BYOD for AI ad-ops — give the agent a CSV, not your refresh token

TL;DR:

• mureo v0.7.1 (released 2026-04-29) lets an AI agent analyze your real Google Ads and Meta Ads accounts from a local XLSX. No OAuth, no developer token, no SaaS login.
• Mutation tools return {"status": "skipped_in_byod_readonly"} by construction. The agent can recommend a budget shift; it cannot execute one.
• Read-only by construction is the structural answer to the threat model I wrote up here. This post is the walkthrough.

A couple of weeks ago I posted about the three failure modes of AI agents that touch ad accounts: prompt injection, credential exfiltration, and unbounded mutations. The honest conclusion was that "be careful with your refresh token" is not a serious answer when the LLM will eventually be tricked.

The structural answer is: don't connect the agent to the account at all. Drop a CSV. Let the agent reason over the numbers, write up the diagnosis, and propose changes you execute by hand if you trust them.

That mode shipped today as mureo v0.7.1. This is the walkthrough.

What you actually get in 5 minutes

A real /daily-check from Claude Code, run against your own ad spend, with no OAuth Client ID registered and no Google Ads developer-token application sitting in someone's review queue.

The thing it produces looks like this. Pulled from a 30-day BYOD bundle on an anonymized JP B2B SaaS account, brand terms replaced with <brand>, numbers untouched:

<brand> in Search_Brand-Performance / Brand ad group: 6 conversions at ¥4,550 CPA.
<brand> in Search_Lead-Gen / Generic group: 0 conversions, ¥31,800 spent across 30 days.
Same for <brand-en> in Search_Lead-Gen: 0 conversions, ¥14,300 spent.
Brand traffic should consolidate into the Brand ad group; add the brand terms as campaign-level negatives on Search_Lead-Gen. ~¥250,000/month redirectable.

That diagnosis exists because the agent had access to the search-term tab from your Google Ads Sheet, plus the persona/USP from your STRATEGY.md. It does not exist because mureo has a refresh token. It cannot execute the move; it can only tell you the move is worth doing.

Setup

mureo is on PyPI as of v0.7.1:

pip install mureo                  # installs 0.7.1
mureo setup claude-code --skip-auth
# => Wrote ~/.claude/.../mcp.json
# => PreToolUse credential guard installed
# => Workflow commands installed (/daily-check, /search-term-cleanup, ...)
# => OAuth skipped (BYOD mode, no credentials needed)

--skip-auth is the thing to notice. It registers the MCP server, the slash commands, the mureo-* skills, and the ~/.mureo/credentials.json PreToolUse guard, but never opens a browser. Nothing in ~/.mureo/credentials.json exists yet. Nothing should.

Python 3.10+ required. The only new runtime dep over v0.6 is openpyxl>=3.1,<4 for the bundle reader.

Producing the bundle

Two platforms, two flows. Pick whichever you have spend on first; they're independent.

Google Ads — Apps Scripts, no GCP project

Open Google Ads. Tools → Bulk actions → Scripts → +. Paste in the contents of scripts/sheet-template/google-ads-script.js from the mureo repo, set TARGET_SHEET_URL at the top to a Google Sheet you own, click Authorize, click Run.

Skip this paragraph if you already know how Google Ads Scripts work. The thing worth knowing for everyone else: this is not Google Apps Script. It runs inside the Google Ads UI under your Ads account's identity, on Google's infrastructure. There is no GCP project to create, no OAuth client to register, no developer-token review queue to wait in. mureo does not get any credential out of this. The script writes to your Sheet in your Drive, and the next step is you hitting File → Download.

If you work at a company on Google Workspace where personal GCP project creation is blocked at the org level, this is the thing that matters. The "log into Apps Script Editor" path that most BYOD-style tools take is dead in those orgs. Google Ads Scripts is not. Different runtime entirely.

Four tabs populate in the Sheet: campaigns, ad_groups, search_terms, keywords. Auction insights are intentionally skipped. Google Ads Scripts does not expose auction_insight_domain from GAQL, and the legacy AWQL AUCTION_INSIGHT_PERFORMANCE_REPORT returns "Report not mapped" from inside the Scripts runtime. I tried both. They don't work. If you need /competitive-scan, the real-API path is unavoidable for that one tool.

Then File → Download → Microsoft Excel (.xlsx) and save it somewhere you can find it.

Meta Ads — saved report, two clicks

Ads Manager → Reports → Customize → Export. Configure once with breakdown By Time → Day, level Ad, and the columns: Day, Campaign name, Ad set name, Ad name, Impressions, Clicks (all), Amount spent, Results. Save it as a Saved Report (call it mureo BYOD or whatever) and the next time you only need Saved Reports → mureo BYOD → Export → Excel. About 10 seconds.

Account language: any of nine. The Meta adapter recognizes column headers in English / 日本語 / 简体中文 / 繁體中文 / 한국어 / Español / Português / Deutsch / Français, verified against actual Ads Manager exports in each locale. You don't need to switch your Ads Manager language to English just to feed the bundle to mureo.

The locale story is also where the messy middle of getting v0.7.1 out lived. I'll come back to it.

