| Availability |
Odoo Online
Odoo.sh
On Premise
|
| Odoo Apps Dependencies |
Discuss (mail)
|
| Lines of code | 2606 |
| Technical Name |
alpenglow_mcp |
| License | OPL-1 |
| Website | https://www.aglow.dev |
| Versions | 18.0 19.0 |
| Availability |
Odoo Online
Odoo.sh
On Premise
|
| Odoo Apps Dependencies |
Discuss (mail)
|
| Lines of code | 2606 |
| Technical Name |
alpenglow_mcp |
| License | OPL-1 |
| Website | https://www.aglow.dev |
| Versions | 18.0 19.0 |
M/09 — Alpenglow module
Alpenglow MCP Connector gives AI assistants like Claude, Cursor, and VS Code secure, controlled access to your Odoo database. Ask questions, look up records, create invoices, and run reports through natural conversation.
2
Steps from install to connected
9
Tools: search, CRUD, aggregation
3
APIs: MCP, REST, XML-RPC
12
Step access check on every request
01 — Setup
From install to connected in three steps.
S/01
Run the setup wizard
Enable MCP access and select which Odoo models the AI can see. One screen, no configuration files.
S/02
Generate a credential
The credential wizard creates an API key and produces a ready-to-paste JSON config for your AI client.
S/03
Connect the AI client
Paste the config into Claude, Cursor, or VS Code. The assistant can now read and act on your Odoo data.
No guesswork needed.
The credential wizard includes a built-in configuration generator. Select your AI client type, and it produces a ready-to-paste JSON config with your connection details already filled in.
02 — Schema intelligence
The AI gets field types, relationships, and selection options. Not just raw data.
Most connectors pass raw values back and forth. Alpenglow MCP Connector exposes a describe tool that returns field types, required flags, selection options, relationships to other models, record counts, and example filters.
The AI writes correct queries on the first try instead of guessing field names and failing.
03 — Aggregation engine
Nine aggregation operations for reporting in conversation.
Ask “What were our top 10 products by revenue last quarter?” or “Show me a monthly sales trend for this year.”
The aggregation engine supports group_by, top-N, pivot tables, time-series trends, plus count, sum, average, min, and max.
Reporting questions get answered without opening a single Odoo view.
04 — Access control
Expose only what you choose, at every level.
Choose which models to expose, which CRUD operations to allow, and which fields are visible. Use allowlists to expose only specific fields, or denylists to hide sensitive ones.
Add domain filters to restrict which records the AI can see. For example, only active customers, or only orders from this year.
Each credential can be further scoped to read-only, with an optional expiration date.
05 — Three interfaces
MCP, REST API, and XML-RPC. One configuration, three protocols.
The MCP endpoint works natively with Claude, Cursor, and VS Code. The REST API exposes standard HTTP verbs for custom integrations, scripts, and dashboards.
The XML-RPC proxy wraps Odoo’s native protocol with the same access controls, so legacy tools and existing integrations get the same security guarantees.
All three share the same access-control pipeline, rate limiting, and audit logging.
06 — Audit trail
Every request logged. Every session visible.
Each API request is recorded with the user, credential, IP address, model, operation, record count, and response time. View the log as a list, graph, or pivot to spot trends and anomalies.
An active sessions dashboard shows who is connected right now, from which IP, and how many requests they’ve made.
Logs are pruned on a configurable retention schedule. 30 days by default.
07 — Security
A twelve-step access check on every request.
Exposing ERP data to an AI demands serious security. Every request passes through a layered pipeline before a single record is touched. Alpenglow MCP Connector never bypasses Odoo’s built-in security — it adds restrictions on top.
SEC/01 — PIPELINE
Access control
- Global on/off toggle
- Credential validation & expiration check
- Scope enforcement (full or read-only)
- Per-model CRUD permissions
- Read-only override at the resource level
- Field-level allowlist / denylist
- Domain filter injection
SEC/02 — NATIVE
Odoo enforcement
- All requests run as a real Odoo user
- Native ACLs (
ir.model.access) enforced - Record rules (
ir.rule) enforced - Multi-company isolation preserved
- Two security groups: Viewer and Manager
SEC/03 — LIMITS
Rate limiting
- Database-backed sliding window (multi-worker safe)
- Separate limits for standard vs aggregation requests
- Per-IP auth-failure throttling
- 13 audit event types
- Live session monitoring
- XXE protection on XML-RPC via
defusedxml
08 — Compatible clients
Any MCP-compatible AI assistant.
