
Security News
Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.
@adbutler/mcp-server
Advanced tools
MCP server for the AdButler ad management API. Manage advertisers, campaigns, zones, creatives, placements, VAST video, programmatic, targeting, drafts, contracts, and reports from Claude, ChatGPT, Cursor, Windsurf, and any other MCP client.
Manage your entire AdButler account from any AI assistant — Claude, ChatGPT, Cursor, Windsurf, Cline, and any other Model Context Protocol client.
This MCP server exposes the full AdButler v2 API — 600+ tools covering advertisers, campaigns, zones, creatives, placements, VAST video ads, programmatic / RTB, reporting, targeting, drafts, contracts, product catalogs, and more — plus 9 pre-built workflow prompts that walk an AI through common tasks like launching a campaign or setting up retail media.
"Create a new campaign for Pepsi targeting users in Canada with a $5,000 lifetime budget, and assign it to my Homepage Banner zone."
"Show me the top 10 underperforming ad items in the last 7 days by CTR."
"Set up a VAST 4.2 pre-roll campaign with a 30-second skippable creative and three companion banners."
"Walk me through creating a new programmatic deal."
"Audit my ad units — which zones have no active placements?"
The AI translates these into the right sequence of AdButler API calls, runs them, and shows you the result.
You have two options. Most users want the hosted version — zero setup, just paste a URL.
Use AdButler's hosted MCP server. No install, no Node, no npm.
The hosted server speaks both modern Streamable HTTP (/mcp) and legacy SSE (/sse) transports. New clients should prefer Streamable HTTP; SSE remains for backward compatibility.
| Client | Configuration |
|---|---|
| Claude Desktop / Code | Add an MCP server with URL https://mcp.adbutler.com/mcp (or /sse for older clients) and header Authorization: Bearer YOUR_ADBUTLER_API_KEY |
| Cursor | Settings → Features → Model Context Protocol → Add server with the URL + auth header above |
| Any MCP client | Streamable HTTP: https://mcp.adbutler.com/mcp · SSE: https://mcp.adbutler.com/sse — pass your API key via Authorization: Bearer … or ?api_key=… |
Run the server locally as a Node process. Useful if you want to keep your API key out of any external service or run against a self-hosted AdButler.
Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"adbutler": {
"command": "npx",
"args": ["-y", "@adbutler/mcp-server"],
"env": {
"ADBUTLER_API_KEY": "your_api_key_here"
}
}
}
}
claude mcp add adbutler --env ADBUTLER_API_KEY=your_api_key_here -- npx -y @adbutler/mcp-server
Add to the client's MCP config:
{
"mcpServers": {
"adbutler": {
"command": "npx",
"args": ["-y", "@adbutler/mcp-server"],
"env": { "ADBUTLER_API_KEY": "your_api_key_here" }
}
}
}
AdButler Dashboard → Settings → API Keys → create a new key. It's the same key the AdButler v2 REST API uses.
The AdButler MCP works for both new and existing customers. What you see depends on whether you've already configured an API key.
Use one of these:
Option 1 — set the API key in your client config (recommended for hosted)
Add an Authorization: Bearer YOUR_ADBUTLER_API_KEY header on the SSE connection. Examples:
claude_desktop_config.json → add headers: { "Authorization": "Bearer YOUR_API_KEY" } next to the SSE URLAuthorization: Bearer YOUR_API_KEYhttps://mcp.adbutler.com/sseReconnect — all 600+ tools become available immediately.
Option 2 — configure inside the chat (works in any MCP client)
If your client doesn't support custom headers, just connect to the hosted MCP without auth and you'll see four onboarding tools. Then in the chat say:
"Configure my AdButler API key:
your_api_key_here"
Your AI will call the setup_api_key tool, validate the key against your account, and unlock all the AdButler tools. You may need to disconnect and reconnect to refresh your client's tool list after.
Connect to the hosted MCP without auth. The chat will guide you through a free trial signup using create_trial_account → check your email → verify_trial_email with the code. The API key is configured automatically.
If you're running locally via npx, set ADBUTLER_API_KEY in the env block of your client's MCP config (see Option B above). The setup tools also work — and on local the key is remembered between sessions.
