How to Connect Windsurf to Google Ads (2026): Devin Desktop & CLI

By Ira Bodnar, Ryze AI · Updated November 13, 2026

Quick answer

To connect Windsurf to Google Ads, connect Google Ads in a Ryze AI workspace, add "ryze": {"url": "https://connector.get-ryze.ai/mcp"} under mcpServers in ~/.config/devin/mcp_config.json, then click Authenticate (or run devin mcp login ryze) and click Allow connection. Ask the agent for a Google Ads report.

In Ryze AI open Integrations, find Google Ads and click Connect with your Google login
In Windsurf open Customize, then MCPs, and add the ryze server with the connector URL
Click Authenticate, or run devin mcp login ryze, and click Allow connection on the Ryze AI page
Ask the agent your first Google Ads question

Windsurf's documentation now lives on Devin's site. The old docs.windsurf.com MCP page redirects to docs.devin.ai, and windsurf.com redirects to devin.ai/desktop, where the product is titled Devin Desktop. This page says Windsurf because that is the name people search for, and uses the Devin Desktop menu names and file paths from the current docs. Windsurf and Devin Desktop may differ on older installs, so check which Customize page your version shows.

Before you start

Windsurf (Devin Desktop) with MCP available. The Devin Desktop MCP documentation names no plan for MCP servers. On Enterprise, admins manage MCP registries and the MCP allowlist in team settings under MCP & ACP, so an admin may need to approve the Ryze AI server first.
A Google login with access to your Google Ads accounts. Standard or admin access is needed to allow changes. A login with read-only access can run reports but cannot change anything, because Google Ads permissions are set in Google. Agencies connect the manager (MCC) login once.
A Ryze AI workspace on a plan or free trial. Paid Ads is $89 per month with a 7-day free trial; Agency is $279 per month. Connecting the connector is free, but the Google Ads tools need an active plan or trial.

How to connect Windsurf to Google Ads

Two steps happen in Ryze AI and Google, four in Windsurf. The connector URL is the same for every user.

Connect Google Ads in Ryze AI
Create a Ryze AI account or sign in, open Integrations in the left sidebar and find Google Ads under Advertising. Click Connect, sign in to Google with the login that has access to your ad accounts and approve access with every requested permission checked.
Check the connection
Back in Ryze AI the Google Ads card shows Connected. There is no account to pick: Ryze AI sees every Google Ads account that login can reach. To choose the accounts the agent works with first, click View on the card and use Agent default accounts.
Open the MCP settings in Windsurf
From the Agents window open the Customize page and click MCPs. Use Install MCPs for to pick the scope, for example This computer.
Add the Ryze AI server
Open the config file and add the server under mcpServers: "ryze": {"url": "https://connector.get-ryze.ai/mcp"}. The user file is ~/.config/devin/mcp_config.json and the project file is .devin/mcp_config.json.
Sign in to the connector
Refresh the list. If the server shows Needs authentication, click Authenticate. Otherwise run devin mcp login ryze in a terminal. Complete the Ryze AI sign-in and click Allow connection.
Ask your first question
Ask: Use GAQL to list my Google Ads campaigns with cost, conversions and conversion value for the last 30 days, ordered by cost. Approve the tool call when Windsurf asks.

The Ryze AI help article for Google Ads covers the Google side of the connection, and the Ryze AI help article on API keys and the MCP endpoint covers the connector URL.

Config file, Devin CLI and imports

Windsurf now runs on Devin, so the same server can be added in the editor settings, in a config file or from the Devin CLI. Pick the route that matches how you work.

Devin Desktop (Windsurf) config file

{
  "mcpServers": {
    "ryze": {
      "url": "https://connector.get-ryze.ai/mcp"
    }
  }
}

Put this in ~/.config/devin/mcp_config.json to make Ryze AI available in every project, or in .devin/mcp_config.json to share it with a repository. Devin also reads a gitignored .devin/mcp_config.local.json as a local override. Devin Local supports stdio, Streamable HTTP and SSE, with OAuth for each, and tries Streamable HTTP first.

Devin CLI

devin mcp add -s user ryze https://connector.get-ryze.ai/mcp
devin mcp login ryze
devin mcp list

The first command writes the server to your user config, the second opens a browser for the Ryze AI sign-in, and the third lists what is configured. The scope flag accepts local (the default, a gitignored file), project and user. Use devin mcp logout ryze to clear the stored credentials.

