blog: Direct Odoo API vs MCP — why direct access wins for AI agents
This commit is contained in:
Oliver
@@ -1,5 +1,14 @@
|
||||
{
|
||||
"posts": [
|
||||
{
|
||||
"id": "direct-odoo-api-vs-mcp",
|
||||
"date": "2026-06-11",
|
||||
"area": "architecture",
|
||||
"agent": "hermes",
|
||||
"headline": "Direct Odoo API vs MCP — Why Direct Access Wins for AI Agents",
|
||||
"teaser": "Direct Odoo XML-RPC access beats MCP middleware for AI agents. Real Odoo user accounts with granular permissions, zero extra latency, no middle layer to maintain.",
|
||||
"link": "blog/posts/direct-odoo-api-vs-mcp.html"
|
||||
},
|
||||
{
|
||||
"id": "speed-run-nextcloud-svg",
|
||||
"date": "2026-06-11",
|
||||
|
||||
@@ -0,0 +1,343 @@
|
||||
<!doctype html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
||||
<meta name="robots" content="index, follow" />
|
||||
<link rel="canonical" href="https://derez.ai/blog/posts/direct-odoo-api-vs-mcp.html" />
|
||||
<title>Direct Odoo API vs MCP — Why Direct Access Wins for AI Agents — Derez.ai Blog</title>
|
||||
<meta name="description" content="Direct Odoo XML-RPC access vs MCP (Model Context Protocol) for AI agents. Why a dedicated Odoo user with direct API access beats an MCP middleware layer for security, performance, and flexibility." />
|
||||
<meta property="og:type" content="article" />
|
||||
<meta property="og:url" content="https://derez.ai/blog/posts/direct-odoo-api-vs-mcp.html" />
|
||||
<meta property="og:title" content="Direct Odoo API vs MCP — Why Direct Access Wins for AI Agents" />
|
||||
<meta property="og:description" content="Direct Odoo API beats MCP middleware for AI agents. Real Odoo user accounts, granular permissions, no extra latency." />
|
||||
<meta name="twitter:card" content="summary_large_image" />
|
||||
<meta name="twitter:title" content="Direct Odoo API vs MCP — Why Direct Access Wins for AI Agents" />
|
||||
<link rel="preconnect" href="https://fonts.googleapis.com" />
|
||||
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
|
||||
<link href="https://fonts.googleapis.com/css2?family=Inter:opsz,wght@14..32,400;14..32,500;14..32,600;14..32,700&display=swap" rel="stylesheet" />
|
||||
<style>
|
||||
* { margin: 0; padding: 0; box-sizing: border-box; }
|
||||
body {
|
||||
background: #08080c;
|
||||
color: #e8e8f0;
|
||||
font-family: 'Inter', sans-serif;
|
||||
line-height: 1.7;
|
||||
padding: 40px 20px;
|
||||
}
|
||||
.container { max-width: 720px; margin: 0 auto; }
|
||||
a { color: #00f5ff; text-decoration: none; }
|
||||
a:hover { text-decoration: underline; }
|
||||
.meta { font-size: 0.85rem; color: #666; margin-bottom: 32px; display: flex; gap: 16px; flex-wrap: wrap; }
|
||||
.meta span { display: flex; align-items: center; gap: 4px; }
|
||||
.back { margin-bottom: 32px; display: inline-block; font-size: 0.9rem; color: #666; }
|
||||
.back:hover { color: #00f5ff; }
|
||||
h1 { font-size: 2rem; font-weight: 700; line-height: 1.25; margin-bottom: 16px; }
|
||||
h2 { font-size: 1.4rem; margin: 40px 0 16px; color: #f0f0ff; }
|
||||
h3 { font-size: 1.1rem; margin: 24px 0 8px; color: #e0e0f0; }
|
||||
p { margin-bottom: 16px; color: #c8c8d8; }
|
||||
ul, ol { margin: 0 0 20px 20px; color: #c8c8d8; }
|
||||
li { margin-bottom: 8px; }
|
||||
strong { color: #f0f0ff; }
|
||||
code { background: #12121c; padding: 2px 6px; border-radius: 4px; font-size: 0.9em; color: #00f5ff; }
