Connecting to Odoo 20's native MCP, the steps are reassuringly short: My Preferences → Security → Add API Key, select MCP for scope, the endpoint is just the database address with /mcp appended, the system shows the key once, save it in your password manager, and you're done. No need to install an app, and no need to host a separate service.
The problem comes after the work is done. This key inherits the Odoo permissions of the bound user. If, to save trouble, you bind an administrator account with write access to all modules, then from the very first second the assistant connects, it has every capability that account has—including changing price lists, confirming sales orders, and generating and posting vouchers. The "read-only" marker in the protocol cannot stop it.
The BiztechCS integration guide lists four common mistakes, three of which are related to permissions: multiple assistants reusing the same key, scopes being granted more broadly than the task requires, and forgetting the key's expiration time. I treat it as the most valuable configuration checklist this week. The barrier to connecting AI to ERP has already dropped to a matter of minutes, but how wide the door is opened is still decided by people.
Third-party applications related to MCP on the Odoo Apps marketplace (October 2026 snapshot) — the ecosystem is lively, but you have to judge trust levels yourself
1. MCP defines the interface format, not the permission policy
This judgment comes from the 2027 planning guide verified by Metanow on November 6, and the original text also added: MCP does not guarantee behavioral safety either; every connection still needs authentication, permission restriction, validation, and monitoring. In the Odoo context, it can be translated into the simplest rule: The ACL of the core system is the ACL of the agent.
The official Odoo 20 documentation is not symmetrical in its attitude toward the two assistants. Claude has a dedicated integration section, covering Desktop and Code CLI; once connected, it can read and write, depending on the key permissions; ChatGPT's research connector is designed around two read-only tools, search and fetch, and to write records you have to go through developer mode (for eligible plans) or build it yourself using the API. The reminder in the guide is very practical: don't treat ChatGPT's connection steps as a replica of Claude's—much of the disappointment at launch comes from this: during the demo it was said to be able to create records, but in reality it can only query.
| Connection object | Odoo Official Documentation Coverage | What can you do after connecting? |
|---|---|---|
| Claude (Desktop / Code CLI) | There is a dedicated section, officially tested. | key readable and writable within the permission scope |
| ChatGPT Research Connector | Not listed in the document | Two read-only tools: search, fetch |
| ChatGPT write | Requires developer mode or self-built | Depends on eligible plans and custom builds |
| Third-party Odoo MCP (e.g., tuanle96/mcp-odoo) | Community maintenance | Read-only, but uses XML-RPC plaintext password |
The third-party ecosystem needs to be weighed separately. Both CorpusIQ and tuanle96/mcp-odoo build “read-only” into their designs: the former explicitly states that it does not confirm orders, post entries, or move inventory, and keeps operation logs for 30 days; the latter requires zero Odoo-side configuration and supports versions 16 and above, but Odoo.sh compatibility has not been confirmed, and permissions are likewise bound to authenticated users. On November 2, M8ven read the code of another Odoo MCP Server and gave it a grade of C; the reasons included no test files, no LICENSE, and reading only a single ODOO_API_KEY environment variable—static analysis found no leakage, but whether a project with 0 stars, 0 forks, and a single contributor can go into production is something you have to decide for yourself.
There is another easily overlooked item at the network layer. DO IT GLOBAL reminds: connections to remote MCP servers are initiated from Anthropic's cloud side; just because an office laptop can access ERP does not mean the cloud connector can access your MCP Server. ERP can stay safely within the internal network, but you need to plan a separate reachable path for this connection. The so-called 'local deployment' and 'externally reachable' are two different things.
Don't treat read-only as a lock.In native MCP, whether writing is possible depends on the user behind the key, not on a flag in the protocol. Locking first and opening later is much cheaper than chasing logs after the fact.
II. Make 'read-only' the default, not a prompt
Supply'd releases V5.5 of its ERP for the food industry, with three new things: Ask Supply'd lets you query inventory, costs, and purchasing records in natural language; Expense Agent is in private beta, handling categorization and reconciliation of supplier invoices and purchase orders; the read-only MCP lets external assistants read real-time data. The report states clearly that read-only is "a deliberate architectural decision"—not allowing cost and supplier information to move into third-party environments.
Why so conservative? In the food industry there are catch weights, batch traceability, and yield calculations; the data structures are different from those of general ERP, and applying AI on top easily leads to errors; when errors hit costs or supplier prices, the price is especially direct. So opening a read-only access point first is more reliable than writing “please do not modify records” ten times in the prompt. Prompts are requests; permissions are constraints.
Microsoft has taken another route: rather than making the opening smaller, it makes it finer-grained: Dynamics 365 CX MCP Server – Sales is now generally available, providing 59 tools at once that can be combined to look up opportunities, recalculate prices, generate quotes, and convert them into orders; it reuses existing Dataverse permissions, and authentication is uniformly consolidated into the Microsoft-hosted Agent 365 Tooling Gateway. There are many tools, but each tool's boundaries and who is invoking it are clear.
Few but read-only
Supply'd: a read-only connection, data does not leave the third-party environment
Many but manageable
Microsoft: 59 tools GA, authentication and permissions consolidated into a unified gateway
The two approaches are different, but what they have in common is turning connection from 'a project' into 'a standard component.' For Odoo users, there are four actionable steps that can be copied, and none require writing code:
- Generate a separate key for each assistant and attach it to a different Odoo user, so that if a problem occurs, only one of the connections can be revoked.
