FAQ
The questions asked most often about MCP Server for Odoo, answered.
Which MCP clients work?
Anything implementing the Model Context Protocol over HTTP with a bearer token. Claude Desktop is the common one. The server implements initialize, tools/list, tools/call and ping against protocol version 2024-11-05.
Can a connected client change anything in Odoo?
No. The underlying tool layer has no write, create, delete or method call, so there is nothing to expose.
Whose data does a client see?
The data of the person the token speaks for, read with their access rights. Two colleagues connecting their own clients get different answers to the same question.
Can I share one token across the team?
You can, and you should not. Every answer would be read with one person's rights and the audit trail would credit them with everybody's questions.
What if a token leaks?
Revoke it. It stops working on the next request, and the audit rows survive so you can see what it read while it was live. This is why tokens carry an expiry, a last-used time and a last-seen client name.
Does it implement resources, prompts or sampling?
No. Tools are what an ERP has to offer; the rest would be surface area with nothing behind it.
Why is there no OAuth?
A bearer token bound to one Odoo user is simpler to reason about, simpler to revoke, and does not require an identity provider. If your client can send an Authorization header, it can use this.
Does the client's reported name mean anything?
It is whatever the program said it was, and it is recorded as such. Useful for telling two of your own tools apart; not for deciding whether to trust one.
Do I need the AI Assistant module?
Yes. It supplies the permission scope, the tool layer and the audit trail that this module puts on the wire. The store lists the two together.
Does the endpoint work without HTTPS?
It will answer, but do not do it. A bearer token over plain HTTP is readable by anything between the client and your server.