Connect Odoo to MCP, step by step

• Odoo 17, 18, 19 or 20, Community or Enterprise, self-hosted or on Odoo.sh. Odoo Online can’t install custom modules.
• A public https URL that reaches Odoo. Gental and cloud clients don’t connect to http or private addresses.
• Administrator rights in Odoo (Settings) to install the module and create users.

In Gental MCP › Configuration › General, set Odoo’s public URL (it defaults to web.base.url), copy the MCP URL ending in /mcp, and run the reachability check.

Every request runs as an Odoo user, so this user is the limit of what the agent can reach.

1. A new internal user

   In Settings › Users, create a user named “Gental Agent” with its own email.

2. Only the groups it needs

   Give it only the groups the agent needs, such as Sales user without manager rights. Your record rules apply to it.

3. Add it to “Gental MCP: Connect”

   Without it the user can’t connect or approve a client. You can change the allowed groups in Configuration › Access.

1. Gental

   In Connectors choose Custom MCP server, paste your Odoo URL ending in /mcp, sign in as Gental Agent and approve. For the customer-only tools (“my orders”, “my invoices”), paste the identity secret Gental shows once into Configuration › General.

2. Claude

   Add a custom connector with the same URL, sign in with the Odoo user and approve.

3. ChatGPT

   Add a connector (in developer mode) with the same URL, sign in with the Odoo user and approve.

4. Your scripts

   In Clients › New API key, pick the user and an expiry. The key is shown once; send it as Authorization: Bearer.

• The agent connects as a dedicated least-privilege user, never as an administrator.
• Review the Inbox (Logs › Inbox) weekly, especially denied requests.
• Revoke clients and keys you don’t use in Clients; revoking stops them at once.
• Rotate API keys and the identity secret regularly, and give keys an expiry.
• Keep Odoo and the module up to date.

Each delivery carries X-Gental-Event, X-Gental-Delivery, X-Gental-Timestamp and X-Gental-Signature. The signature is HMAC-SHA256 with your secret over timestamp + "." + the raw body, in hex. Compare in constant time and reject timestamps older than five minutes.

import { createHmac, timingSafeEqual } from 'node:crypto';

// rawBody: the request body exactly as received (a Buffer), before any JSON parsing.
// headers: Node's lower-cased request headers.
export function verifyGentalWebhook(headers, rawBody, secret, now = Date.now() / 1000) {
  const timestamp = headers['x-gental-timestamp'];
  const signature = headers['x-gental-signature'];
  if (!timestamp || !signature) return false;

  // Reject anything older (or newer) than 5 minutes.
  const ts = Number(timestamp);
  if (!Number.isFinite(ts) || Math.abs(now - ts) > 300) return false;

  const expected = createHmac('sha256', secret)
    .update(`${timestamp}.`)
    .update(rawBody)
    .digest('hex');
  const a = Buffer.from(expected);
  const b = Buffer.from(String(signature));
  return a.length === b.length && timingSafeEqual(a, b);
}

import hashlib
import hmac
import time


def verify_gental_webhook(headers, raw_body: bytes, secret: str, now: float | None = None) -> bool:
    """headers: a case-insensitive mapping (Flask, Django, FastAPI request headers)."""
    timestamp = headers.get("X-Gental-Timestamp")
    signature = headers.get("X-Gental-Signature")
    if not timestamp or not signature:
        return False

    # Reject anything older (or newer) than 5 minutes.
    try:
        ts = int(timestamp)
    except ValueError:
        return False
    if abs((time.time() if now is None else now) - ts) > 300:
        return False

    expected = hmac.new(
        secret.encode(), timestamp.encode() + b"." + raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected.encode(), signature.encode())

A delivery can arrive more than once, so ignore any X-Gental-Delivery you have already handled.

• The module on the Odoo App Storeas of November 2026
• MCP specification: Authorizationas of November 2026