Odoo 20: The Native MCP Server That Opens Your ERP to AI Assistants — What to Secure Before Enabling It

Odoo 20 is being unveiled today in the opening keynote of Odoo Experience 2026 in Brussels. Beyond the already-documented new features (Owl 3, JSON-2 API, embedded AI agents — see our companion article), the official documentation published on odoo.com reveals an addition that doesn't appear in Odoo 19's documentation: a native MCP (Model Context Protocol) server, built into the core product.

MCP in One Sentence

The Model Context Protocol is an open standard that lets an AI assistant (Claude, or any compatible client) connect directly to an external application to read and modify its data, without building a custom integration. That's exactly what Odoo's documentation describes: "an open-source standard that allows large language models (LLMs) to securely interact with external applications and access their data."

What's Actually New — and What Isn't

MCP modules for Odoo have existed for several versions as third-party apps on the Apps Store, including for Odoo 16 and 17. So MCP itself isn't new to the Odoo ecosystem. What changes with Odoo 20: the MCP server becomes native, built into the core product rather than a third-party component to install and maintain separately. Verified on odoo.com/documentation: the page dedicated to the MCP server returns a 404 on the Odoo 19.0 documentation and exists on the branch corresponding to the version 20 currently in development — confirming that native integration is genuinely a new addition in the upcoming release, not a rebranding of an existing feature.

How It Actually Works

• ✓Generate an API key from Settings → Technical → Change my Preferences → Security tab
• ✓Endpoint: the database URL suffixed with /mcp
• ✓Compatible clients cited in the documentation: Claude, Antigravity, Codex
• ✓Client-side setup requires Node.js to run the connection commands
• ✓Once connected, the assistant automatically queries the server for available tools, picks the one matching the user's request, executes it, and responds — with no manual step in between

Default Exposed Tools — and What You Must Enable by Hand

By default, Odoo only exposes basic read tools: Search, Read group (grouped aggregation), and Get Models (list of available models). Anything further — executing an existing Server Action, for example — must be explicitly exposed from Settings → Technical → Server Actions. Nothing is accessible to an AI assistant by default beyond basic reads: it's a restrictive default, but it stays your responsibility the moment you start exposing actions.

The Real Question for an SMB or Mid-Market Company: Access Governance

Giving an AI assistant read and write access to a production database — customers, invoices, inventory, HR depending on installed modules — is not a trivial decision. A few points to check before enabling the MCP server in production:

• ✓Create an API key dedicated to MCP use, separate from any key used for other integrations, so it can be revoked independently
• ✓Test first on a sandbox environment (Odoo.sh or a database copy) before any production connection
• ✓Only expose the Server Actions strictly needed for the intended use — every exposed action is an additional entry point
• ✓Verify that the user tied to the API key doesn't have broader rights than the assistant actually needs (least-privilege principle, via Odoo's existing security groups)
• ✓Log and periodically review calls made through the API key, as with any external integration

Impact on the Odoo 20 Roadmap

General availability for Odoo 20 is still estimated for mid-October 2026, with the first stable patch recommended for a November production rollout. The MCP server logically joins the migration checklist already identified for Odoo 20: while auditing existing integrations (XML-RPC to JSON-2), it's also the right moment to decide, module by module, which business data will be exposed to an AI assistant — and which never will be.

For the full technical migration to Odoo 20 (Owl 3, JSON-2 API, embedded AI agents), see our companion article: Odoo 20 — What Developers Need to Know. For help configuring and securing your Odoo instance, see our offering at /odoo/services.