AI MCP (BytesRaw)
Model Context Protocol for Odoo: consume remote MCP tools and expose Odoo tools to external agents
Model Context Protocol,
in both directions.
As a client, AI MCP turns a remote MCP server into an Odoo record: give it a URL and an optional bearer token, click Import Tools, and that server’s tools become entries in the AI tool registry. From that point an agent uses a remote tool exactly like a local one — same argument validation, same confirmation gate, same audit row.
As a server, it publishes an endpoint so Claude Code, Claude Desktop or any MCP-capable runtime can call your Odoo tools. Authentication is an ordinary Odoo API key that resolves to a real user, and the call then runs with that person’s rights. There is no anonymous access and no service account — the governance you configured for the in-app agent applies unchanged to an external caller.
Remote Tools, Local Behaviour
A tool on someone else’s MCP server arrives in your registry as a first-class tool. Add it to an agent’s tool list and it works like everything else, including the human confirmation step and the tool audit log.
Your Odoo, From Your Desktop Agent
Point Claude Desktop or Claude Code at your Odoo instance and let it search records, read data or run the tools you chose to expose — as you, with your access rights, and with every call recorded.
Opt-In on Both Sides
A remote server can never shadow one of your tools: imported names are namespaced with the server’s prefix. And a local tool is only reachable from outside once you explicitly tick Expose over MCP — being callable by an in-app agent is not consent to being callable from the internet.
One protocol.
Two directions. No shortcuts.
Eleven capabilities, all built on the same rule: whichever side of the boundary a tool lives on, it is validated, user-bound, gated and audited.
MCP Servers as Records
Each remote server is a record with a name, endpoint URL, namespace prefix, a manager-only bearer token, and a Confirm by Default setting. A stat button shows how many tools it has contributed, and the last sync time is stamped on the record.
One-Click Discovery and Refresh
Import Tools performs the MCP handshake, lists the server’s tools and imports each one with its description and input schema. Running it again refreshes what changed and removes tools the server no longer offers, so your registry never drifts from reality.
Test Before You Trust
Test Connection performs the handshake alone and reports the server name and negotiated protocol version, so you can confirm the URL and token are right before importing anything.
Namespaced Tool Names
Imported tools are prefixed with the server’s namespace, so a remote update-record tool can never be mistaken for — or shadow — your own. The prefix is yours to choose per server.
Remote Tools Confirmation-Gated by Default
Newly imported tools require human confirmation, because per-user access enforcement stops at the network boundary and a third-party endpoint’s behaviour is not something Odoo can reason about. You can opt out per tool once you know what it does.
Transport Details Handled
The client speaks JSON-RPC 2.0 over the Streamable-HTTP transport, completes the full three-step handshake, carries the session id header for stateful servers, negotiates the protocol version, and reads replies from either a plain JSON body or an SSE stream — so strict implementations work without special-casing.
Expose Your Tools Over MCP
Every registry tool gains an Expose over MCP flag. Ticked tools are listed by the endpoint; everything else is invisible to external callers, regardless of what an agent inside Odoo can use.
API-Key Authentication to a Real User
External callers authenticate with an Odoo API key scoped to odoo.mcp, presented as a bearer token. The key resolves to a real user, who must additionally hold the AI / User privilege. Revoking access is the user’s existing “delete this key” flow.
Identical Governance for External Calls
A tool call arriving from Claude Desktop runs through the same registry execution path as an in-app agent: arguments validated against the schema, execution bound to the authenticated user so record rules and field-level groups apply, the confirmation gate honoured, and a row written to the tool audit log.
Rate Limiting Per Key
The endpoint is rate-limited per authenticated user, counted after authentication so an unauthenticated flood cannot fill someone else’s window, and applied to every method so cheap calls cannot be used to pad out a burst. Callers over the limit get a proper JSON-RPC error and HTTP 429.
A Tidy Menu
Installing this module gathers MCP servers and the AI tool registry under a single AI → MCP menu, so everything protocol-related lives in one place.
Two directions,
configured separately.
Consuming a remote server and exposing your own tools are independent — set up either, or both.
Open the list
Go to AI → MCP → MCP Servers and click New.
Point it at the endpoint
Enter the URL and, if required, the Bearer Token — visible only to AI managers.