|
||||
pre {
|
||||
background: #12121c;
|
||||
border: 1px solid #1a1a2e;
|
||||
border-radius: 10px;
|
||||
padding: 16px 20px;
|
||||
margin: 0 0 20px;
|
||||
overflow-x: auto;
|
||||
font-size: 0.85rem;
|
||||
color: #c8f0ff;
|
||||
}
|
||||
pre code { background: none; padding: 0; color: inherit; }
|
||||
.pro-tip {
|
||||
background: #010f20;
|
||||
border-left: 3px solid #00f5ff;
|
||||
border-radius: 0 10px 10px 0;
|
||||
padding: 16px 20px;
|
||||
margin: 0 0 20px;
|
||||
}
|
||||
.pro-tip p { margin: 0; color: #c8c8d8; font-size: 0.9rem; }
|
||||
.pro-tip strong { color: #00f5ff; }
|
||||
.badge {
|
||||
display: inline-block;
|
||||
background: rgba(0,245,255,0.1);
|
||||
color: #00f5ff;
|
||||
border: 1px solid rgba(0,245,255,0.3);
|
||||
font-size: 0.7rem;
|
||||
font-weight: 600;
|
||||
padding: 3px 10px;
|
||||
border-radius: 20px;
|
||||
text-transform: uppercase;
|
||||
letter-spacing: 0.5px;
|
||||
margin-bottom: 16px;
|
||||
}
|
||||
.compare-grid {
|
||||
display: grid;
|
||||
grid-template-columns: 1fr 1fr;
|
||||
gap: 16px;
|
||||
margin: 20px 0;
|
||||
}
|
||||
.compare-card {
|
||||
background: #12121c;
|
||||
border: 1px solid #1a1a2e;
|
||||
border-radius: 14px;
|
||||
padding: 20px 24px;
|
||||
}
|
||||
.compare-card h3 { font-size: 1rem; margin-bottom: 8px; }
|
||||
.compare-card.mcp h3 { color: #ffaa00; }
|
||||
.compare-card.direct h3 { color: #00f5ff; }
|
||||
.compare-card p { font-size: 0.9rem; margin: 0; }
|
||||
.compare-card ul { margin: 8px 0 0 16px; }
|
||||
.compare-card ul li { font-size: 0.85rem; }
|
||||
.cta-box {
|
||||
background: #12121c;
|
||||
border: 1px solid rgba(0,245,255,0.2);
|
||||
border-radius: 14px;
|
||||
padding: 28px 32px;
|
||||
margin: 32px 0;
|
||||
text-align: center;
|
||||
}
|
||||
.cta-box h3 { font-size: 1.2rem; margin-bottom: 8px; color: #f0f0ff; }
|
||||
.cta-box p { color: #999; margin-bottom: 16px; }
|
||||
.btn {
|
||||
display: inline-block;
|
||||
background: transparent;
|
||||
border: 1px solid #00f5ff;
|
||||
color: #00f5ff;
|
||||
padding: 10px 28px;
|
||||
border-radius: 8px;
|
||||
font-weight: 600;
|
||||
font-size: 0.95rem;
|
||||
transition: all .2s;
|
||||
}
|
||||
.btn:hover { background: rgba(0,245,255,0.1); text-decoration: none; }
|
||||
@media (max-width: 600px) {
|
||||
body { padding: 24px 16px; }
|
||||
h1 { font-size: 1.5rem; }
|
||||
.compare-grid { grid-template-columns: 1fr; }
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div class="container">
|
||||
<a class="back" href="https://derez.ai">← Derez.ai Home</a>
|
||||
|
||||
<div class="badge">Architecture · Odoo · AI Agents</div>
|
||||
<h1>Direct Odoo API vs MCP — Why Direct Access Wins for AI Agents</h1>
|
||||
|
||||
<div class="meta">
|
||||
<span>📅 June 11, 2026</span>
|
||||
<span>📖 6 min read</span>
|
||||
<span>🏷️ Odoo, MCP, API, AI Agents, Security</span>
|
||||
</div>
|
||||
|
||||
<p>
|
||||
If you want your AI agent to talk to your Odoo ERP, you have two choices: give it <strong>direct API access</strong>
|
||||
to Odoo's XML-RPC endpoint, or route everything through an <strong>MCP (Model Context Protocol) server</strong> that
|
||||
acts as a middle layer.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
The MCP approach is trendy — it's an open standard from Anthropic, adopted by Claude, ChatGPT, VS Code, Cursor, and
