An agency running twenty accounts can see everything in the app — one page at a time. What you can't see is the portfolio: which client never got CallRail connected, which one has been failing its sync for a fortnight, which is spending against a budget nobody ever set. Add PPC TNT to Claude as a custom connector and just ask.
The tools
These aren't a generic database wrapper. Each one answers a question agencies actually ask, using the same maths the app's own pages use — so the Reporting page and Claude can't quote you different numbers.
What accounts exist, and how each one is doing month-to-date.
What's missing or not connected, ranked, per account and across the whole portfolio.
Where to improve, ranked by the money at stake rather than by how easy it is to say.
Pacing against budget, cost per lead against target CPA, and the lead-tracking gap.
When each thing last ran — and which accounts have gone quiet.
One account in full detail, when the portfolio view has pointed you at it.
Specific numbers out of calls, jobs, spend and change history.
What's linked to Jira, and whether the comments are actually landing.
Post a comment to a linked Jira issue. The only thing the connector can change.
Setup
No client id, no secret, no API key to generate and store somewhere. Claude's dialog only takes a URL, so the server handles the rest of the handshake itself.
In Claude, go to Settings → Connectors → Add custom connector.
Call it PPC TNT, and for the remote MCP server URL enter https://betterads-production.up.railway.app/mcp
The server registers Claude automatically. If the fields are optional in your version of the dialog, skip them.
A PPC TNT approval screen opens. Sign in if you need to, choose the permissions, and click Allow. That's the whole setup — there is nothing to configure on the PPC TNT side.
Permissions
Both are offered on the approval screen with read pre-checked. Uncheck the other for a strictly read-only connector.
| Scope | What it allows |
|---|---|
read | Every reporting tool — accounts, performance, setup audit, activity, records, Jira links. Eight of the nine. |
write:jira | post_jira_update only: a comment on a Jira issue already linked to that account. Nothing else in PPC TNT can be written through the connector. |
And it only ever sees what you see. Scope comes from your own PPC TNT access, using the same rules as the app:
| If you are | The connector sees |
|---|---|
| Agency owner or billing member | Every client workspace under that agency. |
| Another agency member | Only the workspaces you've been explicitly granted. |
| A solo operator | The workspaces you own. |
Security
A connector that reads every client's numbers deserves more than an API key in a text field. Here is what actually protects it.
Consent happens on a PPC TNT screen where your existing session already lives, so the connector never touches a password and there's still exactly one login screen.
Your reach is resolved from the database on every request rather than baked into the token. Remove someone from an agency and their connector loses that account on the next question.
Authorization codes and tokens are kept only as SHA-256 hashes. Codes are single-use, and a replay attempt revokes everything already issued to that client.
query_records is not a query language. Tables, columns and operators are declared up front and the workspace filter is applied server-side — never taken from the request.
Posting to Jira has its own scope, asks you to confirm, and is restricted to issues already linked to that account.
Connector tokens aren't your app session. They're scoped to the connector surface, independently revocable, and can't be replayed against the rest of the API.
Paste one URL into Claude and ask which clients need you today.