Odoo Mcp Gateway
About
Security-first MCP gateway for Odoo 17/18/19 — 27 tools, YAML-driven security
Details
- Author
- parth-unjiya
- Downloads
- 1,136
- Categories
- Other, AI, Security
Jump to
- Two‑layer security: MCP restrictions (YAML) + Odoo's built‑in ACLs
- YAML‑driven configuration for model limits, RBAC, field‑level access, rate limiting
- Auto‑discovers custom module models via ir.model — no Python code needed
- Version‑agnostic across Odoo 17, 18, and 19 with version‑specific adapters
- Full MCP primitives: 27 Tools, 5 Resources, 7 Prompt templates
- Plugin architecture extendable via pip‑installable entry points
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Odoo Mcp GatewayCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Install with pip install odoo-mcp-gateway, copy example YAML config files (restrictions, model_access, rbac), set environment variables ODOO_URL and ODOO_DB, then run with python -m odoo_mcp_gateway (stdio mode for Claude Desktop/Claude Code) or with MCP_TRANSPORT=streamable-http for web clients. Authentication happens via the login MCP tool using api_key, password, or session methods.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"odoo mcp gateway": {
"odoo-mcp-gateway": {
"command": "python",
"args": [
"-m",
"odoo_mcp_gateway"
]
}
}
}
}McpServers
{
"odoo-mcp-gateway": {
"command": "python",
"args": [
"-m",
"odoo_mcp_gateway"
]
}
}odoo-mcp-gateway
Security-first, version-agnostic MCP gateway for Odoo 17/18/19. Works with stock and custom modules via YAML configuration. Zero Odoo-side code required.
<!-- mcp-name: io.github.parth-unjiya/odoo-mcp-gateway -->
Why This Exists
Existing Odoo MCP servers share common problems: hardcoded model lists that miss custom modules, security as an afterthought, mandatory custom Odoo addons, and single-version targets. This gateway solves all of them:
- Two-layer security — MCP restrictions (YAML) + Odoo's built-in ACLs (ir.model.access + ir.rule)
- YAML-driven configuration — model restrictions, RBAC, field-level access, rate limiting, audit logging
- Custom module support — auto-discovers models via ir.model, add YAML config and it works
- Version-agnostic — Odoo 17, 18, 19 with version-specific adapters
- Zero Odoo-side code — pip install + YAML config = done. No custom addon required
- Full MCP primitives — 27 Tools + 5 Resources + 7 Prompts (most servers only implement Tools)
- Plugin architecture — extend with pip-installable domain packs via entry_points
Architecture
MCP Client (Claude Desktop / Claude Code / HTTP)
| User calls login tool with Odoo credentials
v
MCP Server (FastMCP)
|
|-- security_gate() --> Rate limit + RBAC tool access + audit logging
|-- restrictions --> Model/method/field block lists (YAML + hardcoded)
|-- rbac --> Field-level filtering + write sanitization
|
|-- tools/ --> 27 MCP tools (auth + schema + CRUD + plugins)
|-- resources/ --> 5 MCP resources (odoo:// URIs)
|-- prompts/ --> 7 reusable prompt templates
|-- plugins/ --> Entry-point plugin system (HR, Sales, Project, Helpdesk)
|
| JSON-RPC / XML-RPC as authenticated user
v
Odoo 17/18/19 (security enforced per user via ir.model.access + ir.rule)
Security Pipeline
Every tool and resource call passes through this pipeline:
Request --> Rate Limit --> Authentication Check --> RBAC Tool Access
--> Model Restriction --> Method Restriction --> Field Validation
--> Handler Execution --> RBAC Field Filtering --> Audit Log --> Response
Hardcoded safety guardrails that cannot be overridden by YAML:
- 18 always-blocked models (ir.config_parameter, ir.cron, ir.module.module, ir.rule, ir.mail_server, etc.)
- 18 always-blocked methods (sudo, with_user, with_env, _sql, _write, _create, etc.)
- 28 ORM methods blocked in execute_method (prevents bypassing field-level checks)
Quick Start
```bash
pip install odoo-mcp-gateway
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