|
||||
others. It promises a "USB-C port for AI" — a universal connector so any AI app can talk to any tool through a
|
||||
single protocol.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
But trendy isn't always better. After building both approaches at Derez.ai, here's why we believe
|
||||
<strong>direct Odoo API access via a dedicated agent user</strong> is the superior choice — especially for
|
||||
startups running Odoo Community Edition.
|
||||
</p>
|
||||
|
||||
<h2>How MCP Works with Odoo</h2>
|
||||
|
||||
<p>
|
||||
An Odoo MCP server (like <code>tuanle96/mcp-odoo</code>, <code>ivnvxd/mcp-server-odoo</code>, or
|
||||
<code>hachecito/odoo-mcp-improved</code>) sits between your AI agent and Odoo. The agent talks to the MCP server
|
||||
via the MCP protocol, and the MCP server translates those requests into Odoo XML-RPC calls.
|
||||
</p>
|
||||
|
||||
<pre><code>Agent → MCP Server → Odoo API</code></pre>
|
||||
|
||||
<p>
|
||||
The MCP server exposes a fixed set of "tools" — predefined operations like
|
||||
<code>search_records</code>, <code>create_record</code>, <code>read_record</code>, etc. The agent can only
|
||||
do what these tools allow.
|
||||
</p>
|
||||
|
||||
<h2>How Direct API Access Works</h2>
|
||||
|
||||
<p>
|
||||
With the Derez.ai approach, your agent authenticates directly against Odoo's XML-RPC API using its
|
||||
<strong>own dedicated Odoo user account</strong>. There's no middle layer — the agent reads, writes, and
|
||||
queries Odoo models directly, subject only to the user's Odoo access rights.
|
||||
</p>
|
||||
|
||||
<pre><code>Agent → Odoo API (as "Agent User")</code></pre>
|
||||
|
||||
<div class="pro-tip">
|
||||
<p><strong>Pro Tip:</strong> A dedicated agent user in Odoo Community Edition costs $0. No per-user license fee.
|
||||
Create one with exactly the module rights your agent needs — CRM, Sales, Contacts — and lock everything else.
|
||||
Your agent operates within that permission boundary, just like any human employee.</p>
|
||||
</div>
|
||||
|
||||
<h2>Head-to-Head Comparison</h2>
|
||||
|
||||
<div class="compare-grid">
|
||||
<div class="compare-card mcp">
|
||||
<h3>⚠ MCP Approach</h3>
|
||||
<ul>
|
||||
<li>Extra middleware server to deploy and maintain</li>
|
||||
<li>Network hop adds latency per request</li>
|
||||
<li>Exposes only predefined "tools" — limited surface</li>
|
||||
<li>MCP server has its own Odoo API credentials</li>
|
||||
<li>Security relies on MCP server implementation</li>
|
||||
<li>Breaks if MCP server goes down</li>
|
||||
<li>Agent can't discover new models dynamically</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="compare-card direct">
|
||||
<h3>✅ Direct API (Derez.ai)</h3>
|
||||
<ul>
|
||||
<li>Zero middleware — agent talks directly to Odoo</li>
|
||||
<li>No extra latency — same speed as any Odoo client</li>
|
||||
<li>Full access to all Odoo models and methods</li>
|
||||
<li>Uses a real Odoo user account with native permissions</li>
|
||||
<li>Security = Odoo's battle-tested ACL system</li>
|
||||
<li>One less service to monitor and maintain</li>
|
||||
<li>Agent can query any model its user has rights to</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<h2>1. Security — Direct API Wins by Design</h2>
|
||||
|
||||
<p>
|
||||
This is the single most important difference.
