Odoo MCP for Odoo 17: XML-RPC, not JSON-2.

What 17 can do

The Odoo 17 External API is XML-RPC and JSON-RPC. A community or homegrown MCP server can call it with a dedicated user and a tight method list. Claude, ChatGPT and Gemini still speak MCP on the other side.

JSON-2 does not exist here. Copy-pasting /json/2/res.partner/search_read from a 19 article will fail. Odoo 16 is the same API generation if you are even earlier — same caveats, older security patches.

What we will not claim

Odin’s MCP Governance Suite is Odoo 19 and 18. We do not list 17. If you need an in-Odoo module with OAuth 2.1 and write approvals, plan an upgrade to 18 or 19, or run a 17-compatible external MCP server you maintain.

Official “connect via MCP” language is in the 19.4 notes, not 17. Official vs community.

If you stay on 17

Dedicated bot user, no admin. Read-only methods first. Rotate keys. Log calls. Same security as 19 — the protocol did not get looser because the ERP is older.

Clients: Claude · ChatGPT · Gemini. Compare 18 if you can move one version.

Security debt on 17 databases

17 systems that never had an AI project often still have XML-RPC on 0.0.0.0 and an admin key in a wiki. MCP will find that. Put the API behind a allow-list, create a bot user, revoke leftover keys, then attach Claude.

If you cannot do those four things, you are not ready for MCP on 17. You are ready for an upgrade conversation.

When 17 is still the right call

A factory on 17 with a frozen customisation set may not move this year. An external read-only MCP server is then a contained experiment. Time-box it. Write down the upgrade date. Do not staff a three-year XML-RPC platform.

Official documentation

• Odoo 17 External API
• Model Context Protocol
• Odoo 18 External API (next step)