MCC Hack Audit

Owns one workflow: walk your entire Google Ads tree and map every manager (MCC) with a link into it — then hand the operator a triage-ready answer to "which MCCs currently have access to which of my accounts, and which are outside my own tree?" Built after a real-world MCC link-fraud incident where hostile external MCCs gained access to client accounts via compromised client-side admin credentials.

The triage judgment — which links matter, when a finding becomes an incident, what "trusted" costs — is rules.md. The exact walk/classification/output mechanics and the hard-won API limitations are references/scan-contract.md.

What It Scans