Odoo MCP Server: How to Connect Odoo to Claude

Your Claude assistant has no idea what's happening in your Odoo instance. It can't see your sales pipeline, flag stuck projects, or run reports. Model Context Protocol (MCP) fixes this by letting Claude read and manage your Odoo data directly. This guide walks you through setting up MCP on a managed Odoo instance, securing your API keys, and troubleshooting common issues.

What Is Odoo MCP? (And Why Connect It to Claude?)

Odoo MCP is an API bridge that lets modern AI assistants talk to your Odoo database. It uses the Model Context Protocol, an open standard that Claude, ChatGPT, Gemini, and other AI tools understand natively. Instead of you copying data between tabs, you ask Claude: "What projects are overdue?" Claude queries Odoo directly and gives you the answer with context.

MCP solves a real problem for ops teams. Your AI doesn't know your business state. You spend time explaining context ("We just closed the Acme deal," "Sarah is out this week"). With MCP, Claude sees your Odoo models in real time. You get faster decisions, fewer mistakes, and less context-switching.

Example use case: You tell Claude, "Help me prioritize this week's calls." Claude searches Odoo for all new leads, checks their industry and value, checks your calendar against sales rep availability, and ranks them by both value and realistic close date. That takes you five minutes manually. Claude does it in 30 seconds.

Odoo MCP Across Versions: Native vs. Community

Odoo's MCP support varies by version. Knowing which one you run determines your setup path.

Odoo 20 (Enterprise only) ships with native MCP baked in. Anthropic worked with Odoo to add a native /mcp endpoint at the instance level. No modules to install. No third-party code. It uses JSON-RPC 2.0 and enforces read-first access by default: Claude can search records, inspect fields, and aggregate data, but cannot create or modify anything unless an admin explicitly grants write permissions. This is the cleanest path if you run Odoo 20 Enterprise on a managed host.

Odoo 16-19 (Community and Enterprise) rely on third-party modules or open-source projects:

• much. Consulting MCP module (Odoo App Store): A commercial module available for Odoo 18 and 19. Fully managed, official support, tested against Odoo's permission model.
• ivnvxd/mcp-server-odoo (GitHub, open-source): A community-maintained Python package with 411 stars and 2,500+ downloads as of February 2026. Runs in a separate process and connects to Odoo via RPC or direct database. More control, but requires infrastructure overhead and upkeep.
• other open-source bridges: Various implementations on GitHub; quality varies. Most assume developer-level knowledge.

For managed Odoo, stick to native (Odoo 20) or the official Odoo App Store module. Running your own open-source MCP server alongside a managed instance adds complexity and shifts security responsibility to you.

Choosing Your MCP Implementation

Your choice hinges on your Odoo version and your team's comfort with infrastructure.

If you run Odoo 20 Enterprise: Use the native MCP endpoint. Zero installation. Zero ongoing maintenance. Odoo handles security patches. You configure API keys and permissions in the Odoo UI. This is production-ready from day one.

If you run Odoo 18 or 19 Enterprise or Community: The much. Consulting module is the simplest path. It integrates into Odoo's permission system (same API key scoping, same group membership rules) and handles updates with each Odoo release. Cost: varies by Odoo version; check the Odoo App Store.

If you need maximum control or run older Odoo: ivnvxd/mcp-server-odoo is mature and well-documented. Run it in a Docker container, point it at your Odoo instance, and manage the lifecycle yourself. Requires someone to monitor it, update dependencies, and handle outages.

YOLO mode (development only): Both ivnvxd and some commercial modules offer "YOLO mode," which disables security controls (permission checks, API key validation, audit logging). Never use this in production. It exists for demos and local testing. The moment you hit YOLO mode on production data, your audit trail is worthless and your compliance team will know.

Prerequisites & Security Checklist

Before you set up MCP, lock down three things: infrastructure, API keys, and model access.