The credential wizard generates a ready-to-paste configuration for each client. Not using MCP? The REST API and XML-RPC proxy work with any HTTP client, scripting language, or automation platform.
C/01
Claude Desktop
Full MCP support
C/02
Claude Code
CLI & IDE
C/03
Cursor
Full MCP support
C/04
VS Code
Copilot & Continue
C/05
Any MCP client
Open protocol
09 — Use cases
Three examples to get started.
U/01 — REPORTING
“Show me this quarter’s top 10 customers by revenue, and compare it to last quarter.”
The AI calls top_n on sale.order, groups by partner, and compares two periods in a single response. No custom report, no spreadsheet export. Ask follow-ups in the same conversation.
U/02 — WORKFLOW
“Find all products below their reorder point and create a draft purchase order.”
The AI searches product.product for items where on-hand quantity is below the minimum, identifies preferred vendors, and creates PO lines, with explicit confirmation before anything is written. Give the team read-only credentials for lookups and a full-access credential to the purchasing manager.
U/03 — SUMMARY
“Summarize all open helpdesk tickets, grouped by priority and team.”
The AI uses group_by to break down open tickets by priority and team, then reads the high-priority ones in detail for a written summary. Reassignments and status updates flow through the same conversation, fully audit-logged.
10 — Frequently asked questions
Common questions before you install.
| Question | Answer |
|---|---|
| Community or Enterprise? | Both. Works on Odoo Community and Enterprise editions. |
| Can the AI modify data? | You choose. Each model can be configured for any combination of read, create, update, and delete. Read-only mode can be enforced globally, per resource, or per credential. New resources default to read access only. Writes must be explicitly enabled. |
| Does it bypass Odoo’s security? | No. Every request runs as a real Odoo user. Native ACLs, record rules, and multi-company isolation are fully enforced. Alpenglow adds restrictions on top. It never loosens existing permissions. |
| Which AI models are supported? | Any AI that speaks MCP, including Claude, GPT (via compatible clients), Gemini, and others. The REST API and XML-RPC proxy work with any language or HTTP client. |
| Python packages on the server? | The module requires defusedxml, a standard security library. The client-side bridge installs itself via uvx. No manual Python setup required. |
| Different users, different access? | Each credential is tied to a specific Odoo user with its own scope and expiration. Because requests run under that user’s permissions, different users naturally see different data based on their existing Odoo access rights. |
| Rate limits across workers? | Limits are stored in the database using a sliding window, not in memory. Enforcement is correct under multiple workers or a load balancer. Defaults: 300 requests/minute standard, 60/minute aggregation, both configurable. |
| How do I see what the AI did? | Every request is recorded in the audit log with user, credential, IP, model, operation, record count, and response time. View as list, graph, or pivot. The active sessions dashboard shows live connections. |
11 — Support
Questions or issues, we answer every one.
Email [email protected] for support.
For full documentation visit aglow.dev/docs/alpenglow-mcp/.
More Alpenglow modules at aglow.dev.
Alpenglow MCP Connector is developed and maintained by Alpenglow Technologies LLC. Provided “as is” without warranty of any kind.
Alpenglow MCP Connector
Connect AI assistants — Claude Desktop, Claude Code, Cursor, VS Code Copilot, or any MCP-compatible client — to your Odoo instance through the Model Context Protocol.
Tip
Full documentation — configuration reference, API details, security model, and troubleshooting — is available at aglow.dev/docs/alpenglow-mcp.
Quick Start
Step 1 — Install defusedxml
This module requires the defusedxml Python package on the server.
Odoo.sh — add defusedxml to the requirements.txt file in the root of your repository and push. Odoo.sh installs it automatically on the next build.
Self-hosted / on-premise — install it in the same Python environment that runs your Odoo server:
pip install defusedxml
Step 2 — Install the Module
- Copy the alpenglow_mcp folder into one of your Odoo addons paths.