Importing it

mureo byod import ~/Downloads/<google-ads-bundle>.xlsx
mureo byod import ~/Downloads/<meta-ads-export>.xlsx

Output looks like this:

=== mureo byod import ===

  [google_ads] format: mureo_sheet_bundle_google_ads_v1
    421 rows, date range 2026-04-01..2026-04-30
    written to /Users/you/.mureo/byod/google_ads/
      - campaigns.csv
      - metrics_daily.csv
      - ad_groups.csv
      - keywords.csv
      - search_terms.csv

Mode summary:
  google_ads        BYOD (421 rows, 2026-04-01..2026-04-30)
  meta_ads          not configured (no BYOD data, no credentials.json)

Next: ask Claude Code: 'Run /daily-check'

There is no --byod flag and no global toggle. The bundle importer dispatches the Google Ads adapter when it sees a campaigns tab from the Sheet template; it dispatches the Meta adapter when the workbook header looks like an Ads Manager export. The tabs are disjoint by header shape (Google Ads uses short-form campaign, Meta uses long-form Campaign name), so you can't mix them in one workbook even if you tried.

The presence of ~/.mureo/byod/manifest.json is the switch. Every MCP tool dispatch checks byod_has(platform); if the manifest says yes for that platform, the tool reads from the local CSV and the live API client is never instantiated. If you remove a platform (mureo byod remove --google-ads), the next tool call falls back to real-API mode for that platform only. Other platforms keep whatever mode they were already in.

Asking Claude Code

You: Run /daily-check

That's the whole interface. The agent reads STRATEGY.md from the current directory (mureo onboard generates one if you don't have it), loads the BYOD CSVs through the same MCP tools it would use against the live API, correlates campaigns / ad groups / search terms / placement-platform-device breakdown, and writes the diagnosis. The slash commands shipped in v0.7.1 (/daily-check, /search-term-cleanup, /budget-rebalance, /competitive-scan, /creative-refresh, /rescue, /sync-state, /weekly-report, /onboard) all name the specific MCP tools they call now. That was a v0.7.1 fix, because the previous wording sent agents looking for raw CSVs in the project directory and aborting when they found none. (BYOD data lives under ~/.mureo/byod/, not in your project.)

Why this is structurally safer

The threat model post named three failure classes. Here's how BYOD mode answers each.

Prompt injection. The agent is still going to be told things by ad copy, search-term strings, and landing-page titles. What changes is what it can do once it has been told. In BYOD mode, every mutation tool (google_ads.campaigns.update_status, meta_ads.campaigns.pause, all of keywords.add / negative_keywords.add / budget.update / the rest) returns {"status": "skipped_in_byod_readonly", "operation": "<name>", "note": "BYOD mode is analysis-only. This call would have written to a real ad account."}. The list is enforced at the BYOD client surface by a verb-prefix check (create_, update_, delete_, remove_, add_, send_, upload_, pause_, resume_, enable_, disable_, apply_, publish_, submit_, attach_, detach_, approve_, reject_, cancel_, set_, patch_). A novel mutation invented by the LLM still falls under one of those prefixes if it does anything; if it doesn't fit a prefix, the BYOD client doesn't have a method for it, and the call returns nothing useful instead of doing damage.

Credential exfiltration. There is no credential. mureo setup claude-code --skip-auth does not write ~/.mureo/credentials.json. The PreToolUse hook is still installed, so even an agent that decides to go fishing for .env files in your home directory gets blocked at the Claude Code runtime before the file is opened. But the more important guarantee is upstream: the file the hook is protecting doesn't exist.

Unbounded mutations. Same answer as the first. The mutation tools return the skip status. The largest mistake an agent can make in BYOD mode is recommending the wrong number to you, which you read and ignore. The agent has no API key. The blast radius of a compromised session is "the agent gave bad advice in a chat window."

This is not the same as "secure" in the universal sense. A compromised agent can still mislead you, embed bad advice, frame a competitor's brand term as the right place to bid. BYOD does not make the LLM honest. It makes the LLM unable to act on dishonesty against your account.

Honest limitations

The XLSX is a snapshot. If you imported on Monday and ask for /daily-check on Friday, the agent reasons over Monday's data unless you re-run the Sheet and re-import. Real-API mode pulls live, BYOD does not.

/competitive-scan returns empty under BYOD on Google Ads. Auction insights aren't reachable from Google Ads Scripts. If you need that one, real-API is unavoidable for it.

GA4 and Search Console are not in the BYOD bundle. They stay on the OAuth path. If you want /daily-check to factor in organic search trends and site behavior, you need mureo auth setup for those two even when Ads is BYOD.

/rescue, /budget-rebalance, /creative-refresh, /search-term-cleanup --execute: all return preview-only diagnoses under BYOD. The agent will tell you what to do; you do it in the platform UI. If you want the agent to actually press the button, that's the real-API path.

Cross-account currency conversion is out of scope. Meta exports are stored raw in the account's own currency. CTR / CPC / CPA inside one account are coherent; comparing CPA across two accounts in different currencies is something you do by hand or not at all.

Try it

pip install mureo
mureo setup claude-code --skip-auth
mureo byod import ~/Downloads/<bundle>.xlsx
# Then in Claude Code: Run /daily-check

• Source: github.com/logly/mureo
• BYOD walkthrough (English): docs/byod.md
• Threat-model post this is the structural answer to: dev.to/yoshinaga/the-threat-model-of-ai-agents-touching-ad-accounts

I'm reading every comment on this post for the next week. If you import a bundle and the adapter blows up on a header I didn't catch, paste the column name into a comment and I'll fix it on main and credit you. The Meta locale work especially is the kind of thing that only gets right because someone in $LOCALE who actually exports daily reports tells you which string you got wrong.

— Yoshinaga (founder, mureo)