2
/ 100
1 month ago
mcp_so

Odoo MCP Server

MCP Server for Odoo

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Reads files from sensitive locations
Touches: ~/.config/odoo/config.json
🔐
You'll be asked for 2 credentials: ODOO_PASSWORD, ODOO_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configODOO_USERNAME"": "your-user",
configODOO_URL"": "https://your-odoo-instance.com",
configODOO_DB"": "your-database",
configODOO_TRANSPORT"": "xmlrpc"
configODOO_MCP_LOG_LEVELStructured logging JSON formatter and rotating file handler via , ODOO_MCP_LOG_JSON, ODOO_MCP_LOG_FILE.
configODOO_MCP_LOG_JSONStructured logging JSON formatter and rotating file handler via ODOO_MCP_LOG_LEVEL, , ODOO_MCP_LOG_FILE.
configODOO_MCP_LOG_FILEStructured logging JSON formatter and rotating file handler via ODOO_MCP_LOG_LEVEL, ODOO_MCP_LOG_JSON, .
configMCP_TRANSPORT
configMCP_HTTP_HOST
configMCP_HTTP_PORT
configMCP_HTTP_PATH
configMCP_LOG_LEVEL
configMCP_ALLOW_REMOTE_HTTP0 Truthy → permit non-local HTTP binds (still requires external auth/TLS).
configMCP_ALLOWED_HOSTS/ MCP_ALLOWED_ORIGINS local CSV allowlists for HTTP transports.
configMCP_ALLOWED_ORIGINSMCP_ALLOWED_HOSTS / local CSV allowlists for HTTP transports.
configODOO_ADDONS_PATHS
configODOO_MCP_KNOWLEDGE_MAX_DOCS5000 Total documents allowed across all local BM25 knowledge indexes.
configODOO_MCP_RETRY_ATTEMPTS2 Extra attempts for read-only calls on connection errors (0–5). Writes never retry.
configODOO_MCP_RETRY_BACKOFF0.5 Base retry backoff seconds; doubles per retry.
configHTTP_PROXY
🔐 secretODOO_PASSWORD"": "your-password-or-api-key",
🔐 secretODOO_API_KEYexport ="your-odoo-api-key"
configODOO_JSON2_DATABASE_HEADERexport ="1"
configODOO_LOCALELocale plumbing injects context.lang automatically on every Odoo call (caller can override).
configODOO_CONFIG_FILEunset Explicit path to a config file, checked before the standard locations.
configODOO_TIMEOUT
configODOO_VERIFY_SSL
configODOO_MCP_RATE_LIMIT_MODERate limiting Opt-in sliding-window budget per instance and tool (=warn\block), surfaced in health_check.
configODOO_MCP_RATE_LIMIT_WINDOW60 Sliding window length in seconds for rate tracking.
configODOO_MCP_RATE_LIMIT_MAX_CALLS120 Calls allowed per window per instance:tool.
configODOO_MCP_SCHEMA_CACHE_MAX256 Max schema cache entries (LRU eviction).
configODOO_MCP_SCHEMA_CACHE_TTL600 Schema cache entry lifetime in seconds.
configODOO_MCP_ALLOWED_SIDE_EFFECT_METHODSempty Exact model.method allowlist (e.g. sale.order.action_confirm).
configODOO_MCP_MAX_SMART_FIELDS15 Cap for smart-field selection when caller omits fields.
configODOO_MCP_MAX_ATTACHMENT_BYTES1048576 Download cap for read_attachment content (hard cap 16 MiB).
configODOO_MCP_CROSS_INSTANCE_WORKERS4 Bounded concurrency for cross-instance fan-out tools.
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/tuanle96-mcp-odoo-1d834l)](https://m8ven.ai/mcp/tuanle96-mcp-odoo-1d834l)
commit: d68de6f96f70e7c773730dc001e0ba0ccae5f864
code hash: 6b46ca856a1ecafd04886dbd020b94ca2de88386dedf3edd70b5427c204b32e7
verified: 6/17/2026, 11:43:39 AM
view raw JSON →