- Restart the Odoo server.
- Go to Apps, search for Alpenglow MCP Connector, and click Install.
Step 3 — Run the Setup Wizard
- Go to Settings > Alpenglow MCP.
- Enable MCP Access and click Save.
- Click the Setup Wizard button that appears.
The wizard walks you through:
- Enable MCP Access — toggle on.
- Select Models — pick the Odoo models AI assistants can access (e.g. res.partner, sale.order, product.product).
Step 4 — Install the Bridge
The bridge (alpenglow-mcp-bridge) runs on your workstation and translates between the MCP protocol and HTTP requests to Odoo. Install it with uv:
macOS / Linux:
curl -LsSf https://astral.sh/uv/install.sh | sh
Windows (PowerShell):
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
Restart your terminal after installing uv. You do not need to install the bridge manually — uvx downloads and runs it automatically.
Step 5 — Generate an API Credential
- Open Settings and find Alpenglow MCP in the top menu bar.
- From the dropdown select Generate Credential and follow the steps.
- Name the credential, choose Full Access or Read-Only, then copy the API key immediately — it will not be shown again.
Step 6 — Configure Your AI Client
Paste the JSON configuration from the wizard into your client's config file. The config looks like this (the wizard fills in your actual values):
{ "mcpServers": { "alpenglow-odoo": { "command": "uvx", "args": [ "alpenglow-mcp-bridge", "--url", "https://your-odoo.com", "--db", "your-database", "--token", "YOUR_API_KEY_HERE" ] } } }
Where to paste depends on your client:
- Claude Desktop — Settings > Developer > Edit Config
- Claude Code — claude mcp add alpenglow-odoo -- uvx alpenglow-mcp-bridge --url ... --db ... --token ...
- Cursor — Settings > MCP Servers
- VS Code — .vscode/mcp.json in your workspace
Step 6 — Verify
Restart your AI client and try:
- "What Odoo models are available?"
- "Search for the first 5 contacts"
If the AI returns data from your Odoo instance, you're connected.
Available Tools
The bridge registers 9 tools with your AI client:
| Tool | Description |
|---|---|
| alpenglow_list_models | List all available Odoo models and their permissions |
| alpenglow_describe | Get full schema for a model (fields, types, relationships) |
| alpenglow_search | Search records with domain filters, pagination, and sorting |
| alpenglow_read | Read specific records by ID |
| alpenglow_create | Create one or more records |
| alpenglow_update | Update records by ID |
| alpenglow_delete | Delete records by ID |
| alpenglow_aggregate | Run reporting queries (count, sum, avg, group_by, trend, etc.) |
| alpenglow_execute | Call a whitelisted ORM method on a model |
Troubleshooting
- uvx not found
- uv is not installed or not on your PATH. Reinstall and restart your terminal.
- defusedxml not met
- Install the package in your Odoo server's Python environment: pip install defusedxml
- "MCP access is not enabled"
- Go to Settings > General Settings > Alpenglow MCP and toggle on.
- "Authentication required" / 403
- Verify the API key, check the credential is not revoked or expired, and confirm the linked Odoo user is active.
For additional troubleshooting, configuration options, API reference, and security details, see the full documentation.
License
Alpenglow MCP Connector is proprietary software licensed under OPL-1 (Odoo Proprietary License v1.0). See the LICENSE file for details.
Odoo Proprietary License v1.0 This software and associated files (the "Software") may only be used (executed, modified, executed after modifications) if you have purchased a valid license from the authors, typically via Odoo Apps, or if you have received a written agreement from the authors of the Software (see the COPYRIGHT file). You may develop Odoo modules that use the Software as a library (typically by depending on it, importing it and using its resources), but without copying any source code or material from the Software. You may distribute those modules under the license of your choice, provided that this license is compatible with the terms of the Odoo Proprietary License (For example: LGPL, MIT, or proprietary licenses similar to this one). It is forbidden to publish, distribute, sublicense, or sell copies of the Software or modified copies of the Software. The above copyright notice and this permission notice must be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Please log in to comment on this module