Connecting an AI client.

The Execution Layer exposes a standard MCP endpoint. Any MCP client points at it, authenticates as a real Odoo user, and gets exactly the tools that user’s bundle allows. The built-in Setup guide shows the same steps as copy-paste snippets, per client.

The endpoint

POST https://<your-odoo>/nanti/mcp

It is MCP Streamable HTTP, stateless, with JSON responses. GET and DELETE on the endpoint return 405. On a local install the endpoint is http://localhost:8069/nanti/mcp (or your configured port).

Reachability

Where the client runs decides whether your Odoo needs to be reachable from the public internet.

HTTPS is your responsibility, exactly as with any Odoo web endpoint: terminate TLS at your proxy or on Odoo.sh.

Claude Code

claude mcp add --transport http odoo https://<your-odoo>/nanti/mcp

Then in Claude Code run /mcp, choose odoo, and Authenticate. A browser opens the Odoo login, you sign in as yourself and click Allow, and Claude Code is connected under your Odoo identity. For local development the URL is http://localhost:8069/nanti/mcp.

Claude Desktop

Settings, then Connectors, then Add custom connector. Set the URL to https://<your-odoo>/nanti/mcp and Connect. The client registers itself (dynamic client registration), the Odoo login opens, and you click Allow.

ChatGPT

Settings, then Connectors (developer mode), then Create. Set the MCP server URL to https://<your-odoo>/nanti/mcp, choose OAuth for authentication, and Connect. ChatGPT runs in the cloud, so your Odoo must be reachable over the public internet on HTTPS.

Cursor

Add the server to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "odoo": { "url": "https://<your-odoo>/nanti/mcp" }
  }
}

Then open Settings, then MCP, select odoo, and Login.

Any client, and unattended jobs

The server is a standard OAuth 2.1 resource. Clients discover it and register automatically:

/.well-known/oauth-protected-resource/nanti/mcp    resource discovery (RFC 9728)
/.well-known/oauth-authorization-server/nanti      authorization server metadata (RFC 8414)
/nanti/oauth/register                              dynamic client registration (RFC 7591)

Authentication is OAuth with PKCE (S256) and refresh-token rotation. For a script or an unattended job, use a scoped API key instead:

curl -X POST https://<your-odoo>/nanti/mcp \
  -H "Authorization: Bearer nmk_your_scoped_key" \
  -H "Content-Type: application/json" \
  -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/list" }'

API keys act as the user who created them, are scoped per operation (read, create, update, delete, execute, export), can carry an expiry, an IP allowlist, and a per-key rate limit, and can be revoked at any time.

Once connected, every call the client makes runs the full pipeline, and the connection appears under Connections, where it can be inspected, narrowed, or revoked. Next: what a verified write looks like.