Odoo 20 Ships a Built-In MCP Server: What It Exposes, Who It Runs As and How to Keep Writes Behind a Person

Odoo 20, unveiled at Odoo Experience on 24 September 2026, ships a built-in MCP server at your database address plus /mcp. Each assistant authenticates with a per-user API key on a new MCP scope and sees five read-only tools by default; Create and Update Records stay hidden until an administrator switches them on. Leave them off and route writes through drafts, as our AI agents for ERP in Australia do.

At a glance

• Who it is for: Australian businesses on Odoo 20 Enterprise, or planning the move from 19, whose staff already use Claude, Codex or another assistant and want it reading live Odoo data instead of pasted exports.
• Problem it solves: until Odoo 20, connecting an assistant to Odoo meant a third-party MCP bridge or custom API work. Odoo 20 makes the database itself the MCP server, which removes the plumbing and moves the whole question to permissions.
• Platforms: Odoo 20 Enterprise with the AI application installed (the AI MCP server documentation sits under Odoo AI). MYOB Acumatica has no equivalent built-in endpoint in the ANZ release as at 29 September 2026; its AI Automation prompts and REST API are covered in our MCP for ERP post.
• Trigger: a person types a request into their MCP client. The client asks Odoo which tools are exposed, then calls them on that person’s behalf. Nothing runs on a schedule.
• Inputs read: whatever the signed-in user can already see. The server authenticates the API key as that user, so Odoo’s access rights and record rules apply to every tool call.
• What it can write: nothing by default. Create Records and Update Records exist as tools but are hidden until an administrator ticks Available in MCP on each one. Our recommendation is to keep both hidden and expose purpose-built tools that draft, log or assign instead.
• Approval gate: two layers. The MCP client’s own confirmation prompt on any tool not marked read-only, and, for anything that touches the ledger, a tool design that stops at a draft or an activity for a named person.
• Audit trail: Odoo’s 20.0 documentation does not describe a call log for MCP requests. We treat the client’s tool log as the minimum and add server-side logging to any custom tool we expose.
• What it never does in our builds: post a journal, confirm an order, change a price list, edit a tax code, or touch a customer’s credit limit without a person clicking the button in Odoo.
• Typical cost: the MCP scope key is free; the person using it needs an Odoo seat on a plan that includes the external API, per Odoo’s pricing page. A scoped agent pilot starts from $5,000 ex GST per the AI agents for ERP in Australia hub, verified 29 September 2026.
• Typical timeline: a read-only connection for one person is a half-day job; a governed rollout with custom write tools follows the hub’s discovery, sandbox and drafts-first go-live pattern of 4 to 10 weeks.
• Last verified: 29 September 2026 against the Odoo 20.0 AI MCP server documentation, the available MCP tools page, the Odoo 20 release notes and the Model Context Protocol tools specification.

When we wrote our MCP for ERP guide on 9 September, Odoo had no first-party MCP server; we had checked the 19.0 documentation, the Enterprise source and the app store. Twenty days later that sentence is out of date. The Odoo 20 release notes list “Connect Odoo to anything: connect to your database via MCP” under the AI section, alongside agents that can now create and update records and be summoned by automated and scheduled actions. This post is about the MCP server only, because it is the piece that lets a tool you already run, on your laptop, reach into your ERP.

What is the Odoo 20 MCP server, and what changed from Odoo 19?

The Model Context Protocol is the open standard that lets a large language model call tools on another system. In the Odoo 20 design, described in the AI MCP server documentation, your Odoo database is the remote MCP server and your assistant is the client. The client connects, asks the server which tools it may use, caches that list for the session, and then, when you type a request, asks the server to run the right tool and turns the result back into plain language. The tools themselves are Odoo server actions with an AI usage flag, which is the same mechanism behind Odoo’s own AI server actions.

