and system user access tokens. Follow the instructions for your chosen method rather than mixing fields from different methods.
For a setup using your own Meta developer app, the current documentation describes adding the Ads MCP use case. For OAuth, the app's redirect configuration must match the client. Check these against the live setup guide because provider requirements can change.
Record the endpoint, client, authentication method and time of failure. Keep tokens and client secrets out of screenshots and support messages. A server URL is useful diagnostic context; an access token is not something a helper needs to see.
Use a read-only test in a fixed order
Begin with listing the ad accounts available to the authenticated identity. Then request a report for one account that you can identify in Ads Manager. Use a short, explicit date range. Keep campaign creation and budget changes out of the connection test.
| What you observe | What to inspect next | What the observation does not prove |
|---|---|---|
| Server cannot be reached | Endpoint, client support and the reported transport error | That the ad account is broken |
| Authentication is rejected | Selected method, credential validity and OAuth setup | That more permissions will fix it |
| Login works but expected account is absent | Signed-in identity and assigned asset access | That every business asset is available |
| Account is listed but one tool fails | Tool requirements and permission scope | That all reporting tools fail |
| Provider reports an eligibility or availability restriction | Exact provider message and current official access guidance | That another reconnection or broader token can remove the restriction |
| Report returns unexpected totals | Account, dates, timezone, filters and attribution settings | That the connection failed |
This sequence narrows the problem. Capture the exact error and failing step before changing settings. If the error is intermittent, keep the timestamp so it can be compared with the provider's status information or logs.
Separate permission scope from asset access
The official setup currently specifies ads_mcp_management plus ads_read or ads_management as minimum token permissions. It also states that only Employee-role system user access tokens are supported, not Admin-role system user tokens. These are provider requirements, not a reason to grant every available permission.
Use the permissions required by the task. Separately check that the identity has access to the intended business asset. A token can have a permission name and still be associated with an identity that cannot see the account you meant to query.
If the account remains absent, involve its administrator with the account identifier and the observed failure. Do not change business ownership or broaden access simply to see whether the error disappears.
When numbers differ, align the question
A technically successful report can still answer a different question from the dashboard beside it. Compare the same account, dates, currency, timezone, campaign status and filters. For conversion metrics, record the attribution definition used on each side before drawing a conclusion.
Ask the assistant to include the report scope in its answer. “Spend was 20,000” is incomplete. “Spend for account X, from date A through date B, in the account currency” is something you can verify.
Inspect an empty result as a result. There may be no matching data, or the query may be too narrow. An empty report is not evidence that there was no business activity until the scope has been checked.
Build a useful support note
Keep a short incident record: client and version, official or third-party server, authentication method, failing step, sanitized error, account identifier where appropriate, and one successful comparison. Include whether the same account is visible in Ads Manager.
Change one condition at a time. After reconnecting or correcting a setting, repeat the same read-only request. Otherwise you cannot tell which change helped.
Once the connection works, keep the advertising report separate from the customer journey. Access to spend and campaign data does not establish qualification, attendance or revenue. Those require records from the lead and booking systems. Rainlight's setup overview explains the connection; its service-business briefing covers the downstream lead path.