Pre-built skill prompts that guide the AI through complete workflows end-to-end. Invoke them as MCP prompts (/launch-campaign etc.) from your client.
| Prompt | What it does |
|---|---|
launch-campaign | Walks an end-to-end campaign launch — advertiser → campaign → ad items → creatives → targeting → placements |
retail-media-setup | Sets up sponsored products / retail media for an e-commerce site |
reporting | Generates a custom report with the right dimensions and filters |
vast-video | Builds a VAST video ad with linear + companion creatives |
programmatic | Configures programmatic deals, bidders, and demand sources |
targeting | Builds geo / platform / data-key / list targets |
contracts | Creates IO contracts and assigns them to campaigns |
channels | Bundles zones into a channel and assigns campaigns |
drafts | Stages a complete campaign as drafts before going live |
When you need an endpoint that no specific tool wraps — or when the user asks about a field (e.g. "priority", "frequency cap") rather than a resource — three escape-hatch tools cover the gap:
| Tool | What it does |
|---|---|
search_adbutler_api | Keyword-search the full AdButler OpenAPI spec for matching endpoints |
describe_adbutler_api | Get the full schema (params, body, response) for one endpoint |
call_adbutler_api | Invoke any endpoint by method+path, with the session's auth applied automatically |
These complement (don't replace) the specific tools below — the LLM continues to prefer specific tools when they obviously match.
| Domain | Tools | Examples |
|---|---|---|
| Display ads | 100+ | list_advertisers, create_campaign, create_image_ad_item, create_native_ad_item, create_placement, create_schedule, create_campaign_assignment |
| VAST 2/3/4 video | 156 | vast_create_creative, vast_create_linear_media, vast_create_companion, vast_create_placement, vast_create_schedule, plus full VAST 4.2 sub-resource coverage |
| Zones & publishing | 50+ | create_zone, create_zone_catalog, create_zone_email, create_native_template, create_publisher, ORTB native assets |
| Targeting | 37 | create_geo_target, create_platform_target, create_data_key, create_data_list, create_postal_code_target |
| Reporting | 39 | get_display_report, get_vast_report, get_event_logs, custom report configs, scheduled reports |
| Programmatic / RTB | 25 | create_demand_source, create_demand_endpoint, create_bidder, create_pmp_deal |
| Product catalogs | 20 | create_product_db_catalog, bulk_upload_products, ad item ↔ catalog item linking |
| Drafts | 48 | Stage campaigns/ad items/placements/schedules as drafts; publish atomically |
| Contracts | 43 | Insertion orders, contract documents, signature requests, payments |
| Account & security | 27 | Users, roles, redirect domains, beacon signing keys, SFTP connections |
| Ad serving | 2 | serve_ad, live_website_preview |
100% coverage of the AdButler v2 OpenAPI spec (604/604 endpoints).
The hosted server at mcp.adbutler.com collects usage analytics so we can understand which tools are popular, prioritize improvements, and diagnose failures. We capture, per tool call:
list_zones, create_campaign) — never tool arguments/self)forbidden, network), and the error message text (truncated to 1000 characters)We never collect: tool arguments, response bodies, your raw API key, IP addresses, request bodies. The instrumentation only sees the tool name, timing, and (on failure) the error message produced by the MCP server or AdButler API.
Self-installed copies — npm package, stdio, your own deployment — collect zero data. The instrumentation only fires when the ANALYTICS_INGEST_URL environment variable is set, which is only true for the hosted endpoint at mcp.adbutler.com.
If you'd prefer to opt out of analytics on the hosted server, run your own copy via stdio or self-host the SSE/HTTP server.
Local source for contributors:
git clone https://github.com/adbutler/mcp-server
cd mcp-server
npm install
npm run build
ADBUTLER_API_KEY=your_key node dist/index.js
Inspect with the official MCP inspector:
npx @modelcontextprotocol/inspector node dist/index.js
MIT
FAQs
MCP server for the AdButler ad management API. Manage advertisers, campaigns, zones, creatives, placements, VAST video, programmatic, targeting, drafts, contracts, and reports from Claude, ChatGPT, Cursor, Windsurf, and any other MCP client.
We found that @adbutler/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.

Security News
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.