Connecting an AI client.

The Execution Layer exposes a standard MCP endpoint. Any MCP client points at it, authenticates as a real Odoo user, and gets exactly the tools that user’s bundle allows.

The endpoint

POST https://<your-odoo>/mcp

It is MCP Streamable HTTP, stateless, with JSON responses. GET and DELETE on the endpoint return 405. On a local install the endpoint is http://localhost:8069/mcp (or your configured port).

Reachability

Where the client runs decides whether your Odoo needs to be reachable from the public internet.

Claude Code

claude mcp add --transport http odoo https://<your-odoo>/mcp

Then in Claude Code run /mcp, choose odoo, and Authenticate. A browser opens the Odoo login, you sign in as yourself and click Allow, and Claude Code is connected under your Odoo identity. For local development the URL is http://localhost:8069/mcp.

Claude Desktop

Settings, then Connectors, then Add custom connector. Set the URL to https://<your-odoo>/mcp and Connect. The client registers itself (dynamic client registration), the Odoo login opens, and you click Allow.

ChatGPT

Settings, then Connectors (developer mode), then Create. Set the MCP server URL to https://<your-odoo>/mcp, choose OAuth for authentication, and Connect. ChatGPT runs in the cloud, so your Odoo must be reachable over the public internet on HTTPS.

Cursor

Add the server to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "odoo": { "url": "https://<your-odoo>/mcp" }
  }
}

Then open Settings, then MCP, select odoo, and Login.

Any client, and unattended jobs

The server is a standard OAuth 2.1 resource. Clients discover it and register automatically:

/.well-known/oauth-protected-resource      resource discovery
/.well-known/oauth-authorization-server    authorization server metadata
/oauth/register                            dynamic client registration (RFC 7591)

Authentication is OAuth with PKCE (S256). For a script or an unattended job, use a scoped API key instead:

curl -X POST https://<your-odoo>/mcp \
  -H "Authorization: Bearer nmk_your_scoped_key" \
  -H "Content-Type: application/json" \
  -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/list" }'

API keys are scoped per operation (read, create, update, delete, execute, export), can carry an expiry, an IP allowlist, and a per-key rate limit, and can be revoked at any time.

Once connected, every call the client makes runs the full pipeline. Next: what a verified write looks like.