MCP for ERP: How to Connect Claude, Copilot or Your Own LLM to Odoo and MYOB Acumatica Without Handing Over the Keys

MCP for ERP means connecting an AI assistant such as Claude or Microsoft Copilot to Odoo or MYOB Acumatica through the Model Context Protocol, an open standard whose current revision is dated 28 July 2026. The assistant signs in as a named, role-scoped user, reads only what that user can read, and drafts instead of posting. You keep the choice of model, and a person approves every write.

At a glance

• Who it is for: owners, CFOs and operations managers already using Claude, Copilot or a self-hosted agent framework who now want it reading, and eventually drafting into, their live ERP.
• Problem it solves: the two bad options most businesses are offered today, which are a shared admin login pasted into a chatbot, or a vendor bundle that locks the model choice for you.
• Platforms: Odoo 19 Enterprise and Community (external API plus app-store MCP servers); MYOB Acumatica 2025.2 and 2026.1 (REST and OData APIs, AI Automation with your own LLM provider); Acumatica’s MCP access announced globally, ANZ timing unconfirmed.
• What the connection reads: whatever the agent’s own ERP user is allowed to see, and nothing more. Record rules, field permissions and company scoping stay in force.
• What it drafts: answers with record links, exception lists, draft quotations, draft notes on the chatter or activity feed. Nothing posts to the ledger, pricing or stock without a person.
• Approval gate: read-only credentials until the drafts have earned trust; a separate read-and-write credential for a single workflow once they have, with the approval step inside the ERP.
• Audit trail: every tool call logged with the key, the tool, the record and the outcome, plus a visible badge or tag on anything the agent wrote.
• Typical cost: a single scoped agent pilot typically starts from a few thousand dollars ex GST for discovery and sandbox build, per our AI agents for ERP in Australia page.
• Typical timeline: 4 to 10 weeks from discovery to a drafts-first go-live, per the same page.
• What it never does: run as an administrator, hold a credential broader than the person it works for, or write to the general ledger, tax codes, prices or stock levels on its own.
• Last verified: 9 September 2026 against the MCP specification, 28 July 2026 revision, Odoo’s AI API key documentation and MYOB’s LLM provider integration guide.

What is MCP for ERP, in plain terms?

Every ERP already has an API, and every large language model can already call tools. What was missing until recently was a shared plug. Each AI vendor had its own way of describing a tool, so a connector built for one assistant had to be rebuilt for the next. The Model Context Protocol fixes that. A business system publishes a list of tools (“search sales orders”, “read a customer’s credit status”) in one standard format, and any MCP client can discover and call them.

The protocol started at Anthropic and was handed to the Linux Foundation’s Agentic AI Foundation in December 2025, which matters for a CFO because no single AI vendor owns the plug you’re building on. The 28 July 2026 revision made the protocol stateless, moved the tool name into an HTTP header so a firewall or gateway can filter on it, and tightened the authorisation rules. Those are plumbing changes, but they are the plumbing changes that make MCP fit behind a corporate proxy.

On the client side, the tools your staff already have speak it. Claude supports custom connectors using remote MCP servers, and Microsoft Copilot Studio lets you extend an agent with tools from an MCP server. Both are shipped features as at September 2026, not previews. The ERP side is where it gets interesting, and where the two platforms we implement are in different places.

What does bring your own LLM actually buy you?

Three things, and only one of them is about the model being clever.

The first is the data path. When MYOB Acumatica’s AI Automation feature sends text to a model, it goes through the MYOB Secure Cloud proxy to a provider account you own on Azure, Amazon Bedrock, OpenAI or Anthropic, and MYOB’s documentation states the proxy does not store, modify or retain the data. You pick the region and the contract. MYOB also ships data masking that swaps sensitive field values for placeholders before the prompt leaves, with one stated limitation in the same document: it cannot mask a value buried inside a larger text field such as an email body. Odoo’s built-in AI features take a different route, supporting Gemini and OpenAI as providers with your own API keys required on Odoo.sh and on-premise databases. An external MCP connection sidesteps the built-in provider list entirely: the model is whatever your MCP client runs.

The second is the exit. MYOB’s own guide warns that providers deprecate models with little notice and that an existing connection can stop working, so it asks administrators to review connections regularly. That is the case for keeping the model swappable. If the assistant is a client talking MCP to your ERP, changing the model is a settings change, not a rebuild.

The third is bargaining power: you’re buying model capacity on your own terms, under your own privacy assessment, instead of accepting whichever bundle the ERP vendor negotiated. The OAIC’s guidance on commercially available AI products expects you to know where personal information goes and why; a connection you configured is far easier to describe in a privacy policy than one you didn’t.

How does an MCP connection to Odoo or MYOB Acumatica stay inside the user’s permissions?

This is the question that decides whether a sceptical finance team says yes, so here is the mechanism on each platform.

Odoo has no first-party MCP server from Odoo SA as at 9 September 2026; we checked the 19.0 documentation, the v19 Enterprise source and the app store this week. What Odoo has is a mature external API that authenticates with a per-user API key, and a set of third-party MCP servers built on top of it. Two examples we have looked at: the mcp-server-odoo package on PyPI, a community bridge that runs beside Odoo, and the MuK MCP Server on the Odoo app store, which turns the Odoo instance itself into the MCP endpoint. The MuK listing is worth reading as a governance checklist whether or not you use it: keys are scoped Read Only or Read and Write, every call runs as the key’s owner so Odoo’s record rules and field permissions apply on top, requests are rate-limited at 60 a minute by default, each call lands in an audit log, and every chatter message the agent writes carries an MCP badge so staff can see which comments came from a machine. That is what “inside the user’s permissions” looks like when a developer takes it seriously.

