Let the AI propose. Let a human decide.
Other MCP servers ask the agent to confirm its own write â a prompt the same session answers, and a speed bump a confused agent will happily wave through. This module routes the write to a different person, in Odoo, with a current-vs-proposed diff. That is separation of duties, not a confirmation dialog.
Approval queueFlag a tool and the agent stops writing directly. Each change waits in a queue showing current value beside proposed value, field by field, for a manager to approve or reject. The review happens in Odoo, so it works with every MCP client â nothing depends on the client supporting elicitation prompts. |
Field-level controlName the fields an agent may read, the narrower set it may write, and a forbidden list that always wins. Enforced on the way out too â a restricted field is never returned. |
Tamper-evident audit
Every call recorded: who, which tool, which key, arguments, result, source
IP, duration, errors. Audit records cannot be edited or deleted through
Odoo â not even by an administrator, and not via |
Approval cannot become escalation
An approved call executes with the requesting user's rights, never the reviewer's. If the agent's user was not allowed to make the change, approving it fails and nothing is written. Without that rule, a restricted agent could reach manager privileges simply by asking and being waved through.
A policy on every key
- Scope â read-only, read & write, or full access
- Allowed tools â restrict a key to specific tools
- IP allowlist â CIDR ranges per key
- Rate limit â calls per key per hour
A key only ever sees the tools its scope permits â a read-only key is not shown the tools it would be refused. Unreviewed approval requests expire automatically.
What it looks like in Odoo
Governance that a manager can operate without reading a manual — ordinary Odoo screens, in the MCP menu.
Field-level control, per tool: what the agent may read, what it may write, and what it may never touch — here, tax ID and credit limit.
A policy on every key: read-only or read-write, the exact tools it may call, an IP allowlist, and a ceiling on calls per hour.
Every call an agent has made: when, which user, which tool, and whether it succeeded. Filter and group by tool, key or day.
And for any one of them: the exact arguments the agent sent, the response it got back, the records touched, the duration and the source IP.
Compatibility
- Odoo 19 Community & Enterprise
- Applies to every MCP client and to the n8n bridge
Odoo Dependencies
- AI Agent Connector (
odoo_mcp_base) â required
Support & Assistance
Need help designing an approval policy or scoping keys for your team?
For questions, issues or feature requests, get in touch.
| Availability |
Odoo Online
Odoo.sh
On Premise
|
| Community Apps Dependencies | Show |
| Lines of code | 1538 |
| Technical Name |
odoo_mcp_security |
| License | OPL-1 |
Odoo Proprietary License v1.0 This software and associated files (the "Software") may only be used (executed, modified, executed after modifications) if you have purchased a valid license from the authors, typically via Odoo Apps, or if you have received a written agreement from the authors of the Software (see the COPYRIGHT file). You may develop Odoo modules that use the Software as a library (typically by depending on it, importing it and using its resources), but without copying any source code or material from the Software. You may distribute those modules under the license of your choice, provided that this license is compatible with the terms of the Odoo Proprietary License (For example: LGPL, MIT, or proprietary licenses similar to this one). It is forbidden to publish, distribute, sublicense, or sell copies of the Software or modified copies of the Software. The above copyright notice and this permission notice must be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Please log in to comment on this module