Connecting External AI Tools to Odoo 20 with MCP

Odoo 20's AI story has two halves. The first is Odoo's own agents, which live inside your database and run on IAP credits. The second is a single line in the release notes, filed under “Connect Odoo to anything”: Connect to your database via MCP (model context protocol). That line reverses the direction of travel. Instead of Odoo calling an AI, your own AI assistant connects to Odoo: the database itself acts as an MCP server, and an external agent such as Claude Code, Codex, or Antigravity can read the database — and, if you allow it, modify it — using your own local AI workflows. There is no middleware bridge to install and no third-party connector module to maintain; the capability is part of Odoo AI in version 20 and is fully documented in the 20.0 documentation. This article explains how it works, how to connect a client safely, and where the control points are.

Diagram showing external AI assistants connecting to Odoo 20 via MCP with OAuth or API keys, under user access rights and a read-only default tool set

What MCP is, in plain terms

Model Context Protocol is an open-source standard that allows large language models to securely interact with external applications and access their data. Three roles matter. The client is the AI application you actually talk to — your coding assistant or chat agent. The server is the system being connected to, here your Odoo database. Between them sit tools: named, permissioned operations the server exposes, which the client can invoke on your behalf. The defining trait of the experience is that you never see the plumbing. As Odoo's documentation puts it, the exchange happens internally and invisibly; the user interacts with the client only by prompting it with tasks in plain language, and the client works out which tools to call.

How a session works

Odoo documents the workflow as a five-step sequence:

You configure the client with the server details and an authentication key. On connecting, the client automatically requests the list of AI tools (server actions) the database exposes to it, and caches them for the session.
You prompt the client in plain language — the documentation provides a list of example prompts, several of which appear below.
The client requests that the server invoke the correct tools for the task.
The server executes the tools and returns the results to the client.
The client answers your prompt in plain language.

Everything the assistant can do is bounded by that tool list, which is why the tool configuration — covered below — is the real security decision in an MCP rollout.

Connecting a client: OAuth or an API key

The server endpoint is simply your database URL with /mcp appended — for example, https://example.odoo.com/mcp. Odoo supports two authentication routes. OAuth is the recommended one: you add the server in the client (in Claude Code, claude mcp add --transport http <server_name> <database_url>/mcp, then claude mcp list to check the connection), the client opens Odoo's login page in a browser, and a Grant Access page shows which client is asking, lets you choose how long access remains valid, and takes effect when you click Allow. Only approved clients can request access this way — administrators review and add approved clients by their Client ID Metadata Document (CIMD) URL in the settings. There is also an option to allow Dynamic Client Registration, which lets any MCP client register itself; the documentation carries an explicit warning here, so leave it off unless you understand the trade-off. OAuth is available to internal users only.

Portal users — and anyone who prefers a static credential — use an API key instead. The key is created from the user menu under My Preferences, on the Security tab, via Create API Key: confirm the account password, then give the key a name, select the MCP scope, and choose an expiry (the documentation's example is one month). The key is shown only once, so save it immediately. API-key connections need Node.js on the client machine, because desktop clients reach the remote server through the mcp-remote helper: in Claude Desktop you edit claude_desktop_config.json to launch npx -y mcp-remote <database_url>/mcp with an Authorization: Bearer <API_KEY> header, and Claude Code offers an equivalent claude mcp add --transport stdio command. Either way, every request the client sends is authenticated as that key's owner, carrying that user's identity and permissions in the database.

Tools: read-only until an administrator says otherwise

MCP tools in Odoo are server actions, and the default exposure is deliberately conservative. Out of the box, a database exposes exactly five tools, all read-oriented:

AI Tool: Get Fields — inspect a model's fields
AI Tool: Get Models — list the models in the database
AI Tool: MCP Retrieve initial context — session context for the client
AI Tool: Search — find records
AI Tool: Read group — grouped, aggregated reads

All other tools stay hidden from the client until an administrator exposes them: with developer mode on, open the server action, go to its Usage tab, and tick Available in MCP. The same tab offers a Readonly Tool checkbox, which tells the client the tool does not modify data and may be invoked automatically without user approval — by implication, write tools that lack that flag surface an approval step in the client before they run. Because the tools are ordinary server actions in Odoo's AI tool framework, administrators are not limited to the shipped set: custom tools can be built as server actions and exposed the same way, which is how an MCP rollout grows from “ask questions about the CRM” to carefully chosen, company-specific operations.

Permissions, expiry, and revocation

The safety model is reassuringly boring: the MCP server does not create a new privilege layer. Whether a client connects by OAuth or by API key, it authenticates as a specific user, and Odoo's documentation of the workflow is built around that identity — the agent works within the connected user's existing access rights, so it cannot read a model, open a record, or run an action that the user themselves could not. Layered on top of that are the tool controls above: a user with broad rights still only gets the tools an administrator exposed. Revocation is equally direct. Every MCP connection, OAuth or key-based, appears as an API key on the user's Security tab; delete the key and the access is gone. OAuth grants additionally expire after the duration chosen on the Grant Access page, at which point the client prompts the user to sign in again. Sensible rollout practice follows naturally: connect as a user whose rights match what you want the agent to do, start with the five default read tools, and expose write tools one at a time.

What it is good for

Odoo's documentation illustrates the intended uses, and they cluster into questions, edits, and light construction:

Analysis: “Show me my open opportunities grouped by stage, then chart the pipeline value by salesperson,” or “How much did we invoice last quarter compared to this quarter?”
Planning checks: “Which products on my Master Production Schedule have no forecast data, and what's my total forecasted demand this month?”
Data entry and fixes: “Create contacts for these five leads I'm pasting in,” or “Does this customer have a Tax ID on file? If not, set it.”
Navigation: “Filter this current view to my team and group by month instead.”
Website work: adding a promotional banner to the homepage, restyling product images, or generating an image for a hero section.

Positioned against Odoo's other machine interfaces, MCP fills a distinct niche. The built-in AI agents are Odoo-operated, run inside the database on IAP credits, and can be summoned by automated and scheduled actions for unattended work. JSON-2 is the deterministic, system-to-system integration API you would use for a warehouse sync or an e-commerce bridge. MCP is neither: it is the interactive, human-in-the-loop option, where a person explores live business data conversationally through an AI client they already pay for, with approvals in the loop for anything that writes. For Canadian businesses already experimenting with AI assistants, it is the lowest-friction way to let those assistants stop guessing about the ERP and start reading it — under your users' permissions, your tool list, and your ability to revoke access with one deleted key.