- Set the shortest feasible validity period, and record the expiration date in the ops calendar—the key expires silently, and from the assistant side it looks exactly the same as “the connector is broken.”
- Start with a read-only account for two or three weeks first, get a clear picture of which models it reads and what it asks, then decide whether to enable write permissions.
- Grant write permissions according to the task, not for “convenience.” If you need to generate a quote draft, don’t casually include posting permissions as well.
3. Once connected, the bill is calculated by action
Once the connection becomes invoked per action, the cost also follows a per-action basis. Business Central 2026 Wave 2 (v29) has broken down the Copilot Credits of four agents to this granularity:
| Agent | Maturity (2026-11) | Billing basis |
|---|---|---|
| Sales Order Agent | Officially available | 2–5 points per step, a basic request is about 14 points |
| Payables Agent | Officially available | 50 points per invoice + 5 points per line, generate unposted drafts only |
| Expense Agent | Production-Ready Preview | 50 points per receipt |
| Custom agents | Preview, sandbox design only | Toolkit rates have not yet been announced |
One prerequisite should not be missed: these agents only run on Business Central online and are not available for on-premises deployments. Ignite on November 17–20 may still adjust several of them, so leave some margin when budgeting.
You can compare this on Odoo's side. Built-in AI uses IAP credits, with 20 free credits per database, low-balance alerts, and optional auto-recharge, but no monthly spending cap; installing the AI app on Standard triggers an upgrade to Custom, and the license fee for each full user increases accordingly; for self-hosting to use AI document retrieval, you must first install PostgreSQL's pgvector extension. The partner's cost-control actions are very specific: buy in small 100-credit packs (the unit price is the same across tiers; larger packs only increase risk), set alert thresholds and add the finance lead as a recipient, turn off auto-recharge initially, check the scheduled job that fills empty AI fields daily, limit agent trigger frequency, assign a cost owner for each AI workflow, and use the "hours saved" each month to reconcile.
Follow up on last week's topic. The November 6 article about DualEntry charging by workload said the pricing model was moving from seats to output; this week's public unit price list pushes it to 'how much per step, how much per document.' The same question has moved down one level: the definition now exists, but who defines 'a step,' whether failed retries count, and whether a draft rejected by someone counts still have to be written into the contract.
In the two Odoo 20 implementation assessments for Phases and Portcities, there is a reminder that is directly related to billing: automation rules, AI field updates, and AI server actions are three different things. If the conditions are known, use ordinary rules; for field assignment, use Update with AI; only when the model needs to decide which tool to use should you use a server action. Distinguishing these three layers is both defining the development scope and defining the cost scope—when a job that should have been solved with a scheduled rule is handed to an agent that must reason every time, the bill will remember that decision for you.
Metanow's 2027 guide also contains a counterintuitive judgment: converge from 'more agents' to 'fewer, narrower responsibilities.' A single-responsibility agent plus conventional automation is often easier to explain, recover, and maintain than a group of agents sharing broad permissions. Model upgrades and business rule changes should trigger regression testing just as software changes do.
IV. Four Configuration Disciplines for Implementers and CIOs
First, lock before opening. MCP scope follows the bound user's ACL. Before connecting, create a dedicated read-only user—don't use an administrator account just to save effort.
Second, single assistant, single key. Independent key, independent user, shortest validity period; can be revoked independently, and it can be independently seen which connection generated the request.
Third, measurement falls on actions. Write the trigger frequency, unit consumption, and cost owner of each AI workflow into the operations manual; for platforms without a monthly cap, set your own alert thresholds and hard-stop mechanisms.
Fourth, changes trigger regression testing. When Odoo upgrades from 19 to 20, agent configuration changes from Topics to Skills, and the API-key documentation was still being built at the time; don't assume that “if the interface opens, the process is still alive.” Replay the agreed business cases, then restore automation.
Odoo has a rather special position in this round: its connectivity is open enough that native MCP, REST API, and third-party modules can all plug in; data stays in your own database, models can be swapped, and the foundation can be composed. The advantage is that you hold the initiative; the cost is that no one draws these boundaries for you—vendors give you a key blank, and you have to file the teeth yourself.
All the materials this week come back to one sentence: connecting AI to ERP is no longer a question of whether it can be connected. First read-only, then a single key, then per-action metering, and only then talk about autonomy. If the order is reversed, the implementation time saved will be paid back in another way.
Sources: BiztechCS "How to Connect ChatGPT or Claude to Odoo 20: A Complete Guide" (Odoo 20 native MCP, 2026 ecosystem data); CorpusIQ Odoo MCP documentation and "How to Connect Odoo to Perplexity"; M8ven Trust Index (code verification 2026-11-02); DO IT GLOBAL "MCP server: how to give ChatGPT, Claude or Copilot access to your ERP data, and whether it is safe"; Restaurant Hospitality News / F&B Industry News (Supply'd V5.5); Magnetism AI (Dynamics 365 CX MCP Server – Sales GA, 59 tools); Zapai "Business Central Agents" and Microsoft Learn (v29 Wave 2, 2026-11); Odiware "Odoo 20 AI Credits Cost" (2026-11-05), Phases / Portcities / Wavect Odoo 20 implementation and upgrade assessments; Metanow "AI Agents in Business: What Changes in 2027" (research verification 2026-11-06); BusinessWire / DualEntry AaaS (2026-11-05, this article serves as follow-up background).
This article was compiled and written by Guangzhou Zhongdi Information Technology for reference by those responsible for enterprise digitalization and informatization, and does not constitute procurement advice. The accompanying images were generated by AI.
