Permission and confirmation are the controls
Every serious mitigation for prompt injection reduces to the same principle: limit what the model can do, not what it can be told. Nova MCP reads by default. Listing edits are available only when a workspace owner turns them on, and every edit is previewed and confirmed before it reaches Amazon. Prices and stock levels are never changed.
Where the ads server changes the calculus
Amazon's own Ads MCP server can create campaigns and change bids. That is its point, and it is useful. It also means the assistant now holds a lever that spends money, so the controls should be different from the ones you apply to an analytics connection with optional listing edits:
- Trial it against a low-budget campaign or a test structure first.
- Keep a human confirmation step for anything that changes budget.
- Do not enable it in the same conversation where the assistant is reading untrusted external content.
The pairing we recommend, and cover in the Ads MCP versus Nova MCP comparison, is read with the analytics server and act deliberately with the ads server.