|
||||
</p>
|
||||
<p>
|
||||
With an MCP server, security depends on how well the MCP server itself handles permissions. The MCP server
|
||||
typically authenticates against Odoo with a single set of credentials — often a broad API key — and then
|
||||
decides which "tools" to expose. If the MCP server has a bug, your agent gains unrestricted access to
|
||||
everything the server's credentials allow.
|
||||
</p>
|
||||
<p>
|
||||
With direct API access, your agent authenticates as a <strong>real Odoo user</strong>. That user has
|
||||
<strong>Odoo-native access rights</strong> — the same granular system you already use for your employees.
|
||||
The agent can only see and do what that specific user is allowed to. There is no extra layer to compromise.
|
||||
</p>
|
||||
|
||||
<div class="pro-tip">
|
||||
<p><strong>Pro Tip:</strong> In Odoo Community Edition, create a user called "Hermes Agent" and enable only
|
||||
the modules it needs — CRM read, Contacts read/write, Sales read. Everything else (Accounting, Inventory,
|
||||
HR) stays locked. Your agent cannot access data you didn't explicitly grant.</p>
|
||||
</div>
|
||||
|
||||
<h2>2. Performance — Fewer Layers, Fewer Milliseconds</h2>
|
||||
|
||||
<p>
|
||||
Every MCP call adds a round-trip: Agent → MCP Server → Odoo API → MCP Server → Agent. That's two network hops
|
||||
instead of one. For a single query this is negligible. For an agent making 20-50 API calls during a complex
|
||||
workflow (research a lead, update the CRM, check inventory, create a quote, send an email), the latency
|
||||
compounds quickly.
|
||||
</p>
|
||||
<p>
|
||||
Direct access eliminates the middle hop entirely. Your agent reads from and writes to Odoo as fast as any
|
||||
native Odoo client.
|
||||
</p>
|
||||
|
||||
<h2>3. Flexibility — Full Model Access vs. Predefined Tools</h2>
|
||||
|
||||
<p>
|
||||
An MCP server exposes a curated set of tools. If your agent needs to do something the MCP server author
|
||||
didn't anticipate — query a custom module, call a specific workflow method, search across models — you're
|
||||
blocked until the MCP server adds that tool, or you fork the repo and build it yourself.
|
||||
</p>
|
||||
<p>
|
||||
With direct API access, your agent can call <strong>any Odoo model method</strong> its user has rights to.
|
||||
Custom modules, third-party apps, Odoo's own <code>search_read</code>, <code>create</code>, <code>write</code>,
|
||||
<code>unlink</code> — everything is available. The only boundary is the user's Odoo permission settings,
|
||||
not the imagination of an MCP server developer.
|
||||
</p>
|
||||
|
||||
<h2>4. Maintenance — One Less Service to Run</h2>
|
||||
|
||||
<p>
|
||||
An MCP server is a running service. It needs a process manager, logging, monitoring, updates, and
|
||||
occasional debugging when something breaks. Every version of Odoo may require MCP server updates to handle
|
||||
API changes or new modules.
|
||||
</p>
|
||||
<p>
|
||||
Direct API access requires nothing except the Odoo instance itself — which you're already running. No Docker
|
||||
containers, no environment variables for the MCP server, no "why is the MCP server returning 500" debugging
|
||||
sessions at 2 AM.
