Odoo API facts that shape an MCP server
| Fact | Detail | Source |
|---|---|---|
| Where it exists | The Odoo 20 release notes list "Connect Odoo to anything", described as connecting to your database via MCP. Odoo documents the same AI MCP server for Odoo Online 19.4; there is no MCP server page for Odoo 19.0 or earlier. | Odoo 20 release notes |
| Endpoint and key | Each database is its own remote MCP server at <database_url>/mcp. Clients authenticate with a static API key created under My Preferences, Security, with the MCP scope and a validity period; the key is shown once and acts with that user’s identity and permissions. | Odoo 20 docs: AI MCP server |
| Default tools | Five tools are exposed by default: Get Fields, Get Models, MCP Retrieve initial context, Search and Read group. Other tools are server actions an admin exposes with "Available in MCP"; the "Readonly Tool" box tells clients a tool can run without approval. | Odoo 20 docs: AI MCP server |
| Documented clients | Odoo documents Claude Desktop, Claude Code, Google Antigravity and OpenAI Codex, all through npx mcp-remote with an "Authorization: Bearer <API_KEY>" header, which needs Node.js on the user’s machine. | Odoo 20 docs: AI MCP server |
| Plan requirement for the API | Odoo states that access to data via the external API is only available on Custom plans, not on One App Free or Standard. The MCP page itself doesn’t name a plan, so confirm with Odoo which plan your MCP use falls under. | Odoo 20 docs: External JSON-2 API |
| API changes | XML-RPC and JSON-RPC are deprecated: the db service is gone in Odoo 20, and the common and object services are scheduled for removal in Odoo 22 (fall 2028) and Online 21.1 (winter 2027). The JSON-2 API (/json/2/<model>/<method> with a bearer API key) replaces them. | Odoo 20 docs: External JSON-2 API |
| Security model and transactions | JSON-2 calls are checked against the user’s access rights, record rules and field access, and Odoo recommends dedicated bot users for integrations. Each call is its own SQL transaction, so multi-step changes should call one business method. | Odoo 20 docs: External JSON-2 API |
| Odoo Online limits | Odoo Online is incompatible with custom modules and modules from the Odoo Apps Store, so MCP modules that install inside Odoo need Odoo.sh or on-premise hosting. | Odoo 20 docs: Odoo Online |
| Test copies | Odoo.sh staging branches create neutralized duplicates of the production database, with scheduled actions disabled, and delete them after one month, which suits testing MCP tools on real data. | Odoo 20 docs: Odoo.sh branches |
| Webhooks | Studio automation rules can receive webhooks through the "On webhook" trigger, and Odoo advises configuring and testing webhooks on a duplicate database before a live one. | Odoo 20 docs: Webhooks |
Every way to connect Odoo to AI
| Option | Type | Fits when | Limits |
|---|---|---|---|
| Odoo built-in MCP server | Official | Odoo 20 or Online 19.4 databases where people query data and run exposed server actions from Claude Desktop, Claude Code or Codex under their own Odoo rights. | Static API keys with expiry and no OAuth, documented clients use a local bridge, and the default tools are generic search and read. Writes depend on the server actions you expose, and nothing exists for Odoo 19.0 or earlier. |
| erpipe-org/mcp-odoo and ERPipe | Community | Odoo 16 and later on any edition, with gated writes (an environment switch, approval tokens and optional elicitation) and an optional JSONL audit file. ERPipe, from the same maintainer, offers a hosted beta with workspace OAuth and an audit dashboard. | Community-maintained, and the hosted service is a free public beta. It uses the external API, so Odoo Online needs a Custom plan. |
| ivnvxd/mcp-server-odoo | Community | Teams that want an Odoo-side access-control module (Odoo 16 and later) for production use, under the MPL-2.0 license. | Its module comes from the Odoo Apps Store, which Odoo Online can’t install, and its no-module "YOLO" mode is for testing only. |
| Custom MCP server on JSON-2 | Custom | Business rules (credit checks, pricing, tax logic, approvals), per-user OAuth for claude.ai or ChatGPT, tools across systems, and one-transaction business methods. | Build and run cost, and on Odoo Online it still needs Custom-plan API access. |
| Custom Odoo module with MCP server actions | Custom | Odoo.sh or on-premise databases that want business logic inside Odoo’s own transaction and security model, exposed through the built-in MCP server. | Not possible on Odoo Online, and the module needs upgrading with each Odoo version. |
Tools a Odoo MCP server should expose
Start with read-only tools and add write actions once the team trusts the answers. Every write action below runs with a confirmation or approval step.