Infrastructure: Your Odoo instance must allow outbound HTTPS connections to your AI client (Claude Desktop, VS Code, Cursor). Most managed hosts allow this by default. If your Odoo is behind a firewall, ask your host or IT team to whitelist the MCP client's IP or allow HTTPS to port 443 outbound. Do not open ports inbound to the MCP endpoint; clients initiate the connection, not the reverse.

API Key Scoping: Create a dedicated API key for MCP. Do not reuse your personal key or an admin key. In Odoo, go to Settings > Users & Companies > API Keys > Create. Name it "Claude MCP" or similar. Set the "RPC" scope on Odoo 20 if available; on other versions, leave it unrestricted (the module or bridge will enforce permissions). Store the key in your password manager, not in files or environment variables left sitting in your terminal.

Model Access: Decide which models your MCP user can see. If you want Claude to read sales orders but not payroll, set up an Odoo "MCP User" group and assign only the necessary model access. This is done via Security > Groups > New Group > set Access Rights > apply to users. You can also use Record Rules to scope which records the MCP user sees (e.g., "Only sales orders created this quarter," "Only leads assigned to your sales team"). Record rules are enforced by Odoo's permission engine and will apply to MCP queries automatically.

Permissions Downgrade: MCP never escalates; it only downgrades permissions. If your MCP user account has "Create" and "Delete" on Sales Orders, Claude can create and delete them via MCP. If the account has "Read" only, Claude can only read. This is intentional: you control the ceiling, and MCP respects it.

Step-by-Step Setup for Managed Odoo

Here's the full walkthrough for Odoo 20 Enterprise on a managed host. Steps for older versions or open-source modules are similar; refer to your module docs for exact paths.

Step 1: Enable or Install the MCP Module

On Odoo 20 Enterprise, MCP is native. No installation. Skip to Step 2.

On Odoo 18 or 19, install the MCP module from the Odoo App Store: Apps > Search for "MCP" > Install "MCP Server" (or "much. MCP"). Odoo will restart the web server; this takes 30 seconds.

Step 2: Create an MCP-Dedicated API Key

1. Log in as an admin.
2. Go to Settings > Users & Companies > API Keys.
3. Click "Create."
4. Fill in: Name: "Claude MCP," Scope: "RPC" (if available).
5. Copy the key and paste it into a password manager. Odoo will not show it again.

Step 3: Create an MCP User Group and Assign Model Access

1. Go to Settings > Users & Companies > Groups.
2. Click "Create."
3. Name: "MCP User."
4. Access Rights: Check "Read" for Sales, CRM, Projects, Accounting, Inventory (or only the modules you want Claude to see). Leave "Write" unchecked unless you specifically want Claude to create records.
5. Save.

Step 4: Assign the MCP API Key to a Restricted User

1. Go to Settings > Users & Companies > Users.
2. Create a new user: Name: "Claude MCP Bot," Email: "claude-mcp@your-domain.local," Groups: add "MCP User."
3. Do not set a password (this user is API-only).
4. Assign the API key from Step 2 to this user.

Step 5: Test the Connection

On your machine, install the MCP client for your AI tool:

• Claude Desktop: Download from claude.com/download. On Mac, go to /Users/YourName/Library/Application Support/Claude/claude_desktop_config.json. Add the following configuration, replacing YOUR_ODOO_URL with your actual Odoo instance URL and YOUR_API_KEY with the key generated in Step 2:

{
  "mcpServers": {
    "odoo": {
      "command": "npx",
      "args": ["@muchconsulting/mcp-server-odoo"],
      "env": {
        "ODOO_URL": "YOUR_ODOO_URL",
        "ODOO_API_KEY": "YOUR_API_KEY"
      }
    }
  }
}

• Cursor or VS Code: Install via settings > Extensions > search "MCP Odoo" > Configure.

Restart your client. Open a conversation and type: "What models can you see in my Odoo instance?" Claude should list the models you granted in Step 4.

Step 6: Try a Real Query

Ask Claude: "Show me all sales orders from this month." If Claude returns results, MCP is working. If you get "permission denied," check that the MCP User group has "Read" access to the Sales module.