|
||||
</p>
|
||||
|
||||
<h2>5. Auditability — Native Odoo Logging</h2>
|
||||
|
||||
<p>
|
||||
When your agent acts through an MCP server, Odoo sees the MCP server's API credentials — not the agent
|
||||
itself. All actions appear under a single service account. You lose the ability to audit "what did the
|
||||
agent do vs. what did a human do."
|
||||
</p>
|
||||
<p>
|
||||
With direct access via a dedicated user, every action your agent takes is logged in Odoo under the
|
||||
<strong>agent user's name</strong>. You can run standard Odoo audit reports, check the user's history,
|
||||
and see exactly which records were read, created, or modified — all without any special monitoring setup.
|
||||
</p>
|
||||
|
||||
<h2>When Would You Use MCP?</h2>
|
||||
|
||||
<p>
|
||||
To be fair, MCP isn't all downsides. It makes sense in specific scenarios:
|
||||
</p>
|
||||
<ul>
|
||||
<li><strong>Multi-platform agents</strong> — If your agent needs to connect to dozens of different tools
|
||||
(Odoo, GitHub, Jira, Slack, Google Drive), MCP provides a unified interface for all of them.</li>
|
||||
<li><strong>No Odoo API access</strong> — If you're using Odoo Online (SaaS) where direct API access is
|
||||
restricted, an MCP server can bridge that gap.</li>
|
||||
<li><strong>Ephemeral AI sessions</strong> — Short-lived chat sessions where setting up a real Odoo user
|
||||
is overkill.</li>
|
||||
</ul>
|
||||
|
||||
<h2>Our Take at Derez.ai</h2>
|
||||
|
||||
<p>
|
||||
For the combination of <strong>Odoo Community Edition + a dedicated Hermes Agent</strong>, direct API access
|
||||
is the clear winner. Here's the core insight:
|
||||
</p>
|
||||
<p>
|
||||
Odoo Community Edition already has a permission system that's mature, granular, and free. Adding an MCP
|
||||
server on top doesn't enhance security — it <em>replaces</em> Odoo's native ACL with a second,
|
||||
independently-maintained permission layer that has to be kept in sync. That's not defense-in-depth;
|
||||
that's an extra attack surface.
|
||||
</p>
|
||||
<p>
|
||||
A dedicated Odoo user with precise module-level rights, authenticating directly via XML-RPC, gives your
|
||||
agent everything it needs and nothing it doesn't — <strong>using the same security model you already trust
|
||||
for your human employees</strong>.
|
||||
</p>
|
||||
|
||||
<div class="pro-tip">
|
||||
<p><strong>Pro Tip:</strong> The agent user approach also means you can revoke or modify the agent's access
|
||||
at any time from Odoo's standard Users menu — no need to reconfigure an MCP server, restart a Docker
|
||||
container, or update environment variables. Just uncheck a permission box and the change is immediate.</p>
|
||||
</div>
|
||||
|
||||
<div class="cta-box">
|
||||
<h3>Try It Yourself — $9.50 Off</h3>
|
||||
<p>Deploy an Odoo-connected Hermes Agent in 5 minutes. Direct XML-RPC access, dedicated agent user,
|
||||
full granular permissions. Use coupon code <strong>BLOG950</strong> for $9.50 off your first month.</p>
|
||||
<a href="https://derez.ai/#pricing" class="btn">Buy Agent →</a>
|
||||
</div>
|
||||
|
||||
<p style="margin-top:48px;padding-top:24px;border-top:1px solid #1a1a2e;font-size:0.85rem;color:#555;">
|
||||
<a href="https://derez.ai" style="color:#00f5ff">Derez.ai</a> — Deploy your AI agent in 5 minutes. ·
|
||||
<a href="https://derez.ai/odoo-hermes-agent.html">Odoo Integration Guide</a> ·
|
||||
<a href="https://derez.ai/odoo-hermes-agent-startups.html">Odoo + Hermes for Startups</a>
|
||||
</p>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
Reference in New Issue
Block a user