A tool count is not a security model.

Short answer: there is no universal winner. Choose an external gateway for Odoo Online or zero-addon deployment. Choose an in-Odoo module when direct ORM access and a single remote endpoint matter. Choose a managed service when OAuth, updates, and uptime are work you do not want to own.

Repositories and public documentation were checked on 26 August 2026. Fast-moving projects can change after publication. Verify the release, license, and security controls yourself.

Seven questions, in this order

1. Can it run where your Odoo runs? Odoo Online does not accept arbitrary server addons.
2. Which Odoo API does it use? Odoo 19’s current external API is JSON-2; XML-RPC and JSON-RPC are deprecated.
3. Whose identity reaches Odoo? One shared administrator key is not per-user authorization.
4. Can administrators limit models, fields, methods, and record counts?
5. What gates a write? Allowlist, dry run, confirmation, or nothing?
6. What gets logged? User, tool, model, record, arguments, result, and denial?
7. Is it maintained? Releases, issues, tests, and a clear license beat a large README.

Open-source Odoo MCP projects worth evaluating

This table reports what each project publishes; it is not an independent penetration test. Start from the curated Awesome Odoo MCP list to discover more projects, then inspect the actual code and releases.

External gateway or module inside Odoo?

External gateway

The server runs beside the AI client or on your infrastructure and calls Odoo through an external API. This is the practical shape for Odoo Online because you cannot install arbitrary backend addons there. It also isolates MCP dependencies from the Odoo worker and can serve multiple databases.

The trade-off is another service carrying Odoo credentials. Confirm encryption at rest, tenant isolation, egress controls, key rotation, and whether every user shares one Odoo identity.

In-Odoo module

The module exposes an MCP endpoint from Odoo and uses the ORM directly. That avoids an extra RPC hop and can enforce Odoo ACLs and record rules naturally. It requires Odoo.sh or self-hosting with permission to install the addon, plus careful reverse-proxy, dependency, and worker management.

Managed gateway

A managed service removes server operations but adds a vendor trust boundary. Ask where credentials are stored, how OAuth users map to Odoo users, how data is retained, and how you export logs or leave.

Odoo 19 changes the API decision

Odoo’s official Odoo 19 documentation describes JSON-2 at /json/2/{model}/{method}, bearer API keys, and a maximum key duration of three months. It also marks XML-RPC and JSON-RPC for removal in Odoo 22.

An Odoo MCP server that supports 17–19 may legitimately use XML-RPC on 17/18 and JSON-2 on 19. What matters is whether the adapter is explicit and tested. “Supports all Odoo versions” without a protocol matrix is not evidence.

Search tools are easy. Safe posting is the product.

Read-only tools should be the default. If you need writes, prefer a sequence: propose the intended change, validate access and field values, show the diff, require a user-bound confirmation, execute once, and log the outcome. A free-form execute_method tool can bypass a carefully named CRUD surface; expose it only through a strict method allowlist.

Odoo’s ACLs and record rules remain essential, but they are not the whole policy. A user may be allowed to edit an invoice in the UI while an unattended agent should only create a draft activity. MCP needs a narrower boundary than the human account it represents.

Pick by scenario, not stars

Run every candidate against the same test: a low-privilege user, two companies, one forbidden model, one forbidden record, one attempted write, one oversized query, and one revoked credential. The failure behavior tells you more than the demo.

Repository and protocol sources

• Awesome Odoo MCP directory
• MCP specification
• Odoo 19 External JSON-2 API
• Individual GitHub repositories linked in the comparison table; checked 26 August 2026.