Odoo API facts that shape an MCP server
| Fact | Detail | Source |
|---|---|---|
| Where it exists | The Odoo 20 release notes list "Connect Odoo to anything", described as connecting to your database via MCP. Odoo documents the same AI MCP server for Odoo Online 19.4; there is no MCP server page for Odoo 19.0 or earlier. | Odoo 20 release notes |
| Endpoint and sign-in | Each database is its own remote MCP server at <database_url>/mcp. As of October 2026, Odoo calls OAuth the recommended way to sign in, so users approve access from their client without copying keys; OAuth is only for internal users, and portal users authenticate with an API key created under My Preferences, Security, with the MCP scope and a validity period. Either way the connection acts with that user’s identity and permissions. | Odoo 20 docs: AI MCP server |
| OAuth client approval | An admin approves OAuth clients under Settings, Integrations, MCP OAuth by listing each client’s Client ID Metadata Document (CIMD) URL, or ticks Allow Dynamic Client Registration for clients without one, which Odoo warns lets any application register. On a Grant Access page, each user picks how long the access lasts. Odoo’s documentation gained this section on October 17, 2026. | Odoo 20 docs: AI MCP server (Connect with OAuth) |
| Default tools | Five tools are exposed by default: Get Fields, Get Models, MCP Retrieve initial context, Search and Read group. Other tools are server actions an admin exposes with "Available in MCP"; the "Readonly Tool" box tells clients a tool can run without approval. | Odoo 20 docs: AI MCP server |
| Documented clients | With OAuth, Odoo documents Claude Code and Grok over remote HTTP (claude mcp add --transport http <name> <database_url>/mcp) and ChatGPT through Settings, Plugins, Add custom MCP server. With an API key, it documents Claude Desktop, Claude Code, Google Antigravity and OpenAI Codex through npx mcp-remote with an "Authorization: Bearer <API_KEY>" header, which needs Node.js on the user’s machine. | Odoo 20 docs: AI MCP server |
| Plan requirement for the API | Odoo states that access to data via the external API is only available on Custom plans, not on One App Free or Standard. The MCP page itself doesn’t name a plan, so confirm with Odoo which plan your MCP use falls under. | Odoo 20 docs: External JSON-2 API |
| API changes | XML-RPC and JSON-RPC are deprecated: the db service is gone in Odoo 20, and the common and object services are scheduled for removal in Odoo 22 (fall 2028) and Online 21.1 (winter 2027). The JSON-2 API (/json/2/<model>/<method> with a bearer API key) replaces them. | Odoo 20 docs: External JSON-2 API |
| Security model and transactions | JSON-2 calls are checked against the user’s access rights, record rules and field access, and Odoo recommends dedicated bot users for integrations. Each call is its own SQL transaction, so multi-step changes should call one business method. | Odoo 20 docs: External JSON-2 API |
| Odoo Online limits | Odoo Online is incompatible with custom modules and modules from the Odoo Apps Store, so MCP modules that install inside Odoo need Odoo.sh or on-premise hosting. | Odoo 20 docs: Odoo Online |
| Test copies | Odoo.sh staging branches create neutralized duplicates of the production database, with scheduled actions disabled, and delete them after one month, which suits testing MCP tools on real data. | Odoo 20 docs: Odoo.sh branches |
| Webhooks | Studio automation rules can receive webhooks through the "On webhook" trigger, and Odoo advises configuring and testing webhooks on a duplicate database before a live one. | Odoo 20 docs: Webhooks |
Every way to connect Odoo to AI
| Option | Type | Fits when | Limits |
|---|---|---|---|
| Odoo built-in MCP server | Official | Odoo 20 or Online 19.4 databases where people query data and run exposed server actions from Claude Code, ChatGPT, Grok, Claude Desktop or Codex under their own Odoo rights, with OAuth for internal users. | OAuth is for internal users only and needs an admin to approve each client or open dynamic registration; portal users and API-key clients use a static key, often through a local bridge; and the default tools are generic search and read. Writes depend on the server actions you expose, and nothing exists for Odoo 19.0 or earlier. |
