ads-google

SUSPICIOUS. The audit behavior matches the stated Google Ads purpose, but the install trust story is inconsistent: it prefers a personal GitHub MCP source while also referencing an official Google repo, and the external MCP process receives Google Ads credentials. This looks more like a risky integration pattern than clear malware, but the source mismatch and credential forwarding make it medium-high security risk.