What Your MCP Server Can (and Cannot) Do

MCP enforces strict boundaries.

Read capabilities (always enabled, no admin approval needed):

• Search records by model (e.g., "Find all leads with status = won").
• Read field values and metadata (field type, constraints, help text).
• Aggregate data (sum revenue, count records, group by date).
• List models and their fields.
• Check record rules (who can see what).

Write capabilities (opt-in, admin must explicitly enable):

• Create new records (if the MCP User group has "Create" permission).
• Update existing records (if the MCP User group has "Write" permission).
• Delete records (if the MCP User group has "Delete" permission).

Odoo never escalates permissions. If your MCP User has "Read" only, Claude is locked to read-only no matter what it asks for. This is by design and enforced at the database level.

Limitations:

• MCP has no built-in audit logging separate from Odoo's audit trail. All MCP actions appear in Odoo's Activity logs, but you cannot filter "these logs were from MCP" at query time. Check your managed host's logging options.
• MCP has no rate limiting built-in. If Claude issues 1,000 queries in a minute, Odoo will process them. Use your AI client's settings or a reverse proxy to throttle if needed.
• MCP cannot interact with custom Python methods or crons. It reads and writes standard ORM methods only.
• MCP cannot access encrypted fields unless your instance is configured to decrypt them (rare).

Security & Audit Concerns for Production

MCP is secure by default, but production use requires discipline.

API Key Rotation: Rotate your MCP API key every 90 days. Go to Settings > Users & Companies > API Keys > select the key > delete and create a new one. Update your Claude config and restart the client. Old key expires immediately; you will get "permission denied" until you update your config.

Audit Trails: Every MCP query is logged in Odoo's Activity log. This includes search, create, update, and delete. The logs show: who (the MCP User), what (the model and record), when, and the change. If you need compliance reporting (SOC 2, GDPR, ISO 27001), ask your managed Odoo host if they export audit logs or retain them for a specified period. By default, Odoo keeps audit logs indefinitely unless you configure purging.

Record Rules & Multi-Company Scoping: If your Odoo instance serves multiple companies, use record rules to restrict what MCP can see. Example: Create a rule "MCP User can only read Sales Orders where company_id = My Company." This prevents Claude from seeing a competing company's data if they share the same instance.

GDPR & Data Residency: If your MCP queries pull PII (names, emails, phone numbers), ensure your AI client's data residency matches your legal requirements. Claude Cloud (free/pro) trains on data; Claude API (paid, self-hosted) does not. If you use Claude API, the data stays in Anthropic's infrastructure, which has SOC 2 Type 2 and ISO 27001 certification. Your managed Odoo host likely also has these certifications; check their compliance docs. Opsily's managed Odoo instances are GDPR compliant and hosted in certified data centers; contact our support team for data residency details.

Disabling MCP Temporarily: If you suspect an API key leak, immediately revoke it: Settings > Users & Companies > API Keys > delete. MCP will fail with "unauthorized" until you assign a new key. This is instant and requires no instance restart.

Troubleshooting: Common Issues on Managed Instances

"Connection refused" or "Timeout": MCP client cannot reach your Odoo instance. Check:

1. Is the instance URL correct? (Use your Odoo instance's actual domain, not http://)
2. Can you log in to Odoo manually? If yes, MCP should reach it.
3. Is your instance behind a corporate firewall? Ask your IT team to whitelist your AI client's IP.
4. Restart your AI client.

"API key not recognized" or "Permission denied": The key is invalid or has been revoked. Check:

1. Is the key copied exactly, with no extra spaces?
2. Has the key been deleted? Generate a new one in Settings > Users & Companies > API Keys.
3. Does the MCP User group have the correct access rights? Go to Settings > Users & Companies > Groups > MCP User > check Access Rights.
4. Has the RPC scope been applied? On Odoo 20, go to the API key and ensure "RPC" is checked.

