Short answer
The much. MCP Server (technical name mcp_server) and Odoo's built-in MCP server in Odoo 20 (ai_mcp) both let AI assistants read and write Odoo data through the Model Context Protocol. The much. module adds a per-model whitelist with separate create, read, update, delete and method rights, ships audit logs and rate limiting, and runs on Odoo 16 to 20.
Odoo's native server exists only in Odoo 20. Any tool you expose works on every model the user can access, and Odoo documents the setup for local agents such as Claude Code, Codex and Antigravity. For companies that want to connect Claude.ai, ChatGPT or Microsoft Copilot to Odoo with tight control over what the AI can touch, the much. MCP Server is the better fit today.
Comparison at a glance
| Category | much. MCP Server | Odoo 20 native MCP (ai_mcp) |
|---|---|---|
| Odoo versions | 16, 17, 18, 19, 20 | 20 only |
| Edition | Community and Enterprise | Needs Odoo's AI app (Enterprise) |
| Hosting | Odoo Online, Odoo.sh, on premise | Odoo Online, Odoo.sh, on premise |
| Price | Free | Included in Odoo Enterprise |
| Configuration | One settings page in Odoo (Settings > MCP Server) | Split across Settings > Integrations, Server Actions and OAuth Clients (developer mode) |
| Documented AI clients | Claude.ai, Claude Desktop, ChatGPT, M365 Copilot, Copilot Studio, Perplexity, Mistral Le Chat, Gemini Enterprise, Claude Code, Cursor, VS Code, Windsurf, Gemini CLI | Claude Code, Claude Desktop, Codex, Antigravity, Grok |
| Local software needed | None for cloud chats | Node.js and mcp-remote for API key setups |
| Model whitelist | Default deny, each model enabled by an admin | None, every model the user can access |
| Rights per model | Read, create, update, delete set separately | Rights set per tool, valid for all models |
| Buttons and methods | Opt-in per model, public methods only | Only through custom server actions |
| Read-only sessions | Enforced on the server | Readonly flag is a hint to the client |
| Audit log | Calls, denials, login attempts (30 days default) | Not documented |
| Rate limiting | Per user, configurable | Not documented |
| Token control | Smart default fields, record limits, pagination, files on demand | Fields chosen by the model per call, no documented limits |
| Attachments | Reads PDF, Office and image files, uploads files | No attachment tools |
| Delete records | Opt-in per model | No delete tool |
| UI navigation and website editing | No | Yes |
| Adoption | Around 10,000 Odoo databases | New with Odoo 20 |
Setup and supported AI clients
The much. MCP Server is set up in four steps inside Odoo and then works in browser chats without any local software:
- Install the module from the Odoo App Store.
- Switch it on under Settings > MCP Server and enable the models the AI may use.
- Add users to the "MCP User" group.
- Paste the /mcp URL into the AI client and log in through OAuth.
much. documents working setups for Claude.ai, Claude Desktop, ChatGPT, Microsoft 365 Copilot, Copilot Studio, Perplexity, Mistral Le Chat and Gemini Enterprise, plus coding agents like Claude Code, Cursor and Windsurf. Clients that only speak stdio connect through the open source mcp-server-odoo bridge, with the same permissions and audit log.
Odoo's documentation for the native server lists an MCP-compatible agent such as Claude Code, Antigravity or Codex as a prerequisite. Connecting with an API key requires Node.js and the mcp-remote package on the user's machine, configured through a JSON file or terminal command. OAuth works without that bridge, but admins first approve each AI client by its metadata URL or open Dynamic Client Registration to any client.
After connecting, an admin still has to switch on developer mode and tick "Available in MCP" on each server action beyond the five default read tools. Writing data needs at least the Create Records and Update Records tools exposed by hand.
Permissions and access control
Both servers run every call as the logged-in Odoo user, so standard access rights and record rules apply. The difference is what an admin can restrict on top of that.
The much. MCP Server uses two layers. Layer one is the user's own Odoo rights. Layer two is an MCP whitelist that is closed by default: an admin enables each model separately and sets read, create, update and delete per model. Calling business methods, the code behind buttons like "Confirm" on a sales order, is off by default and enabled per model. Private methods and raw data access methods are always refused.
In practice, a sales team can let the AI read CRM leads and update their stage, read products, and confirm quotations, while invoices, payroll and HR records stay invisible to the AI even for users who see them in Odoo.
Odoo's native server has one layer. Tools are exposed per server action, and each tool works on every model the user can reach. Once "Update Records" is available, the AI can update any record the user may edit, and the tool accepts a domain, so one call can change every record that matches a filter. There is no way to keep the AI away from accounting while the same user works in accounting in the browser.
Security features
The much. MCP Server documents twelve security controls beyond user rights. Odoo's documentation for the native server covers OAuth client approval, API key scope and expiry, and revoking keys.
- Read-only sessions: the user can tick a consent box that limits the session to reading. Write tools are hidden and refused on the server. In Odoo's server, "Readonly Tool" only tells the client it may skip asking for approval.
- Audit log: every call, every denied call and every login attempt is logged, kept 30 days by default.
- Rate limiting: per-user request limits, answered with HTTP 429.
- Clean errors: tracebacks and SQL never reach the AI client.
- Origin allowlist: optional block for browser requests from unknown websites.
- Token handling: OAuth 2.1 with PKCE, one-hour access tokens, rotating refresh tokens, and revocation of the whole token family when a refresh token is reused.
- Token binding: tokens only work for the /mcp endpoint (RFC 8707).
- Hashed storage: tokens are stored as hashes in the database.
- Revocation: single tokens or every token of a client can be revoked.
- Registration limits: dynamic client registration is rate-limited per IP.
