Odoo Projects MCP (thewth55-sys/odoo-projects-mcp) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 52 tools. No publisher has claimed this listing.

Caution

52/100

Odoo Projects MCP

Item: Odoo Projects MCP
Rating: 52
Author: M8ven

Enables authenticated team members to manage Odoo projects, tasks, timesheets, and milestones through Claude, with per-user token-based authentication.

→ thewth55-sys/odoo-projects-mcp · listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

thewth55-sys

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

🔐

You'll be asked for 2 credentials: ENROLL_SECRET, MASTER_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes52 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

list_projects

Lista los proyectos. Devuelve id, nombre, cliente, responsable y nº de tareas.

get_project

Devuelve el detalle de un proyecto por su id.

list_tasks

Lista tareas con filtros opcionales.

get_task

Devuelve el detalle completo de una tarea por su id.

list_stages

Lista las etapas/columnas del kanban. Opcionalmente filtradas por proyecto.

my_tasks

Devuelve las tareas asignadas al usuario actual (el dueño de la API key).

list_timesheets

Lista partes de horas (timesheets). Filtra por tarea o por proyecto.

list_milestones

Lista hitos del proyecto. Opcionalmente filtrados por proyecto.

create_task

Crea una nueva tarea en un proyecto.

update_task

Actualiza campos de una tarea existente. Solo se cambian los campos que envíes.

move_task_stage

Mueve una tarea a otra etapa/columna del kanban.

create_project

Crea un nuevo proyecto.

log_timesheet

Registra un parte de horas (timesheet) en una tarea.

create_milestone

Crea un hito en un proyecto.

delete_task

Elimina una tarea de forma PERMANENTE. Requiere ALLOW_DELETE=true y confirm=true.

delete_project

Elimina un proyecto de forma PERMANENTE (incluidas sus tareas).

find_users

Busca usuarios de Odoo por nombre o email (útil para obtener su id antes de asignar).

find_partners

Busca contactos/clientes (res.partner) por nombre, email o teléfono. Devuelve su id.

list_leads

Lista oportunidades/leads del CRM, con filtros opcionales por etapa, equipo o comercial.

get_lead

Detalle de una oportunidad/lead del CRM.

create_lead

Crea una oportunidad en el CRM. 'name' es el título de la oportunidad.

update_lead

Actualiza campos de una oportunidad. Solo cambia lo que envíes.

move_lead_stage

Mueve una oportunidad a otra etapa del pipeline de CRM.

list_crm_stages

Lista las etapas del pipeline de CRM.

list_crm_teams

Lista los equipos de ventas (CRM).

list_tickets

Lista tickets de soporte (Helpdesk), con filtros opcionales.

get_ticket

Detalle de un ticket de soporte (Helpdesk).

create_ticket

Crea un ticket de soporte. 'name' es el asunto; priority '0'..'3'.

update_ticket

Actualiza campos de un ticket. Solo cambia lo que envíes.

move_ticket_stage

Mueve un ticket a otra etapa del Helpdesk.

list_helpdesk_teams

Lista los equipos de Helpdesk.

list_helpdesk_stages

Lista las etapas del Helpdesk.

list_mailings

Lista campañas de email marketing (envíos).

get_mailing

Detalle de un envío de email marketing (métricas y estado).

create_mailing_draft

Crea un envío de email marketing EN BORRADOR dirigido a una o más listas de contactos.

list_mailing_lists

Lista las listas de contactos de email marketing.

list_mailing_contacts

Lista contactos de email marketing, opcionalmente de una lista concreta.

add_mailing_contact

Añade un contacto a una o más listas de email marketing.

list_marketing_campaigns

Lista campañas de automatización de marketing.

get_marketing_campaign

Detalle de una campaña de automatización de marketing.

list_marketing_activities

Lista las actividades (pasos) de una campaña de automatización de marketing.

set_marketing_campaign_state

Cambia el estado de una campaña de automatización: 'draft', 'running' o 'stopped'.

list_dashboard_groups

Lista los grupos de tableros (Dashboards).

list_dashboards

Lista los tableros (Dashboards), opcionalmente de un grupo concreto.

list_sales_orders

Lista pedidos de venta (solo lectura). state: 'draft','sent','sale','done','cancel'.

get_sales_order

Detalle de un pedido de venta con sus líneas (solo lectura).

list_invoices

Lista facturas/documentos contables (solo lectura).

get_invoice

Detalle de una factura/documento contable (solo lectura).

list_purchase_orders

Lista órdenes de compra (solo lectura). state: 'draft','sent','purchase','done','cancel'.

get_purchase_order

Detalle de una orden de compra (solo lectura).

list_expenses

Lista gastos (solo lectura). state: 'draft','reported','approved','done','refused'.

get_expense

Detalle de un gasto (solo lectura).

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configODOO_URL

configODOO_DBnombre de la base de datos (suele ser el subdominio) Sí

configMCP_PATH/mcp (por defecto; normalmente no cambiar) No

configALLOW_DELETEBorrado protegido: delete_ requiere =true y confirm=true (mitiga borrados accidentales y prompt-injection). Por defecto, deshabilitado.

configODOO_USERSmapa token\login\api_key (opcional, para sembrar usuarios manualmente) No

configODOO_USERS_FILE/data/users.json (debe estar en un volumen persistente) Sí (para self-service)

🔐 secretENROLL_SECRETclave de invitación para el auto-registro en /enroll Sí (para self-service)

configPUBLIC_BASE_URL

🔐 secretMASTER_KEY

configTOKEN_TTL_DAYSRotación / caducidad: con los enlaces caducan; re-registrarse invalida automáticamente el token anterior del mismo usuario.

configHOST

Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.

deployPORT

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

52/52 tools missing one or more hints — list_projects (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_project (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_tasks (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +49 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Destructive tools are labelled

2 tools perform destructive updates without destructiveHint — delete_task deletes at line 750 (odoo.unlink("project.task", [task_id])); delete_project deletes at line 761 (odoo.unlink("project.project", [project_id]))

Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.

Tool inputs are validated

46/52 tool handlers declare input schemas (88%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

Only 0/52 tool handlers wrap calls in try/catch (0%)

Wrap each tool handler body in try/catch and return a structured error response.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tests exist

No test files found

Add tests that exercise each declared tool.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/thewth55-sys/odoo-projects-mcp?variant=verified)](https://m8ven.ai/mcp/thewth55-sys/odoo-projects-mcp)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: d6790f68c69666efc85ed4afd5c18ccdf8ae1a92

code hash: e608d3ba321c7acd9b0318bb4180bee9b3fb8a9899f38c74cb61bda764143358

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client