Meta's ads MCP server arrived in Databricks Marketplace on October 6, 2026, announced through the Databricks official blog: once advertising teams connect the server to Genie, they can query governed enterprise data and operate Meta campaigns in the same conversation — creating campaigns and ad sets, changing budgets and bids, defining audiences, managing creative and catalogs, pulling performance data and diagnosing signal quality, with more than 25 tools in total, according to the company.
The handoff it aims to remove sits between data teams and media teams
The scenario is familiar. A data team maintains a churn model, lifetime-value scores and attribution data, while the media team still makes decisions from platform reporting inside Ads Manager, with CSV exports and custom API integrations ferrying insights across. With the server connected, marketers can ask Genie for tasks that carry business context: use churn-risk scores to find high-value customers at risk and launch a retention campaign, or read gross margin per order from Databricks next to spend and delivery metrics from Meta before moving budget between ad sets. Advertisers already sending conversion signals through the Conversions API — itself an earlier Marketplace release from this partnership — can also have an agent check event volumes, Event Match Quality and data freshness, and work out whether a drop in purchase events means slower sales or a broken pipeline.
An agent that can move budgets needs guardrails on the server
The obvious worry about letting an agent touch a production ad account is expensive mistakes. Databricks describes two layers of control. On its side, administrators govern access to the Meta connection through Unity Catalog, while Unity Gateway governs tool calls and keeps audit logs, and enterprise data stays under existing permissions. On Meta's side, advertisers pre-set rules in Business Settings — for example, block any single budget increase above 20%, or disallow campaign creation on an account entirely. The server checks every tool call against those rules before executing; a violation is blocked and returns a structured error explaining why. That is server-side enforcement, not a polite instruction in a prompt, so it holds regardless of which model is driving, and the rules can be managed through the Marketing API for teams running hundreds of ad accounts.
The contrast with our earlier report on a malicious Skill slipping past Databricks Genie controls is instructive: the same agent-plus-tools architecture shows how phishing and data exfiltration succeed when controls are missing, and how permissions, limits and auditing built into the execution layer change what an agent can safely be trusted with — in this case, real budgets. As MCP becomes a standard interface for production systems like advertising and data platforms, the contest is shifting from whether agents can connect to who governs the connection, and how well. Getting started means finding the server in the Marketplace, configuring a connection with a Meta user access token and the required permissions, and beginning with one concrete question the team already asks every week.