| erpipe-org/mcp-odoo and ERPipe | Community | Odoo 16 and later on any edition, with gated writes (an environment switch, approval tokens and optional elicitation) and an optional JSONL audit file. ERPipe, from the same maintainer, offers a hosted beta with workspace OAuth and an audit dashboard. | Community-maintained, and the hosted service is a free public beta. It uses the external API, so Odoo Online needs a Custom plan. |
| ivnvxd/mcp-server-odoo | Community | Teams that want an Odoo-side access-control module (Odoo 16 and later) for production use, under the MPL-2.0 license. | Its module comes from the Odoo Apps Store, which Odoo Online can’t install, and its no-module "YOLO" mode is for testing only. |
| Custom MCP server on JSON-2 | Custom | Business rules (credit checks, pricing, tax logic, approvals), tools across systems, one-transaction business methods, and per-user access for Odoo 19 and earlier. | Build and run cost, and on Odoo Online it still needs Custom-plan API access. |
| Custom Odoo module with MCP server actions | Custom | Odoo.sh or on-premise databases that want business logic inside Odoo’s own transaction and security model, exposed through the built-in MCP server. | Not possible on Odoo Online, and the module needs upgrading with each Odoo version. |
Tools a Odoo MCP server should expose
Start with read-only tools and add write actions once the team trusts the answers. Every write action below runs with a confirmation or approval step.
| Tool | Access | Risk | Purpose | Guard |
|---|---|---|---|---|
search_partners | Read | Low | Find customers or vendors by name, VAT number or tag. | Runs under the key user’s access rights and record rules. |
get_sale_order_status | Read | Low | Show a quotation or sales order with delivery and invoice status. | Read-only; one order per call. |
list_overdue_invoices | Read | Medium | Overdue customer invoices with amounts and follow-up level. | Read-only; company filter enforced; no bank account fields returned. |
get_stock_forecast | Read | Low | On hand and forecasted quantity per product and warehouse. | Read-only. |
pipeline_summary | Read | Low | Open opportunities grouped by stage and salesperson. | Read-only; grouped totals through read_group. |
create_quotation | Write | Medium | Create a draft quotation from a customer and product lines and return totals. | Draft only, saved after the user confirms; Odoo computes pricelist prices and taxes. |
confirm_sale_order | Write | High | Confirm a quotation into a sales order. | Explicit approval; calls Odoo’s own confirm method in one transaction after credit and approval rules pass. |
register_payment | Write | High | Register a customer payment on an invoice. | Approval by an accounting user; amount and journal shown before posting; logged. |
update_partner_contact | Write | Medium | Change a contact’s email, phone or address. | Confirmation with before-and-after values. |
Connect it to Claude, ChatGPT or Copilot Studio
Claude
Odoo documents Claude Code over remote HTTP with OAuth (claude mcp add --transport http) once an admin has approved Claude’s client metadata URL or allowed dynamic client registration, and Claude Desktop and Claude Code through npx mcp-remote with an "Authorization: Bearer" API key header, which runs a local bridge on each machine. A claude.ai custom connector also signs in with OAuth, so the same admin approval should let each person act as their own Odoo user; Odoo’s page lists Claude Code rather than claude.ai, so test it on a sandbox first.
ChatGPT
Odoo documents ChatGPT: add a custom MCP server under Settings, Plugins with <database_url>/mcp and OAuth as the authentication method. An admin must first approve ChatGPT’s client metadata URL or allow dynamic client registration in Odoo’s MCP OAuth settings. Developer mode runs on Pro, Plus, Business, Enterprise and Education web accounts, and it asks for confirmation on tools not marked read-only.
Microsoft Copilot Studio
Odoo doesn’t document Copilot Studio. Copilot Studio accepts an API key sent in a header, which fits Odoo’s bearer-key route, over Streamable HTTP; its OAuth 2.0 option needs testing against Odoo’s client approval. The agent’s users provide the key, so decide whether each person uses their own Odoo key or a bot user’s key, and test the header format in a sandbox agent first. Generative orchestration must be on, and Power Platform data policies apply.