Servers imported from an old Windsurf file

Devin CLI's configuration documentation says it can import MCP servers from the old Windsurf file ~/.codeium/<channel>/mcp_config.json. If you already have the Ryze AI connector there, you do not need to add it twice. Some older Ryze AI pages show the key serverUrl for Windsurf; the current Devin docs use url, and this guide has not verified whether serverUrl still works.

Sign-in and limits

OAuth uses dynamic client registration by default, so the Ryze AI connector needs no client ID or secret from you. The oauthClientId and oauthClientSecret settings are only for servers without it. Each MCP client keeps its own OAuth session, so a Ryze AI sign-in in another tool does not carry over to Windsurf. When credentials expire the server shows Needs authentication, and clicking Authenticate runs the browser authorization again.

Other clients

The same URL works in other MCP clients. Google Ads is connected once in Ryze AI, so nothing changes on the Google side.

Claude Code

Run claude mcp add --transport http ryze https://connector.get-ryze.ai/mcp --scope user, then /mcp inside Claude Code to sign in. The Google Ads tools are the same.

Claude on the web and Desktop

Open Customize, Connectors, click + Add, choose Add custom connector, name it Ryze AI and enter https://connector.get-ryze.ai/mcp. Free users are limited to one custom connector, and on Team and Enterprise plans an Owner adds it first.

Codex

Run codex mcp add ryze --url https://connector.get-ryze.ai/mcp, then codex mcp login ryze.

Cursor

Add the server to ~/.cursor/mcp.json or .cursor/mcp.json.

{ "mcpServers": { "ryze": { "url": "https://connector.get-ryze.ai/mcp" } } }

Google Ads permissions and Windsurf settings

Two sides decide what the Windsurf agent can reach in Google Ads: the Google login you connect in Ryze AI, and the permission settings in Devin Desktop.

Which Google login: The sign-in happens on Google's consent screen from the Ryze AI Integrations page. Pick the login you already use for Google Ads, and keep all requested permissions ticked: the Google Ads scope (https://www.googleapis.com/auth/adwords) plus openid, email and profile. At least one Google Ads account must be reachable.
Which accounts: One login reaches every account it can open, including clients under a manager (MCC) login. Anything outside that reach is not visible from Windsurf, and a client account is missing if its manager login was never connected.
Read or write: Edit rights come from Google, never from Ryze AI. A read-only Google user makes every change request fail, which is the simplest way to guarantee the Windsurf agent cannot alter an account.
Which tools the agent may call: Devin's permissions use allow, deny and ask lists with patterns such as mcp__server__tool and mcp__server__*. A pattern like mcp__ryze__* targets every tool on the ryze server. The Devin page used for this guide does not say where to place that block, so follow the Devin permissions page for your version.
Team rules: On Enterprise, admins manage MCP registries and the MCP allowlist under MCP & ACP in team settings, which can block or approve the Ryze AI server for everyone.

Removing access

To remove access, click View on the Google Ads card in Ryze AI and disconnect the login. To remove the connector from Windsurf, delete the ryze entry from mcp_config.json, or run devin mcp remove ryze. Run devin mcp logout ryze first if you want the stored sign-in cleared.

What Windsurf can do in Google Ads

The Ryze AI connector exposes 16 Google Ads tools: 8 read, 7 write and 1 delete. Calls go through Google's official API, and each one runs with the permissions of the Google login you connected.