The practical difference from Odoo 19 is where the endpoint lives. On 19 you chose between a community bridge running beside Odoo and an app-store module that turned the instance into an endpoint; both sat on the external API and both were somebody else’s code. On 20 the endpoint is your database URL with /mcp on the end, maintained by Odoo SA, and the documentation walks through connecting it to Claude Desktop and Claude Code, Google’s Antigravity and OpenAI’s Codex using the npx mcp-remote command with the API key passed as a bearer header. Any other client that speaks MCP over that transport should connect the same way, though those three are the ones Odoo documents.

Two things did not change. The external API that our Odoo 19 AI agents and MCP for ERP posts describe is still there for agents that run on a server instead of a person’s desk. And the “latest” link on Odoo’s documentation still pointed to 19.0 on 29 September, so most Australian businesses are running 19 today and should check with Odoo which hosting types can move to 20 before planning around any of this.

Who does the MCP connection run as?

This is the first question a CFO asks us, and Odoo’s answer is a good one: it runs as you. The documentation says every request the client sends carries a static API key that “authenticates the user’s identity and permissions in the Odoo database”. You generate the key from My Preferences, on the Security tab, after confirming your database password, and the key form has three fields worth pausing on: a name, a scope, and a validity period.

The scope is new. Odoo 20 adds an MCP scope to its API keys, so a key minted for an assistant cannot be reused for the general external API, and the reverse. The validity period means the key expires, with one month given as the example, which is a control we would otherwise have had to build. And because the key is tied to the person who created it, Odoo’s access rights, record rules and field-level restrictions apply to every tool call exactly as they do when that person clicks through the interface. A credit controller connecting Claude Desktop sees the customers she can see and nothing else. There is no shared super-user, which is the rule we apply to every agent we build and the rule we explain in our AI agent governance guide.

The limit of that design is worth stating plainly. “Runs as you” protects Odoo from the assistant. It does not protect the assistant from a careless prompt. If a person can update a customer’s credit limit in Odoo, and Update Records is exposed, then the assistant can update it too, and the only thing between a typo and a changed limit is the client’s confirmation dialog. That is why the next section matters more than this one.

Which MCP tools should you expose, and which should stay hidden?

Out of the box, Odoo exposes five tools to the client: Get Models, Get Fields, Search, Read group and the initial context tool that returns the user, timezone and companies at the start of a session. All five are read-only. Every other tool is hidden until an administrator turns on developer mode, opens Settings, then Technical, then Server Actions, and ticks Available in MCP on the tool’s Usage tab. The available MCP tools page lists what is there and marks each one read-only or not.

There is a second checkbox next to Available in MCP called Readonly Tool, and it is easy to misread. Odoo’s documentation is careful here: ticking it “does not hide the tool from the AI client. It only advises the client that the tool is safe to invoke without explicit user approval”. In MCP terms that is a tool annotation, and the protocol specification says clients must treat annotations as untrusted unless the server is trusted, and that there should always be a human able to deny a tool call. So the Readonly flag is a hint that removes a confirmation prompt. It is not a lock. Never tick it on a tool that writes, and audit the list of ticked tools the way you would audit a list of users with accounting manager rights.

Our own rule for clients is simpler than the table: leave the generic Create Records and Update Records hidden on every finance and operations key, full stop. When a job needs a write, build a server action tool for that job with an argument schema that allows only the fields the job needs, mark it Available in MCP with Readonly off, and have its code create a draft, log a note or schedule an activity for a named person instead of posting anything. That is the same manager-and-worker pattern we built for Odoo’s internal agents in our Odoo AI server action approval-gate note, and Odoo’s 20.0 documentation repeats the line that matters: once an AI tool is called, “it will execute unconditionally, unless the code itself prevents it”.

A worked example: the credit controller and the customer on hold

A Brisbane wholesale distributor on Odoo 20 gives its credit controller an MCP key with the five default tools and the navigation group. She connects Claude Desktop, and on a Monday morning she types: “Show me overdue invoices grouped by customer, largest first, for the last 90 days.” The client calls Read group under her login, and she gets a table she would otherwise have built as a pivot. Her second request is one the ATO cares about: “Which of those invoices are $1,000 or more where the customer record has no ABN?” The ATO’s tax invoice rules require the buyer’s identity or ABN on tax invoices of $1,000 or more, so a missing ABN on a large overdue invoice is a document problem as well as a collections one. Search and Get Fields answer that without writing a thing.

