Odoo MCP (MarioMillet2b/mcp-odoo) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 41 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
C
Emerging
74/100
25 days ago

Odoo MCP

An MCP server that connects to any Odoo 16+ database using existing credentials, providing read, write, diagnostic, and migration tools via XML-RPC or JSON-2 without requiring Odoo-side module installation.

→ MarioMillet2b/mcp-odoo· listed on glama

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

MarioMillet2b

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
✅
41 tools verified — handlers match their declared behaviour
38 read-only tools verified — handlers contain no write/delete/exec
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 2 credentials: ODOO_PASSWORD, ODOO_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configODOO_MCP_LOG_LEVELStructured logging JSON formatter and rotating file handler via , ODOO_MCP_LOG_JSON, ODOO_MCP_LOG_FILE.
configODOO_MCP_LOG_JSONStructured logging JSON formatter and rotating file handler via ODOO_MCP_LOG_LEVEL, , ODOO_MCP_LOG_FILE.
configODOO_MCP_LOG_FILEStructured logging JSON formatter and rotating file handler via ODOO_MCP_LOG_LEVEL, ODOO_MCP_LOG_JSON, .
configMCP_TRANSPORT
configMCP_HTTP_HOST
configMCP_HTTP_PORT
configMCP_HTTP_PATH
configMCP_LOG_LEVEL
configMCP_ALLOW_REMOTE_HTTP0 Truthy → permit non-local HTTP binds (still requires external auth/TLS).
configMCP_ALLOWED_HOSTS/ MCP_ALLOWED_ORIGINS local CSV allowlists for HTTP transports.
configMCP_ALLOWED_ORIGINSMCP_ALLOWED_HOSTS / local CSV allowlists for HTTP transports.
configODOO_ADDONS_PATHSODOO_MCP_ATTACHMENT_UPLOAD_ROOTS unset Colon-separated local directories validate_write may read <field>_from_path uploads from (mirrors ). Required — fails closed with no roots configured.
configODOO_MCP_MAX_SMART_FIELDS15 Cap for smart-field selection when caller omits fields.
configODOO_MCP_MAX_ATTACHMENT_BYTES1048576 Download cap for read_attachment content (hard cap 16 MiB).
configODOO_MCP_MAX_ATTACHMENT_UPLOAD_BYTES10485760 Size cap for <field>_from_path local-file uploads (hard cap 16 MiB).
configODOO_MCP_CROSS_INSTANCE_WORKERS4 Bounded concurrency for cross-instance fan-out tools.
configODOO_MCP_INSTRUCTIONS_FILEunset Plain-text file appended to the server-level MCP instructions every client receives — deployment-specific guidance (fiscal-year rules, naming conventions) without touching tool descriptions.
configODOO_MCP_ATTACHMENT_UPLOAD_ROOTSunset Colon-separated local directories validate_write may read <field>_from_path uploads from (mirrors ODOO_ADDONS_PATHS). Required — fails closed with no roots configured.
configODOO_MCP_ALLOWED_SIDE_EFFECT_METHODSempty Exact model.method allowlist (e.g. sale.order.action_confirm).
configODOO_MCP_PLUGINS
configODOO_MCP_TOOLS_INCLUDE/ _EXCLUDE unset CSV fnmatch globs trimming the registered tool surface per deployment (small agents drown in 41 tools). Removed names listed in health_check.
configODOO_MCP_TOOLS_EXCLUDE
configODOO_USERNAME"": "your-user",
configODOO_URL"": "https://your-odoo-instance.com",
configODOO_DB"": "your-database",
configODOO_TRANSPORT"": "xmlrpc"
configODOO_MCP_KNOWLEDGE_MAX_DOCS5000 Total documents allowed across all local BM25 knowledge indexes.
configODOO_MCP_RETRY_ATTEMPTS2 Extra attempts for read-only calls on connection errors (0–5). Writes never retry.
configODOO_MCP_RETRY_BACKOFF0.5 Base retry backoff seconds; doubles per retry.
configHTTP_PROXY
🔐 secretODOO_PASSWORD"": "your-password-or-api-key",
🔐 secretODOO_API_KEYexport ="your-odoo-api-key"
configODOO_JSON2_DATABASE_HEADERexport ="1"
configODOO_LOCALELocale plumbing injects context.lang automatically on every Odoo call (caller can override).
configODOO_CONFIG_FILEunset Explicit path to a config file, checked before the standard locations.
configODOO_TIMEOUT
configODOO_VERIFY_SSL
configODOO_MCP_RATE_LIMIT_MODERate limiting Opt-in sliding-window budget per instance and tool (=warn\block), surfaced in health_check.
configODOO_MCP_RATE_LIMIT_WINDOW60 Sliding window length in seconds for rate tracking.
configODOO_MCP_RATE_LIMIT_MAX_CALLS120 Calls allowed per window per instance:tool.
configODOO_MCP_SCHEMA_CACHE_MAX256 Max schema cache entries (LRU eviction).
configODOO_MCP_SCHEMA_CACHE_TTL600 Schema cache entry lifetime in seconds.
// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/mariomillet2b/mcp-odoo)](https://m8ven.ai/mcp/mariomillet2b/mcp-odoo)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: b609cda55715734b6f92bb77ace6362d9f46bf30
code hash: e6d64a49a9f9a9a3f8326ba646e9ca1745ccfa069588e83399ee901a8daf76a3
verified: 8/18/2026, 3:54:11 PM
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client