What it's for
An agency running twenty client accounts can already see everything in the app — one page at a time. What's hard to see is the portfolio: which client never got CallRail connected, which one has been quietly failing its sync for a fortnight, which is spending against a budget nobody ever set. Those questions span every account at once, which is exactly what a page-by-page dashboard is bad at.
The connector turns them into questions you can just ask:
- "Which clients aren't fully set up?"
- "What changed on Ace Plumbing since last week, and when did anything last run?"
- "Where are we losing money across the portfolio?"
- "Post that summary to the client's Jira issue."
Setting it up
Claude's connector dialog only accepts a URL, so the PPC TNT server drives the rest of the handshake itself. There is no API key to generate, and nothing to configure on the PPC TNT side.
- Open the dialog. In Claude, go to Settings → Connectors → Add custom connector.
- Name it and paste the URL. Call it
PPC TNT, and for the remote MCP server URL enterhttps://betterads-production.up.railway.app/mcp - Leave the OAuth client id and secret blank. The server registers Claude automatically.
- Click Add, then Connect. A PPC TNT approval screen opens. Sign in if you need to, choose the permissions, and click Allow.
That's the whole setup. You approve on a PPC TNT screen rather than in the connector dialog, because that's where your existing session already lives — so the connector never handles your password.
Permissions
Two scopes are offered on the approval screen, with read pre-checked. Uncheck the other one for a strictly read-only connector.
| Scope | What it allows |
|---|---|
read | Every reporting tool — accounts, performance, setup audit, activity, records, Jira links. Eight of the nine tools. |
write:jira | post_jira_update only: a comment on a Jira issue already linked to that client. Nothing else in PPC TNT can be written through the connector. |
What it can see
Everything is scoped to you — the PPC TNT user who approved it — using the same access rules as the app itself.
| If you are | You see |
|---|---|
| Agency owner or billing member | Every client workspace under that agency. |
| Another agency member | Only the workspaces you've been explicitly granted. |
| Solo operator | The workspaces you own. |
That scope is re-resolved from the database on every request, not stored in the token at approval time. Remove someone from an agency and their connector loses that account on the next question they ask — there's no stale token to chase down.
The nine tools
You don't call these by name — you ask a question and Claude picks. They're listed so you know what's in scope.
| Tool | The question it answers | Writes? |
|---|---|---|
list_client_accounts | What accounts exist, and how each is doing month-to-date. | No |
audit_setup | What's missing or not connected, ranked, per account and portfolio-wide. | No |
find_improvements | Where to improve, ranked by money at stake. | No |
get_performance_report | Pacing vs budget, cost per lead vs target CPA, lead-tracking gap. | No |
get_activity_log | When each thing last ran; which accounts have gone quiet. | No |
get_client_account | One account in full detail. | No |
query_records | Specific numbers from calls, jobs, spend, change history. | No |
get_jira_links | What's linked to Jira, and whether comments are landing. | No |
post_jira_update | Post a comment to a linked Jira issue. | Yes |
What the setup audit looks for
Ranked critical → warning → suggestion, each with where in the app to fix it.
Critical
- No ad platform connected at all.
- No CRM while ads are running — so nothing attributes spend to revenue.
- Never synced, or the sync is currently failing.
Warning
- No call tracking, so calls never reach Google Ads as conversions.
- Sync going stale.
- Spending with no attributed revenue.
- Google Ads conversion upload switched off.
- No business profile, so the AI tools have no context to work from.
Suggestion
- Budget or target CPA inherited rather than set for that client.
- Not linked to Jira — only raised if your agency uses Jira at all.
What find_improvements adds
The performance half of the same picture: projected over- and underspend against budget, cost per lead above target CPA, a large gap between tracked leads and platform-reported conversions, accounts spending with no Google Ads changes in the last 30 days, and lead volume falling at similar spend. Findings from both halves are ranked together by estimated dollars at stake, so the list starts with what's worth your afternoon.
Posting to Jira
The one write. Ask Claude to post a summary and it will name the issue and wait for you to confirm. It can only post to issues already linked to that client, it needs the write:jira scope, and it goes out through the same Jira outbox the app uses — so a Jira outage queues the comment rather than losing it. See the Jira integration page for linking a client to its issue.
Security
A connector that can read every client's numbers deserves more than an API key pasted into a field. What's actually protecting it:
- Your password is never involved. Consent happens on a PPC TNT screen using your existing session.
- Access is re-checked per request rather than baked into the token.
- Nothing reusable is stored. Authorization codes and tokens are kept only as SHA-256 hashes, codes are single-use, and a replay attempt revokes everything already issued to that client.
- Reads are an allow list.
query_recordsis not a query language — tables, columns and operators are declared up front, and the workspace filter is applied server-side rather than taken from the request. - Small blast radius. Connector tokens aren't your app session. They're scoped to the connector surface, independently revocable, and can't be replayed against the rest of the API.
FAQ
Do I need an OAuth client id and secret?
No — leave both blank. Claude's dialog only accepts a URL, so the server registers Claude automatically as part of the handshake.
Can the connector change anything in my account?
Only one thing: posting a comment to a Jira issue already linked to that client, and only if you granted write:jira. Everything else is read-only. It cannot change budgets, campaigns, tracking pools, workspaces, or any PPC TNT setting.
What happens when someone leaves the agency?
Their connector loses those accounts on the next question they ask. Access is re-resolved per request rather than stored at approval time, so there's no stale token to hunt down.
Will Claude and the Reporting page ever disagree?
No. Both read the same roll-up code, so cost per lead, pacing, and account metrics come from one source rather than two implementations drifting apart.
Who can set this up?
Anyone with a PPC TNT login — the connector simply mirrors your own access. An agency owner gets the whole portfolio; a member with two workspace grants gets those two.
https://betterads-production.up.railway.app/mcp into Claude's Add custom connector dialog, then ask it which of your clients aren't fully set up. The connector overview has the short version.