"Model not found" or "No fields available": MCP can see the model but has no access. Check:

1. Is the model part of a module the MCP User can read? (e.g., MCP User must have "Read" on "Sales" to see sales orders).
2. Go to Settings > Security > Access Control > check the model > check MCP User group > ensure "Read" is checked.
3. If using record rules, ensure the rule does not block all records. Example: A rule like "created_date > today" will hide old records even from reads.

Slow queries or timeouts: MCP queries are hitting a large dataset or a slow database. Check:

1. Is the query filtering properly? Ask Claude to "search sales orders from 2026 only," not "all sales orders ever."
2. Is the database indexed? Your managed host's support team can check if critical fields lack indexes.
3. Are you making many nested queries? Example: "For each lead, fetch the associated company, then for each company fetch all contacts." This multiplies queries. Ask Claude to fetch leads first, then batch-fetch companies.

"YOLO mode enabled" errors: You or someone enabled YOLO mode in development and forgot to disable it. YOLO is for demos only. On ivnvxd/mcp-server-odoo, disable via environment variable: YOLO_MODE=false. On Odoo App Store modules, it is not exposed by default; contact the module vendor if you see this.

Frequently Asked Questions

What is the Odoo 20 MCP server?

The Odoo 20 MCP server is a native endpoint built into Odoo 20 Enterprise. It exposes a /mcp URL on your instance that speaks Model Context Protocol (JSON-RPC 2.0). Claude and other AI tools connect to this endpoint and query or modify Odoo data within the bounds of your API key's permissions. No module installation required.

Can the Odoo 20 MCP server write or edit data by default?

No. The Odoo 20 MCP server ships read-only. It allows Claude to search records, inspect fields, and aggregate data, but cannot create, update, or delete anything. An Odoo admin must explicitly grant write permissions via the MCP User group's Access Rights before Claude can modify data.

How does Odoo secure MCP assistant actions?

Odoo enforces three layers: dedicated API keys scoped for MCP use, permission downgrades to the MCP User's group level, and record rules that filter which records are visible. All MCP actions are logged in the Activity trail. No request bypasses the permission system.

Which Odoo versions support MCP?

Odoo 20 Enterprise has native, built-in MCP. Odoo 16, 17, 18, and 19 (Community and Enterprise) are supported via third-party modules like the much. Consulting MCP module on the Odoo App Store or open-source bridges like ivnvxd/mcp-server-odoo on GitHub.

What AI assistants can connect to Odoo MCP?

Claude Desktop, Claude Code, Cursor, VS Code Copilot, ChatGPT (with MCP plugin), Gemini, and any tool that implements the Model Context Protocol. Each client has its own configuration file where you paste the Odoo URL and API key.

How do I authenticate my Odoo instance to MCP?

Create a dedicated API key in Odoo (Settings > Users & Companies > API Keys > Create). On Odoo 20, ensure the "RPC" scope is selected. Assign the key to an MCP-specific user account with the "MCP User" group. Paste the key and your Odoo URL into your AI client's MCP config file.

What is YOLO mode in mcp-server-odoo?

YOLO mode is a development/testing feature that disables security controls (permission checks, API key validation, and audit logging). It is meant for local demos and prototyping only. Never enable YOLO mode on production or shared instances; it renders the audit trail useless and violates compliance standards.

The Bottom Line

Odoo MCP is the bridge between your business data and modern AI. It is most seamless on Odoo 20 Enterprise (native), but works on any version via modules or open-source projects. Setup takes 15 minutes: create an API key, set group permissions, add your instance to Claude's config, and test. Security is enforced by default: MCP respects Odoo's permission model and logs everything. For production use, rotate API keys quarterly, monitor audit trails, and use managed hosting with certified compliance (like Opsily's Odoo platform) to handle infrastructure security and data residency for you. Ready to connect Odoo to Claude? Head to Opsily's managed Odoo hosting to get started with a platform that includes audit logging, API key management, and support for secure MCP deployments.