Configure read, create, write, and delete access individually for each Odoo model that AI clients may interact with. Permissions are set through MCP Server settings with independent flags per operation type.
Why it matters: You maintain precise control over exactly what AI can do in your system — no blanket access, no assumptions.
AI clients authenticate using Odoo's built-in API key system with bearer token support. No separate credential store, no third-party identity provider, and no custom authentication flow to maintain.
Why it matters: You eliminate credential management complexity while using auth your team already understands.
Every MCP request is recorded with the authenticated user, source IP address, target model, full request payload, server response, and execution duration. Logs provide a complete forensic record.
Why it matters: When compliance, security, or troubleshooting requires knowing exactly what happened — you have the answer immediately.
Requests are throttled at two levels: 100 per minute per authenticated user and optionally 50 per minute per IP address. This prevents any single client from consuming excessive server resources.
Why it matters: Your Odoo instance remains responsive for human users even under heavy AI workload.
When a client exceeds rate limits, the system applies escalating suspensions — 5 minutes for first offense, 15 minutes for second, and 60 minutes for repeated violations.
Why it matters: Persistent abuse is contained automatically with increasing severity, protecting your infrastructure without manual monitoring.
Verified compatibility with Claude Desktop, ChatGPT, Cursor Editor, Windsurf, Jan, and Msty Studio. An additional OpenAI-compatible tools endpoint extends support to any function-calling AI client.
Why it matters: You're not locked into a single AI vendor — your team can use whichever tools best fit their workflow.
AI clients can perform search, read, count, grouping, create, write, delete, and model listing operations through standardized JSON-RPC 2.0 endpoints. All operations respect Odoo's native validation.
Why it matters: AI interactions behave identically to standard Odoo operations — triggering automations and maintaining data integrity.
Every operation processed through the MCP Server is subject to the authenticated user's existing Access Control Lists and record rules. The MCP layer adds permissions on top of — never instead of — Odoo's security model.
Why it matters: Your existing security architecture remains intact and authoritative.
Expired audit logs, stale rate limit counters, and elapsed blocks are cleaned up automatically by Odoo's scheduled action system. No manual database maintenance or cron configuration required.
Why it matters: The system remains performant over time without administrator intervention.
The module's administrative interface is available in German, Spanish, French, Japanese, and Arabic in addition to English, ensuring international teams can configure and monitor MCP access in their preferred language.
Why it matters: Global organizations can onboard administrators across regions without language barriers.