| Tool | Access | Risk | Purpose | Guard |
|---|---|---|---|---|
search_partners | Read | Low | Find customers or vendors by name, VAT number or tag. | Runs under the key user’s access rights and record rules. |
get_sale_order_status | Read | Low | Show a quotation or sales order with delivery and invoice status. | Read-only; one order per call. |
list_overdue_invoices | Read | Medium | Overdue customer invoices with amounts and follow-up level. | Read-only; company filter enforced; no bank account fields returned. |
get_stock_forecast | Read | Low | On hand and forecasted quantity per product and warehouse. | Read-only. |
pipeline_summary | Read | Low | Open opportunities grouped by stage and salesperson. | Read-only; grouped totals through read_group. |
create_quotation | Write | Medium | Create a draft quotation from a customer and product lines and return totals. | Draft only, saved after the user confirms; Odoo computes pricelist prices and taxes. |
confirm_sale_order | Write | High | Confirm a quotation into a sales order. | Explicit approval; calls Odoo’s own confirm method in one transaction after credit and approval rules pass. |
register_payment | Write | High | Register a customer payment on an invoice. | Approval by an accounting user; amount and journal shown before posting; logged. |
update_partner_contact | Write | Medium | Change a contact’s email, phone or address. | Confirmation with before-and-after values. |
Connect it to Claude, ChatGPT or Copilot Studio
Claude
Odoo documents Claude Desktop and Claude Code through npx mcp-remote with an "Authorization: Bearer" API key header, which runs a local bridge on each machine. In claude.ai and on Team or Enterprise plans, a fixed request-header credential is a beta for a limited set of organizations, and it is one key for the whole organization, so everyone would act as the same Odoo user. For per-user access in claude.ai, put an OAuth-capable server in front of Odoo.
ChatGPT
Odoo doesn’t document ChatGPT. Developer mode lists OAuth, no authentication and mixed authentication, not a static API key, so use an OAuth-capable server instead, such as a custom server or ERPipe’s hosted beta, which uses workspace OAuth. Developer mode runs on Pro, Plus, Business, Enterprise and Education web accounts.
Microsoft Copilot Studio
Copilot Studio accepts an API key sent in a header, which fits Odoo’s bearer-key model, over Streamable HTTP. The agent’s users provide the key, so decide whether each person uses their own Odoo key or a bot user’s key, and test the header format in a sandbox agent first. Generative orchestration must be on, and Power Platform data policies apply.
Claude implementation · Copilot implementation · ChatGPT implementation
Permissions, identity and audit
- The MCP key acts as the Odoo user who created it: that user’s access rights, record rules and field access decide what tools can read or change.
- For shared agents, create a dedicated bot user with minimal groups and no password login, as Odoo recommends for integrations; never use an administrator’s key.
- Give keys the MCP scope and a short validity, rotate them by creating the new key before revoking the old one, and revoke keys when people change roles.
- Expose only the server actions you need with "Available in MCP". Mark only true reads as "Readonly Tool", because clients may run those without asking.
- In multi-company databases, check that the key’s user can reach only the companies the agent should see.
Hosting and network
- The built-in server runs inside Odoo (Online, Odoo.sh or on-premise), so there is nothing extra to host; the documented clients run a local mcp-remote bridge on the user’s machine.
- A custom or community server runs in your cloud next to Odoo and calls JSON-2; on Odoo Online that needs Custom-plan API access.
- For self-hosted Odoo behind a firewall, Claude and ChatGPT connect from their own clouds, so expose the MCP endpoint through an allowlisted reverse proxy or use ChatGPT’s Secure MCP Tunnel.
- Test on an Odoo.sh staging branch or a duplicate database first, and log each tool call with user, model, method and record IDs.
Cost and timeline
- The built-in server comes with Odoo 20; the effort is choosing which server actions to expose, setting up users and keys, and testing. Odoo’s release notes say AI features in Odoo 20 need IAP credits, and Odoo’s MCP page doesn’t say whether MCP calls use them.
- A focused Odoo MCP server, for example approval-gated sales and accounting tools or OAuth for claude.ai, typically takes two to four weeks including security and evaluation.
- Multi-system servers (Odoo plus a marketplace or payroll), moves off XML-RPC before Odoo 22, and agent workflows take longer and are scoped after a short discovery.
Odoo MCP questions
Does Odoo have an official MCP server?
Yes, from Odoo 20 and Odoo Online 19.4. Every database serves MCP at its URL plus /mcp, secured with a user API key that has the MCP scope.
Does it work on Odoo 17, 18 or 19?
Not the built-in server; Odoo’s MCP documentation starts with Online 19.4 and Odoo 20. For older versions, community servers such as erpipe-org/mcp-odoo support Odoo 16 and later through the external API.
Does it work on Odoo Online, Odoo.sh and on-premise?
The built-in server runs wherever Odoo 20 runs. The differences are around it: Odoo Online can’t install custom or Apps Store modules and needs a Custom plan for external API access, while Odoo.sh and on-premise can add modules.
Does it work with Odoo Community edition?
Odoo’s MCP page doesn’t name an edition, and the Odoo 20 Community source code has no AI or MCP module, so expect the built-in server to come with Enterprise; confirm with Odoo. Community users can run an open-source server over the external API.
Can it write data?
Yes, if you expose server actions that write. By default only five read tools are exposed, and an admin marks others "Available in MCP". Keep the "Readonly Tool" flag for true reads, since clients may run those without approval.
Does it work with Claude, ChatGPT or Copilot?
Odoo documents Claude Desktop and Claude Code through mcp-remote with a bearer key. ChatGPT developer mode lists OAuth or no authentication rather than static keys, and Copilot Studio accepts API keys in a header, so test each; an OAuth-capable server closes the gaps.
How is personal data protected?
Tools see only what the key’s user can see, so start with a bot user whose groups exclude HR and payroll data. Log calls without personal values and give keys a short expiry.
Build or buy?
Use the built-in server for Odoo 20 read access. Use a community or hosted server for older versions or quick approvals. Build when you need business rules, tax logic, OAuth for claude.ai, or tools across systems; we build read-only first, under a dedicated user.