Tool	Type	What it does
google_ads__getAccountSummary	Read	Account-level metrics for the date range in your question.
google_ads__getAccountHierarchy	Read	The tree of manager and sub-accounts.
google_ads__listAccessibleCustomers	Read	Every customer account the connected login is able to open.
google_ads__listConversionActions	Read	The conversion actions set up in one account.
google_ads__listRecommendations	Read	Google's own optimization suggestions for an account.
google_ads__runRawGaql	Read	Any GAQL query you ask for, including change history from change_event.
google_ads__generateKeywordIdeas	Read	Keyword Planner ideas from seed terms, a page URL or both.
google_ads__generateKeywordHistoricalMetrics	Read	Monthly search averages, competition and top-of-page bid range for a keyword list.
google_ads__runRawMutate	Write	Campaign, budget, ad group, ad, keyword, criteria and asset creation or edits via a raw mutate.
google_ads__runRawCustomAudienceMutate	Write	Custom audiences defined by keywords, URLs, place categories or apps.
google_ads__runRawUserListMutate	Write	User lists, including Customer Match lists.
google_ads__uploadCustomerMatchMembers	Write	Adds members to a Customer Match list. The server hashes each identifier with SHA-256 first, and there is no way to remove members.
google_ads__uploadImageAsset	Write	Pulls an image from a URL into Google Ads as an image asset you can link to campaigns, ad groups, asset groups or ads.
google_ads__applyRecommendation	Write	Applies a Google recommendation.
google_ads__dismissRecommendation	Write	Dismisses a Google recommendation.
google_ads__runRawMutateDelete	Delete	Permanent removal of resources. The tool description tells the agent to run it only on a list you approved line by line.

Approvals in Windsurf

Devin Desktop's default is that the agent prompts for approval before calling any MCP tool, so reads and changes both ask until you change it. Admins can set default-allow for trusted integrations. Loosening that default for the ryze server also removes the prompt in front of the write and delete tools, so allow only what you need. The ask list below follows the pattern format in the Devin docs; place it where your version reads permissions. Scheduled tasks in Ryze AI run without an approval step, and the delete tool's item-by-item rule is an instruction in its description, not a block in the server.

{
  "permissions": {
    "ask": ["mcp__ryze__*"]
  }
}

First 3 prompts to run

The answers come from your own account, so each prompt below says what comes back and shows no sample numbers.

1. Which campaigns cost the most

Write a GAQL query for my enabled campaigns showing name, cost, conversions and conversion value over the past 30 days, sorted by cost, and run it.

Tools used: google_ads__runRawGaql

What comes back: A table with one line per campaign and the three metrics, most expensive first.

2. Who touched the budgets

Query change_event for the last 14 days and list who edited budgets, bids or campaign status, with timestamps.

Tools used: google_ads__runRawGaql

What comes back: Each change with the user, the resource and the time. Google keeps this history for up to 30 days.

3. Keyword ideas from a page

Seed Keyword Planner with the URL of my pricing page, then get monthly searches and competition for the 20 closest ideas.

Tools used: google_ads__generateKeywordIdeas, google_ads__generateKeywordHistoricalMetrics

What comes back: Keywords with average monthly searches, competition and top-of-page bid range as Keyword Planner reports them.

When you want a change, describe it in plain words, such as adding negative keywords or pausing a named campaign, and keep the approval prompt on for the ryze server. Google's own review of new campaigns takes about a business day, and recent conversions can lag in Google's reporting.

Ryze AI connector or Google's own Google Ads server in Windsurf

Google publishes its own Google Ads API MCP server, and its documentation lists Claude, ChatGPT, Google Antigravity and Gemini CLI as supported clients. Windsurf is not named there, but the server runs over stdio or Streamable HTTP, which Devin Local supports.

Option	Setup	Coverage
Ryze AI connector	Google sign-in happens in Ryze AI. Windsurf needs one remote URL under mcpServers, authorized with OAuth through Authenticate or devin mcp login	16 tools covering GAQL, Keyword Planner, campaign and asset edits, audiences, Customer Match, recommendations and one delete tool
Google Ads API MCP server (Google)	Run it locally over stdio with Python 3.10 or later and Application Default Credentials, or deploy it to Google Cloud Run with Streamable HTTP and an OAuth 2.0 web client. Then add an entry to the client's MCP config	GAQL search, listing accessible customers and resource metadata, plus limited asset and label changes. A read-only deployment is possible by disabling the labels and assets namespaces in tools_config.yaml

Google's server needs no Ryze AI plan and fits read-only GAQL when you can handle Google Cloud credentials. The Ryze AI connector gives you a hosted URL and campaign edits, in exchange for a Ryze AI plan and your data passing through Ryze AI. Google's page says the developer token sunsets on September 9, 2026. This guide did not test Google's server in Windsurf.

