The marketing control plane for AI agents
Autonomy for agents. Control for humans.
One MCP URL for 16 ad, analytics and CRM platforms. Every write is capped, previewed, and audited — and the big ones approved by a human — enforced server-side, where no prompt can reach.
$ claude mcp add --transport http ducto https://mcp.getducto.com/
✓ connected — 226 tools across 16 platforms
read-only until you set a policy
Works with Claude, ChatGPT, Cursor, n8n, LangChain — any MCP client.
The control plane
Between your agent and your accounts
Agents connect on one side, platforms on the other. Everything in between is enforced in Ducto's gateway — not in the prompt.
any MCP client
Ducto policy engine
- read-only by default
- caps from the policy row
- preview before apply
- approval on flagged writes
- hash-chained audit
mcp.getducto.com — server-side
16 platforms · 226 tools
What agents do here
Real account work, not just reporting
Full write access to campaigns, budgets, tags, and analytics — each write governed by the same server-side path.
Launch campaigns
Agents build campaigns, ad groups, and ads across platforms — everything is created paused, so nothing spends until you say so.
Move budgets inside caps
Budget and bid changes execute instantly — as long as they clear the numeric caps in your policy row. The model can't raise them.
Fix tracking, preview first
GTM tags, GA4 events, conversion actions: every mutation dry-runs as a preview your agent must match before apply.
Answer “what changed?”
Every tool call lands in a hash-chained, append-only ledger you can filter and export — for the client, the CFO, or security.
One endpoint
Fourteen platforms behind one URL
Including the only governed write path to Google's full marketing stack — Ads, Tag Manager, and GA4 Admin.
How it works
Read-only in minutes. Writes when you've set your caps.
01
Connect
Sign in and connect your accounts by OAuth on the Connections page; tokens go into a KMS-envelope vault and every account starts read-only.
02
Set policies
On the Policies page, set your caps, turn on preview-before-apply, and pick which tool classes wait for approval — that policy row is exactly what the engine enforces, server-side.
03
Point your agent
Copy your connector URL from the MCP page into Claude, Cursor, or any MCP client; your agent sees only the tools your token and connections allow.
The request path
What happens to every write your agent proposes
A fixed, server-side path. There is no code path from tool input to a platform write that bypasses it.
- 01
Authenticate
Bearer token or OAuth 2.1 resolves to your org and workspace. Rate limits apply before anything else runs.
bearer → org → workspace → rate limit
- 02
Scope
The agent only sees tools for platforms you've connected and the token allows — no 226-tool context dump.
tools = connected ∩ token.scopes
- 03
Policy
The policy row is read from Postgres. No row means read-only — the gateway fails closed, not open.
policy row absent ⇒ read_only = true
- 04
Cap and preview
Budget and bid caps come from the policy row, never from the model. Every mutation dry-runs first; apply requires a matching live preview.
caps ← policy row · preview.fingerprint == mutation
- 05
Approval — when you've flagged it
waits for a humanTool classes you mark high-stakes park here for a human. Everything else executes instantly within its caps.
status: pending_approval
- 06
Apply and audit
The write executes and lands in an append-only ledger — each event hash-chained to the last. No role can edit it, including ours.
hash = sha256(prev_hash + event)
Governed writes
Six mechanisms. No adjectives.
Every safety claim on this page names the thing that enforces it.
Read-only by default
No policy row means no writes — the gateway fails closed. Write access is something you grant, per platform, on your terms.
Caps from the policy row
Budget and bid ceilings live in Postgres, not in the prompt. A hijacked model can't raise a cap it never sees.
Preview before apply
Every mutation dry-runs first. Apply requires a live preview whose fingerprint matches the exact change — no bait and switch.
Approval on what matters
Scope approval to high-stakes tool classes — big budget moves, structural changes. Routine writes execute instantly within caps.
Hash-chained audit
Append-only ledger, each event chained to the last. No role can update or delete it — including the database owner.
Scoped, revocable tokens
Per-platform, per-tool, even per-client-account scoping. Each token sees exactly the tools you've allowed, nothing more.
Who it's for
Three ways teams use the control plane
Agencies
Isolated client workspaces, tokens scoped per client account, and an exportable ledger you can hand to the client.
Read more →
In-house teams
Caps your finance team trusts, a rollout path security signs off on, and an answer to “what changed last week?”
Read more →
Agent builders
One endpoint instead of 15 OAuth apps, entitlement-filtered tool lists, and the annotations directory reviews check.
Read more →
188
tools behind one endpoint
14
ad and analytics platforms
1
URL to paste into your agent
0
write paths that bypass the policy engine
FAQ
Questions skeptics ask
Something else? Contact us.
The official platform MCPs are free. Why add Ducto?
We already have guardrails in the prompt.
Does every write wait for a human?
What does my agent actually see?
Can we audit what the agent did?
Autonomy for agents. Control for humans.
One MCP URL, 16 platforms, every write enforced server-side.