- MCP-only API keys: keys scoped to MCP cannot call the general Odoo API.
- Access groups: "MCP User" is required for any access, "MCP Administrator" for configuration.
For companies under ISO 27001, SOC 2 or GDPR audits, the audit log and the per-model whitelist are usually the deciding points. They show who let the AI do what, on which data.
Token efficiency and data handling
Every record an MCP server returns is read by the language model and billed as tokens. The much. MCP Server is built to keep those answers small:
- Smart field selection: when the AI asks for records without naming fields, the server returns a compact set of relevant fields.
- Record limits: admins set a default and a maximum number of records per call, with pagination for larger sets.
- Files on demand: images and attachments are not embedded as base64. The AI fetches them through MCP resources only when needed.
- Context in the handshake: user, timezone and company scope arrive once at session start.
- Batch writes: creating or updating many records is one atomic call.
Odoo's native Search tool returns the fields the model requests on a given domain, much like the Odoo external API. Odoo's documentation names no default field set, record cap or pagination. With large models such as sale.order or account.move, a single broad search can fill a large part of the context window, which slows answers and raises cost per question.
Tools and capabilities
The much. MCP Server exposes 17 tools for working with business data. Odoo's native server lists 27 tools, of which 16 drive Odoo's own user interface and website builder.
| Capability | much. MCP Server | Odoo 20 native MCP |
|---|---|---|
| Search, read, group and aggregate | Yes | Yes |
| Create and update | Single and atomic batch | Create Records, Update Records by domain |
| Delete | Yes, opt-in per model | No |
| Run business methods (buttons) | Yes, opt-in per model | Only through custom server actions |
| Read attachments | PDF, Word, Excel text extraction, images, download links | No |
| Upload attachments | Yes | No |
| Post to the chatter | Yes | No |
| Custom tools from server actions | Yes, with JSON input schema, access groups, rollback on error and audit | Yes, server actions flagged "Available in MCP" |
| Open list, kanban, pivot and graph views | No | Yes |
| Edit website pages and CSS | No | Yes |
| Generate images, search the web | No | Yes |
Attachment reading matters more than it looks. Asking the AI to check a supplier's PDF invoice against the purchase order, or to summarise the contract attached to a customer, only works when the server can open the file.
Versions, license and lock-in
The much. MCP Server is free and open source, runs on Odoo Community and Enterprise, and supports Odoo 16, 17, 18, 19 and 20. Companies on older versions get MCP access now, without an upgrade project.
Odoo's native server ships with Odoo 20 as part of the AI app. Using it means running Odoo 20 Enterprise. Odoo has a track record of moving features into paid services: its in-app AI, OCR and SMS features run on prepaid IAP credits sold by Odoo. Several native MCP tools, like image generation and web search, depend on Odoo's AI services.
An open source module keeps the MCP layer independent from Odoo SA's pricing decisions. Any Odoo partner or in-house developer can read, audit and extend the code.
One more point for Odoo 20 users: Odoo is removing the XML-RPC and JSON-RPC endpoints in the same release. Integrations built on those APIs need rework anyway, which makes it a good moment to decide on the MCP layer.
Where Odoo's native MCP is stronger
Odoo's server wins when the AI should operate the Odoo screen for the user. Its navigation tools open list, kanban, pivot and graph views with filters and grouping, adjust the current search, and render record preview cards in Odoo's chat. Prompts like "filter this view to my team and group by month" have no equivalent in the much. module.
It also covers website work: reading and writing custom CSS, inserting snippets, editing page HTML, finding Unsplash photos and generating images.
Finally, it is maintained by Odoo SA and needs no extra module. For an Odoo 20 Enterprise customer who mainly wants AI help inside the Odoo interface and the website builder, that is a fair reason to start there.
Which one to choose
- You run Odoo 16 to 19: the much. MCP Server is the only one of the two available to you.
- You run Odoo Community: the much. MCP Server, since the native server needs Enterprise.
- Your team works in Claude.ai, ChatGPT or Microsoft Copilot in the browser: the much. MCP Server, with documented setups for these clients.
- The AI should see some apps but not others: the much. MCP Server, because only it restricts access per model and per operation.
- You need an audit trail of AI actions: the much. MCP Server.
- You are on Odoo 20 Enterprise and want the AI to drive Odoo views and the website builder: Odoo's native server.
Both can run on the same Odoo 20 database. A workable setup is the much. module for data work from external AI clients, with Odoo's native tools for in-app navigation.
FAQ
Does Odoo 20 have a built-in MCP server?
Yes. Odoo 20 ships the ai_mcp module as part of its AI app. It exposes Odoo server actions as MCP tools at https://<your-database>/mcp, with OAuth or API key login.
Can I use MCP with Odoo 17, 18 or 19?
Yes, with the much. MCP Server from the Odoo App Store. It supports Odoo 16 to 20. The native server is only part of Odoo 20.
Can I connect Claude.ai or ChatGPT in the browser to Odoo?
Yes. The much. MCP Server documents OAuth setups for Claude.ai, ChatGPT, Microsoft 365 Copilot, Perplexity, Mistral Le Chat and Gemini Enterprise. You paste the /mcp URL and log in.
Can I stop the AI from seeing accounting or HR data?
With the much. MCP Server, yes: leave those models off the whitelist. With Odoo's native server, the AI sees everything the user can see, so you would need a separate user with fewer rights.
Is the much. MCP Server free?
Yes. It is free and open source, for Odoo Community and Enterprise.
Who makes the much. MCP Server?
much. Consulting, an Odoo Gold Partner with offices in Germany, Portugal and the UK. The module is used by around 10,000 Odoo databases.