Her third request is “put Northside Trade Supplies on credit hold”. Update Records is hidden on her key, so the client reports that it has no tool for that. What she does have is a custom tool we exposed called Request Credit Hold, which takes one customer and one reason, logs an internal note on the customer with the overdue figures attached, and schedules an activity for the accounts receivable officer. The officer opens the customer, reads the note, checks the payment promise from last week, and sets the hold himself. The assistant did the reading and the asking. A person made the decision, and the chatter shows the request, the reason and who acted on it. That is the whole design of our AI credit management agent, delivered through a desktop assistant instead of a scheduled agent.

“The MCP server is the part of Odoo 20 a finance team will use first, and the easiest part to get wrong. Read-only by default is the right call from Odoo. The mistake I expect to see is an admin ticking Available in MCP on Update Records because a sales manager asked, and nobody noticing that every laptop with a key can now rewrite records under whoever holds it.”

Bill Alvarez, Practice Manager, Auboros

Where does the data go, and what does the Privacy Act say?

With an in-Odoo agent, the model call goes from Odoo to the provider Odoo is configured for, and the release notes say all of Odoo’s own AI features now need credits bought through IAP. With the MCP server it is the other way round: the model runs wherever your client runs, so the records a tool returns are sent to that client’s provider. If the credit controller uses Claude Desktop, the overdue invoice list goes to Anthropic; if she uses Codex, it goes to OpenAI. Odoo isn’t the one making that disclosure. You are.

The Office of the Australian Information Commissioner’s guidance on commercially available AI products says privacy obligations apply to any personal information input into an AI system, that entering it may be a use or a disclosure under Australian Privacy Principle 6 depending on whether it leaves your effective control, and that cross-border disclosures bring APP 8 into play. Customer contact names and debtor histories count, and so do staff records if HR is in the same database. So before the first key is issued, three decisions belong in your AI usage policy: which providers are approved for which data, whether the provider’s terms let it train on or retain what you send, and which Odoo models an MCP key may query at all. The AI agent register we recommend keeping should list each MCP key, its owner, its expiry and the tools it can reach, and a monthly review should confirm nothing has been ticked since.

Should you upgrade to Odoo 20 for the MCP server?

Not on its own, and not this quarter for most businesses. Odoo 20 was unveiled at Odoo Experience on 24 September and the documentation’s default version was still 19.0 five days later. Enterprise subscribers get Odoo’s upgrade service at no extra charge, but an upgrade is still a project with a test cycle, and Australian localisation changes deserve their own check before anything else. If you are on 19 and want an assistant reading Odoo today, the third-party options in our MCP for ERP post work now, and the key and tool decisions in this post carry over as a design brief for when you move. If you are already planning a 20 upgrade, add the MCP rollout to the same project: decide the tool list per role in the sandbox, expose nothing beyond the defaults on the first day, and treat the first custom write tool as a governed build, not a checkbox. Our Odoo 20 roadmap post covers the rest of the release from an Australian angle.

Goes well with

• MCP for ERP: how to connect your own LLM to Odoo and MYOB Acumatica: what MCP is, the bring-your-own-model architecture and the Odoo 19 options.
• How to build an approval gate into an Odoo AI server action: the tool pattern this post relies on for any write.
• AI agent governance for Australian businesses: the usage policy, key register and review cycle that make an MCP rollout safe.

Planning an Odoo 20 MCP rollout, or wondering what to expose?

We’re an Odoo partner in Brisbane that runs MCP connections and AI agents over Odoo for our own operations and for Queensland businesses, read-only first, with every write behind a person. If you’d like the tool list and the key policy settled before anyone ticks a checkbox in production, book a free consultation. We’ll tell you what to switch on and what to leave alone.