Claude implementation · Copilot implementation · ChatGPT implementation
Permissions, identity and audit
- An OAuth grant or MCP key acts as the Odoo user behind it: that user’s access rights, record rules and field access decide what tools can read or change.
- Approve OAuth clients one by one through their client metadata URL and leave dynamic client registration off, since Odoo warns it lets any application register; have users choose short grant durations.
- For shared agents, create a dedicated bot user with minimal groups and no password login, as Odoo recommends for integrations; never use an administrator’s key.
- Give keys the MCP scope and a short validity, rotate them by creating the new key before revoking the old one, and revoke keys and grants when people change roles.
- Expose only the server actions you need with "Available in MCP". Mark only true reads as "Readonly Tool", because clients may run those without asking.
- In multi-company databases, check that the key’s user can reach only the companies the agent should see.
Hosting and network
- The built-in server runs inside Odoo (Online, Odoo.sh or on-premise), so there is nothing extra to host; OAuth clients connect to it directly over HTTP, and API-key clients run a local mcp-remote bridge on the user’s machine.
- A custom or community server runs in your cloud next to Odoo and calls JSON-2; on Odoo Online that needs Custom-plan API access.
- For self-hosted Odoo behind a firewall, Claude and ChatGPT connect from their own clouds, so expose the MCP endpoint through an allowlisted reverse proxy or use ChatGPT’s Secure MCP Tunnel.
- Test on an Odoo.sh staging branch or a duplicate database first, and log each tool call with user, model, method and record IDs.
Cost and timeline
- The built-in server comes with Odoo 20; the effort is choosing which server actions to expose, approving OAuth clients, setting up users and keys, and testing. Odoo’s release notes say AI features in Odoo 20 need IAP credits, and Odoo’s MCP page doesn’t say whether MCP calls use them.
- A focused Odoo MCP server, for example approval-gated sales and accounting tools, typically takes two to four weeks including security and evaluation.
- Multi-system servers (Odoo plus a marketplace or payroll), moves off XML-RPC before Odoo 22, and agent workflows take longer and are scoped after a short discovery.
Odoo MCP questions
Does Odoo have an official MCP server?
Yes, from Odoo 20 and Odoo Online 19.4. Every database serves MCP at its URL plus /mcp, secured with OAuth sign-in for internal users (from clients an admin approves) or a user API key that has the MCP scope.
Does it work on Odoo 17, 18 or 19?
Not the built-in server; Odoo’s MCP documentation starts with Online 19.4 and Odoo 20. For older versions, community servers such as erpipe-org/mcp-odoo support Odoo 16 and later through the external API.
Does it work on Odoo Online, Odoo.sh and on-premise?
The built-in server runs wherever Odoo 20 runs. The differences are around it: Odoo Online can’t install custom or Apps Store modules and needs a Custom plan for external API access, while Odoo.sh and on-premise can add modules.
Does it work with Odoo Community edition?
Odoo’s MCP page doesn’t name an edition, and the Odoo 20 Community source code has no AI or MCP module, so expect the built-in server to come with Enterprise; confirm with Odoo. Community users can run an open-source server over the external API.
Can it write data?
Yes, if you expose server actions that write. By default only five read tools are exposed, and an admin marks others "Available in MCP". Keep the "Readonly Tool" flag for true reads, since clients may run those without approval.
Does it work with Claude, ChatGPT or Copilot?
Yes for Claude and ChatGPT: as of October 2026 Odoo documents Claude Code, ChatGPT and Grok with OAuth over remote HTTP, and Claude Desktop, Claude Code, Codex and Antigravity through mcp-remote with a bearer key. Odoo doesn’t document Copilot Studio, which accepts API keys in a header, so test it on a sandbox; a custom server adds your own rules on top.
How is personal data protected?
Tools see only what the signed-in user or the key’s user can see, so start with a bot user whose groups exclude HR and payroll data. Log calls without personal values, give keys a short expiry and ask users for short OAuth grants.
Build or buy?
Use the built-in server for Odoo 20 read access and exposed server actions. Use a community or hosted server for older versions or quick approvals. Build when you need business rules, tax logic or tools across systems; we build read-only first, under a dedicated user.
