Claude Ads is an MIT-licensed plugin that runs paid advertising work inside Claude Code; it is an independent project, not Anthropic showing ads in Claude. Version 2.0.0 is a ground-up rebuild around versioned JSON contracts, deterministic scoring, and capability-gated adapters, and it adds first-class contracts for Reddit, Pinterest, Snapchat, and X, bringing the Claude Code ads plugin to twelve platforms served by 33 skills. Version 2.0.1, shipped one day later, points every install path at the public AgriciDaniel/claude-ads repository, so you can install without any org membership.
Here is what actually changed, what it means in practice, and what breaks if you were on v1.
Four new platforms, twelve total
v1 already covered the large search and social networks. v2 adds dedicated skills, references, audit workers, and catalog entries for four more:
- Reddit Ads: community and interest targeting, Reddit Pixel and Conversions API, catalog advertising, native-fit creative.
- Pinterest Ads: Pinterest Tag and Conversions API, catalog and shopping readiness, Performance+ intent.
- Snapchat Ads: Snap Pixel and Conversions API, mobile and app campaigns, AR and catalog formats.
- X Ads: X Pixel and Conversions API, keyword and conversation targeting, brand safety.
Each of the twelve platforms gets the same treatment: a focused skill, an audit worker, a control reference, a capability declaration, and a testable routing surface. That last part matters more than it sounds. Platform shortcuts like /ads reddit or /ads pinterest are covered by routing evaluations, so a request for one platform reliably lands on that platform's contract instead of a generic prompt.
The full platform list and every command are documented on the commands page.
A complete lifecycle, not just audits
v1 was audit-centric. v2 ships lifecycle skills that carry an account from onboarding to deliverable: setup, launch, monitor, optimize, research refresh, validation and status, and JSON-first report rendering. In day-to-day use that looks like:
/ads setup
/ads audit all
/ads optimize --draft
/ads report
The --draft flag on launch and optimize is not decoration. Drafting is the default posture: those commands produce a mutation plan you can read, not a change that already happened. More on that below.
The count behind the headline: 33 skills total, covering the twelve platforms plus cross-platform work like attribution, server-side tracking, budget modeling, creative production, competitor research, experiments, landing pages, and PPC math.
Deterministic scoring with evidence confidence
The scoring system is the part I would call the real v2. Controls resolve to pass, fail, unknown, or not_applicable, and the aggregation is deterministic and category-first with severity-weighted evidence coverage. Portfolio scoring is spend-aware, so a failing platform that carries most of your budget weighs more than a failing platform running pocket change.
The design principle is that health and evidence stay separate. An unknown control reduces evidence coverage, but it never silently drags down the health score of the things that were actually checked. Coverage itself is banded:
| Evidence coverage | Score state |
|---|---|
| 80% or more | Graded |
| 60 to 79% | Provisional |
| Below 60% | Insufficient evidence |
A few consequences fall out of this that v1 could not express:
- Optional, beta, premium, unavailable, and ineligible features are reclassified as unscored opportunities. Not using a beta feature is no longer a health penalty.
- A disabled or unapproved platform profile produces no health score at all, rather than a misleading one.
- If a required worker fails, the run is marked partial. It is never presented as a complete audit.
- Every finding carries explicit confidence, and universal one-size rules for CPA, budgets, learning phases, and attribution were removed from the runtime prompts. If the evidence for your account does not support a claim, the system does not make it.
Drafts-first mutations behind approval gates
Claude Ads v2 is read-only by default, and live writes stay disabled until each exact platform operation passes capability-specific release gates. When a write capability is enabled, applying a change still requires all of the following:
- A tested and enabled capability for the exact operation.
- Explicit account and object IDs.
- A human-readable before and after diff with blast radius.
- Owner approval within account-defined ceilings.
- An idempotency key, audit destination, rollback plan, and verification window.
- Verification that remote state still matches the mutation precondition.
Missing ceilings mean no write. The gates fail closed, and permanent account-object deletion is not supported in v2 at all. If you have watched an automation tool quietly rewrite a bid strategy at 2 a.m., this is the opposite design: the boring path is the default path.
Security hardening
v2 treats the tool itself as an attack surface, which is the correct assumption for anything that fetches pages and reads account data:
- Pre-dispatch SSRF controls for HTTP and Playwright navigation, including redirects, frames, and subresources. Service workers and downloads are disabled.
- Safe output-root and symlink containment, credential redaction, and private corpus boundaries.
- Prompt-injection rules that treat fetched content as untrusted data.
- An uninstall that refuses namespace globs, tampered manifests, unowned files, and canonical-path escapes, so removal only touches manifest-owned files.
Breaking changes from v1
Two things break, both deliberate:
- v2 JSON contracts and run-directory outputs replace v1 fixed report files. The canonical result of any run is versioned JSON in a unique run manifest. Markdown, HTML, and PDF are renderings of that same validated bundle, produced by
/ads report. Anything that parsed the old fixed filenames needs updating. - Live writes are gated per operation. Nothing mutates an account until that exact operation clears its release gates, and permanent deletion is unsupported.
The full diff is in the changelog, including the v2.0.0 removed and security sections that are easy to skim past.
What v2.0.1 adds
v2.0.1 changes no code contracts, scoring, catalogs, or behavior. It retargets the release surface: README install paths, support and security docs, issue templates, citation metadata, the plugin and marketplace manifests, and the installer's default clone source all now point at the public AgriciDaniel/claude-ads repository under the MIT license. Installation, issues, and vulnerability reporting work without access to the AI-Marketing-Hub org, while the community mirror remains available to AI Marketing Hub Pro members.
Install the Claude Code ads plugin
Claude Code is the canonical runtime, and the native plugin flow is two commands:
/plugin marketplace add AgriciDaniel/claude-ads
/plugin install claude-ads@ai-marketing-hub-claude-ads
The install guide also covers verified local installs, other hosts like Codex and Gemini, and the checksum-first policy (never pipe a remote installer into a shell). From there, /ads setup builds your client profile and /ads audit all runs the first evidence-graded pass across everything you have connected.