Enable the Server

1. Navigate to Settings → MCP Server.
2. Enable the toggle to activate the /mcp endpoint.

Configure Accessible Models

1. Go to MCP Server → Model Access Config.
2. Create a new record.
3. Select the model (e.g., res.partner).
4. Enable the required permissions:
   • Allow Read
   • Allow Create
   • Allow Write
   • Allow Delete
5. Save.

Tip: You may enable "Allow All Models (Read-Only)" in settings to provide read-only access globally without configuring each model individually.

Rate Limiting Settings

Go to MCP Server → MCP Settings -> Settings:

• Max Requests per Minute (Per User)
• Enable Per-IP Rate Limiting
• Max Requests per Minute (Per IP)
• Progressive Blocking Base Duration

Log Retention

Set the number of days to retain logs before automatic cleanup (default: 10 days).

Generate an API Key

1. Go to Settings → Users & Companies → Users.
2. Open your user profile.
3. Navigate to the API Keys tab.
4. Click New API Key and copy the generated value.

Use in Requests

Include the key in the Authorization header:

Authorization: Bearer <your-api-key>

Transport Methods

The MCP endpoint can be consumed using two common approaches:

1. Streamable HTTP (recommended for most setups)
2. Local MCP bridge (for desktop AI tools that require stdio transport)

Streamable HTTP Connection

For clients that support HTTP-based MCP connections:

• Endpoint: https://your-odoo-domain.com/mcp

• Method: POST

• Authentication: Bearer Token

• Header:

  Authorization: Bearer <your-api-key>

Your client must send JSON-RPC 2.0 formatted requests to the endpoint.

Example configuration structure:

{
  "mcpServers": {
    "odoo": {
      "type": "streamable-http",
      "url": "https://your-odoo-domain.com/mcp",
      "headers": {
        "Authorization": "Bearer <your-api-key>"
      }
    }
  }
}

Local MCP Bridge (stdio-based clients)

Some desktop AI tools rely on a local MCP bridge process.

In this case:

1. Install Node.js (if not already installed) on your local machine.
2. Configure your AI client to launch mcp-remote@latest using npx.
3. Provide your Odoo MCP endpoint URL (including /mcp).
4. Pass the API key securely using the Authorization header.

The local bridge will:

• Start a stdio server for your AI client.
• Forward JSON-RPC requests to your remote Odoo instance.
• Return responses (including streaming responses) back to the client.
• Preserve authentication and security validation on the Odoo side.

Example configuration structure:

{
  "mcpServers": {
    "odoo": {
      "command": "npx",
      "args": [
         "mcp-remote@latest",
         "https://your-odoo-domain.com",
         "--allow-http",
         "--header",
         "Authorization: Bearer <your-api-key>"
      ]
    }
  }
}

Security & Access Control

All requests are validated against:

• Model-level CRUD configuration
• Access Control Lists (ACLs)
• Record rules
• Rate limits and blocking policies

Verification

After configuration:

1. Test using the health tool.
2. Confirm that available tools are listed.
3. Execute a simple read query (e.g., fetch limited records from res.partner).

If the request succeeds, the client is correctly connected and authorized.

Data Retrieval

You can retrieve business data conversationally:

• "Show all vendors created in the last 30 days"
• "List purchase orders pending approval"
• "Find employees working in the Sales department"
• "Display invoices that are overdue by more than 15 days"
• "Get the top 5 customers by total revenue this quarter"
• "Check which products have zero stock in Warehouse WH/Stock"

Data Management

You can also create, update, and delete records:

• "Create a new vendor named Global Supplies with payment terms Net 30"
• "Update the price of product Ultra Laptop to 1250"
• "Assign salesperson Michael Scott to opportunity OP-2024-15"
• "Mark invoice INV/2026/045 as paid"
• "Add a new task under project Website Revamp with deadline next Friday"
• "Archive the inactive customer record Blue Ocean Traders"

Common Model Examples

Typical business interactions may involve:

• res.partner (Contacts & Customers)
• sale.order (Sales Orders)
• account.move (Invoices)
• product.product (Products & Inventory)

All operations strictly respect:

• Model-level CRUD configuration
• Odoo Access Control Lists (ACLs)
• Record rules
• Configured rate limits and progressive blocking

POST /mcp

Primary JSON-RPC 2.0 endpoint.

Headers:

Content-Type: application/json
Authorization: Bearer <api-key>

Supported Operations (via tools/call)

Example Request

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "id": 1,
  "params": {
    "name": "odoo_search",
    "arguments": {
      "model": "res.partner",
      "domain": [["is_company", "=", true]],
      "fields": ["name", "email", "phone"],
      "limit": 10
    }
  }
}