Choose a namespace
Set the Prefix used to name imported tools.
Test, then import
Click Test Connection, then Import Tools, then add them to an agent’s Registry Tools.
Choose what to expose
Tick Expose over MCP on each registry tool an external agent may call. Nothing is exposed by default.
Grant AI access
The user whose key will be used needs the AI / User privilege.
Mint an API key
On that user’s profile, under Account Security, create a key with the scope odoo.mcp.
Point your client at Odoo
Configure the MCP client with your Odoo endpoint and an Authorization: Bearer header.
See it in action
Connecting a remote server and using its tools.
Three workflows, end to end
Give an agent a remote capability, drive Odoo from an external agent, and review what you imported.
Give an Agent a Remote Capability
Extend an Odoo agent with tools that live on someone else’s server.
Use Odoo From Claude Desktop or Claude Code
Drive your Odoo data from an external agent, with your own rights.
Review What a Remote Server Can Do
Decide which imported tools are safe to hand to an agent.
Full transparency
The current limitations, stated plainly.
Enforcement stops at the network boundary
Odoo can guarantee that a remote tool is called on behalf of a specific user, but it cannot control what that remote server does with the request. This is exactly why remote tools are confirmation-gated by default. Treat a remote MCP server as an integration you are authorising, not as a sandbox.
Remote descriptions are data, but still influence
A remote server’s tool descriptions and schemas are passed to your model, never executed as instructions by Odoo. Even so, a hostile description is an attempt to influence your agent’s behaviour — one more reason to read what you import.
A fixed set of protocol methods
The endpoint speaks initialize, tools/list, tools/call and ping. MCP resources, prompts and change notifications are not implemented in this version.
Rate limiting is not a spend cap
It bounds request frequency per key. Combine it with a Daily Token Budget on the provider connection if external calls can trigger model usage.
Questions, answered
Quick answers to the questions buyers ask most.
What is MCP?
The Model Context Protocol is an open standard for exposing tools to AI agents over JSON-RPC. It lets an agent discover what a system can do and call it in a uniform way, whichever runtime the agent lives in.
Does an external caller get admin rights on my database?
No. The API key resolves to a real Odoo user, and the call runs as that person — record rules, model access and field-level groups all apply. The user must also hold the AI / User privilege.
Which of my tools are reachable from outside?
Only the registry tools you explicitly ticked Expose over MCP. Nothing is exposed by default, and being usable by an in-app agent does not make a tool externally reachable.
Can a remote server override one of my tools?
No. Every imported tool name is prefixed with the server’s namespace, so collisions are impossible by construction.
How do I revoke an external agent’s access?
Delete the API key from the user’s Account Security page. There is no separate credential store to clean up.
Are external calls audited?
Yes — identically to in-app ones. Each call writes a row to AI → Configuration → Tool Logs with the tool, user, arguments, output and status.
Do I need to install anything extra?
No. The client uses requests, which already ships with Odoo, and the server is a standard Odoo controller.
Release history
A clean record of every release.
Bytesraw
🛠️ Need help?
Got a question, found a bug, or need a custom enhancement? Our support team responds within 24 hours on business days.
help@bytesraw.com →💼 Custom development
Need this module tailored to your workflow, or a brand-new Odoo solution? Let’s talk about your project.
info@bytesraw.com →| Availability |
Odoo Online
Odoo.sh
On Premise
|
| Community Apps Dependencies | Show |
| Lines of code | 6370 |
| Technical Name |
ai_mcp_bytesraw |
| License | OPL-1 |
| Website | https://www.bytesraw.com |
Odoo Proprietary License v1.0 This software and associated files (the "Software") may only be used (executed, modified, executed after modifications) if you have purchased a valid license from the authors, typically via Odoo Apps, or if you have received a written agreement from the authors of the Software (see the COPYRIGHT file). You may develop Odoo modules that use the Software as a library (typically by depending on it, importing it and using its resources), but without copying any source code or material from the Software. You may distribute those modules under the license of your choice, provided that this license is compatible with the terms of the Odoo Proprietary License (For example: LGPL, MIT, or proprietary licenses similar to this one). It is forbidden to publish, distribute, sublicense, or sell copies of the Software or modified copies of the Software. The above copyright notice and this permission notice must be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Please log in to comment on this module