One repo finding from our own work belongs here because it cuts the other way. Odoo 19’s built-in AI agents run their tool code with the rights of the user who is chatting, not as an administrator; we verified that in the Enterprise source. The catch is that a tool’s own code can escalate itself, and the shipped lead-creation tool does exactly that so a website visitor can leave their details. Copy that pattern into a “look up my order” tool without thinking and every order becomes readable to anyone who types a number. Our build review now includes a search of every AI tool for an escalation call. Our post on AI agents in Odoo covers the allowlist design that makes the built-in agents safe by default.

MYOB Acumatica is a two-part answer. The Acumatica product page states that authorised AI tools can access permitted business information through MCP while respecting existing security policies, naming Claude, Gemini and Cursor as example clients and role-based permissions, inherited security and field-level masking as the controls. That is the global product’s language, and we could not find MCP in the MYOB Acumatica ANZ release documentation as at today, so treat it as announced globally with the usual 6 to 9 month ANZ lag and no confirmed date. The community got there first: MCP4Acumatica is an open-source, read-only server a customer built and ran against their own 2025 R2 instance before publishing it. For an Australian business on 2025.2 or 2026.1 today, the working route is the REST and OData APIs under a named user with a role built for the agent, plus AI Automation for the in-form drafting MYOB ships. Our MYOB Acumatica AI post tracks what has landed in ANZ.

A worked example: the credit question that never leaves the fence

A Queensland building products distributor runs MYOB Acumatica and has a Claude subscription its operations manager already uses for writing. She wants to ask it about customers, not paste spreadsheets into it.

We set up an ERP user called “Agent, Credit Read” with a role that can see customer master data, open invoices and credit limits, and nothing in payroll, cost prices or bank details. That user’s credential sits behind an MCP server the assistant connects to. On Monday she asks: “Which customers are over their credit limit with orders due to ship this week?” The assistant calls two read tools, returns nine accounts with links into the ERP, and notes one it can’t fully assess because the invoice batch hasn’t posted yet. She checks two of the nine against the screens herself the first month. They match.

Then she asks it to put the nine on credit hold. It can’t. The key is read-only, and the answer says so: here is the list, here is the hold screen, a credit controller applies each one. Six weeks later, once the drafts have a clean run behind them, we add a second, write-scoped credential for one job: drafting a chatter note on each flagged account with the reason and the figures, badged as agent-written, for the controller to act on. The hold itself is still a human click, because a wrongly held account is a lost order and the credit management agent post explains why that stays with a person.

Nothing about this is exotic. It is a user, a role, a key and a habit. That is the whole point.

Hosted assistant or self-hosted framework: which fits your business?

MCP for ERP is one of three connection routes, and the right one depends on who is on your payroll as much as on the software.

The self-hosted row needs a caveat, not a cheerleader. OpenClaw, the open-source runtime Australian owners ask us about most often, is real and actively maintained: its GitHub releases show version 2026.9.3 published on 8 September 2026. The same page is a reminder of the trade-off. Of the 30 releases published between 21 June and 8 September 2026, 12 list security fixes in their notes. That is a healthy project doing its job, and it is also the job you are taking on: running one against an ERP means owning that patch cycle yourself. The Australian Signals Directorate co-published Careful adoption of agentic AI services with its Five Eyes partners in May 2026, and its advice is the same we give: never grant an agent broad or unrestricted access, start with low-risk tasks, and keep a human accountable. A hosted assistant over a scoped MCP key gives you most of the value with a fraction of that burden, which is why it is where we start with almost everyone.

What goes wrong, and how do we design for it?

Prompt injection is the one that keeps us careful. An agent reading a supplier’s PDF or a customer’s email is reading text a stranger wrote, and that text can contain instructions. The defence is structural, not clever: the agent’s credential cannot do the damaging thing in the first place, so an injected “cancel all open orders” fails on permissions before it fails on judgement. Read-only until trusted, then one write scope per workflow.

Then there is key sprawl, which nobody notices until it has happened. Six months in, a business has four assistants, three MCP servers and nobody remembers which key belongs to which. The fix is the same register we recommend for every agent, described in our AI agent register post: one page listing each agent, its credential, its scope, its owner and its review date.

And a provider will, sooner or later, retire the model you tested against. The connection breaks or, worse, keeps working with different behaviour. MYOB puts that warning in its own documentation, and it applies to every row of the table above. Test drafts against a known set of cases each month and log the results.

“The businesses that get this right treat the AI like a new hire with a probation period. It gets a login with the same permissions a junior in that team would have, it drafts, someone senior signs off, and its access only grows after it has earned it. That’s not caution for its own sake. It’s the same control we’d put on a person.”

Bill Alvarez, Practice Manager, Auboros

From 10 December 2026, Australian privacy policies must also describe the kinds of substantially automated decisions that significantly affect people, per the OAIC’s ADM transparency consultation. If an MCP-connected assistant helps decide credit terms, the connection needs to be documented before that date, and the final OAIC guidance is due this month. Our AI agent governance post covers the policy side.

Goes well with

• AI agents for ERP in Australia: once the connection exists, which workflow should the first agent take on, and what does a drafts-first pilot cost.
• Conversational ERP in Australia: what staff can safely ask a connected assistant about live orders, stock and credit, and the permission rules underneath.
• The AI sales order agent: the first write-scoped workflow most distributors add after the read-only phase, and why a person still confirms every order.

Ready to connect an assistant to your ERP without handing over the keys?

Auboros is an Odoo partner in Brisbane and a MYOB Acumatica partner in Brisbane that wires assistants to ERPs through MCP and platform APIs, role-scoped and drafts-first, for businesses across Queensland, NSW, Victoria and New Zealand. If you want to know what a read-only connection could answer for your team by the end of the month, book a free consultation. We’ll tell you which credential to create first, and which questions to ask it before you trust it.