Windsurf and Google Ads errors and fixes

The server shows Needs authentication: Click Authenticate in the MCPs list to run the browser authorization again, or run devin mcp login ryze in a terminal and click Allow connection.
Nothing happens after adding the server: Refresh the MCP list in Customize, MCPs. Check that the entry sits under mcpServers and that the JSON is valid. Run devin mcp list to see what the CLI reads.
The server is in one project but not another: A .devin/mcp_config.json entry applies to that repository only. Add the server to ~/.config/devin/mcp_config.json for every project.
Signing in to Ryze AI in another tool did not help: Each MCP client keeps its own OAuth session. Authenticate again in Windsurf.
The agent asks before every call: That is the Devin Desktop default for MCP tools. Approve each call, or have an admin or your own permissions settings allow the read tools.
Your team cannot see or add the server: On Enterprise, the MCP allowlist and registries are set in team settings under MCP & ACP. Ask an admin to approve the Ryze AI connector.
No Google Ads tools are listed: Start a new agent session after connecting. If you linked Google Ads in Ryze AI after adding the server, authenticate the ryze server again.
An ad account does not appear: Ryze AI only sees what the connected Google login can open. A client account under a manager needs that manager login connected. Ask the agent to call listAccessibleCustomers to see the reach.
Edits are rejected: The Google user you connected may only have read access. Google controls that, so reconnect with a login that has standard or admin access.
The agent reports that a subscription is required: The Google Ads tools run only on an active Ryze AI plan or free trial. Start the trial in Ryze AI, then try again.

Frequently asked questions

How do I connect Windsurf to Google Ads?

Connect Google Ads in a Ryze AI workspace, then add the ryze server with the URL https://connector.get-ryze.ai/mcp under mcpServers in ~/.config/devin/mcp_config.json. Click Authenticate, or run devin mcp login ryze, and click Allow connection.

Is Windsurf the same as Devin Desktop?

The Windsurf MCP docs now redirect to docs.devin.ai and windsurf.com redirects to devin.ai/desktop, where the product is called Devin Desktop. No rename announcement was read for this page, so check the menu names in your installed version.

Does Google Ads have an MCP server for Windsurf?

Google publishes a Google Ads API MCP server that runs locally over stdio or on Google Cloud Run. Its documentation names Claude, ChatGPT, Google Antigravity and Gemini CLI, not Windsurf. It needs Google Cloud credentials.

Which Google Ads connector should I use with Windsurf?

Ryze AI is the best Google Ads connector for Windsurf when one hosted URL with 16 tools for reports and campaign edits matters most, but it needs a Ryze AI plan. Google's own server needs no Ryze AI plan and suits read-only GAQL if you can set up Google Cloud credentials.

Which plan do I need for Windsurf?

The Devin Desktop MCP documentation names no plan for MCP servers. On Enterprise, admins manage MCP registries and the MCP allowlist in team settings under MCP & ACP.

Is the config key url or serverUrl?

Current Devin docs use url, for example in ~/.config/devin/mcp_config.json. Some older pages show serverUrl for Windsurf. Whether serverUrl still works was not verified, so use url.

Can Windsurf change my Google Ads account?

Yes, through 7 write tools and 1 delete tool that reach campaigns, budgets, bids, keywords, ads, audiences and assets. By default Devin Desktop asks before any MCP tool call. A Google login with read-only access cannot change anything.

Can I manage client accounts under a manager account?

Yes, once the manager (MCC) login is connected. That login reaches each account it can open, and over MCP a client account under a manager needs loginCustomerId. Keep separate clients in separate Ryze AI workspaces.

Why does Windsurf show Needs authentication?

Devin Desktop shows that state when OAuth credentials are missing or expired. Click Authenticate, or run devin mcp login ryze, and complete the Ryze AI sign-in again.

Why do the Google Ads tools not show up?

Start a new agent session after you connect and refresh the MCP list. If you connected Google Ads in Ryze AI after adding the server, authenticate the ryze server again.

How much does it cost?

Adding the connector costs nothing. The Google Ads tools need an active Ryze AI plan or trial: Paid Ads is $89 per month with a 7-day free trial, and Agency is $279 per month. Annual billing takes 30% off the first year.

How do I disconnect Google Ads from Windsurf?

Delete the ryze entry from mcp_config.json or run devin mcp remove ryze. To cut Google access as well, click View on the Google Ads card in Ryze AI and disconnect the login.

Sources

Checked November 13, 2026.