Oliver
343 lines
17 KiB
HTML
343 lines
17 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
|
<meta name="robots" content="index, follow" />
|
|
<link rel="canonical" href="https://derez.ai/blog/posts/direct-odoo-api-vs-mcp.html" />
|
|
<title>Direct Odoo API vs MCP — Why Direct Access Wins for AI Agents — derez.ai Blog</title>
|
|
<meta name="description" content="Direct Odoo XML-RPC access vs MCP (Model Context Protocol) for AI agents. Why a dedicated Odoo user with direct API access beats an MCP middleware layer for security, performance, and flexibility." />
|
|
<meta property="og:type" content="article" />
|
|
<meta property="og:url" content="https://derez.ai/blog/posts/direct-odoo-api-vs-mcp.html" />
|
|
<meta property="og:title" content="Direct Odoo API vs MCP — Why Direct Access Wins for AI Agents" />
|
|
<meta property="og:description" content="Direct Odoo API beats MCP middleware for AI agents. Real Odoo user accounts, granular permissions, no extra latency." />
|
|
<meta name="twitter:card" content="summary_large_image" />
|
|
<meta name="twitter:title" content="Direct Odoo API vs MCP — Why Direct Access Wins for AI Agents" />
|
|
<link rel="preconnect" href="https://fonts.googleapis.com" />
|
|
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
|
|
<link href="https://fonts.googleapis.com/css2?family=Inter:opsz,wght@14..32,400;14..32,500;14..32,600;14..32,700&display=swap" rel="stylesheet" />
|
|
<style>
|
|
* { margin: 0; padding: 0; box-sizing: border-box; }
|
|
body {
|
|
background: #08080c;
|
|
color: #e8e8f0;
|
|
font-family: 'Inter', sans-serif;
|
|
line-height: 1.7;
|
|
padding: 40px 20px;
|
|
}
|
|
.container { max-width: 720px; margin: 0 auto; }
|
|
a { color: #00f5ff; text-decoration: none; }
|
|
a:hover { text-decoration: underline; }
|
|
.meta { font-size: 0.85rem; color: #666; margin-bottom: 32px; display: flex; gap: 16px; flex-wrap: wrap; }
|
|
.meta span { display: flex; align-items: center; gap: 4px; }
|
|
.back { margin-bottom: 32px; display: inline-block; font-size: 0.9rem; color: #666; }
|
|
.back:hover { color: #00f5ff; }
|
|
h1 { font-size: 2rem; font-weight: 700; line-height: 1.25; margin-bottom: 16px; }
|
|
h2 { font-size: 1.4rem; margin: 40px 0 16px; color: #f0f0ff; }
|
|
h3 { font-size: 1.1rem; margin: 24px 0 8px; color: #e0e0f0; }
|
|
p { margin-bottom: 16px; color: #c8c8d8; }
|
|
ul, ol { margin: 0 0 20px 20px; color: #c8c8d8; }
|
|
li { margin-bottom: 8px; }
|
|
strong { color: #f0f0ff; }
|
|
code { background: #12121c; padding: 2px 6px; border-radius: 4px; font-size: 0.9em; color: #00f5ff; }
|
|
pre {
|
|
background: #12121c;
|
|
border: 1px solid #1a1a2e;
|
|
border-radius: 10px;
|
|
padding: 16px 20px;
|
|
margin: 0 0 20px;
|
|
overflow-x: auto;
|
|
font-size: 0.85rem;
|
|
color: #c8f0ff;
|
|
}
|
|
pre code { background: none; padding: 0; color: inherit; }
|
|
.pro-tip {
|
|
background: #010f20;
|
|
border-left: 3px solid #00f5ff;
|
|
border-radius: 0 10px 10px 0;
|
|
padding: 16px 20px;
|
|
margin: 0 0 20px;
|
|
}
|
|
.pro-tip p { margin: 0; color: #c8c8d8; font-size: 0.9rem; }
|
|
.pro-tip strong { color: #00f5ff; }
|
|
.badge {
|
|
display: inline-block;
|
|
background: rgba(0,245,255,0.1);
|
|
color: #00f5ff;
|
|
border: 1px solid rgba(0,245,255,0.3);
|
|
font-size: 0.7rem;
|
|
font-weight: 600;
|
|
padding: 3px 10px;
|
|
border-radius: 20px;
|
|
text-transform: uppercase;
|
|
letter-spacing: 0.5px;
|
|
margin-bottom: 16px;
|
|
}
|
|
.compare-grid {
|
|
display: grid;
|
|
grid-template-columns: 1fr 1fr;
|
|
gap: 16px;
|
|
margin: 20px 0;
|
|
}
|
|
.compare-card {
|
|
background: #12121c;
|
|
border: 1px solid #1a1a2e;
|
|
border-radius: 14px;
|
|
padding: 20px 24px;
|
|
}
|
|
.compare-card h3 { font-size: 1rem; margin-bottom: 8px; }
|
|
.compare-card.mcp h3 { color: #ffaa00; }
|
|
.compare-card.direct h3 { color: #00f5ff; }
|
|
.compare-card p { font-size: 0.9rem; margin: 0; }
|
|
.compare-card ul { margin: 8px 0 0 16px; }
|
|
.compare-card ul li { font-size: 0.85rem; }
|
|
.cta-box {
|
|
background: #12121c;
|
|
border: 1px solid rgba(0,245,255,0.2);
|
|
border-radius: 14px;
|
|
padding: 28px 32px;
|
|
margin: 32px 0;
|
|
text-align: center;
|
|
}
|
|
.cta-box h3 { font-size: 1.2rem; margin-bottom: 8px; color: #f0f0ff; }
|
|
.cta-box p { color: #999; margin-bottom: 16px; }
|
|
.btn {
|
|
display: inline-block;
|
|
background: transparent;
|
|
border: 1px solid #00f5ff;
|
|
color: #00f5ff;
|
|
padding: 10px 28px;
|
|
border-radius: 8px;
|
|
font-weight: 600;
|
|
font-size: 0.95rem;
|
|
transition: all .2s;
|
|
}
|
|
.btn:hover { background: rgba(0,245,255,0.1); text-decoration: none; }
|
|
@media (max-width: 600px) {
|
|
body { padding: 24px 16px; }
|
|
h1 { font-size: 1.5rem; }
|
|
.compare-grid { grid-template-columns: 1fr; }
|
|
}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<div class="container">
|
|
<a class="back" href="https://derez.ai">← derez.ai Home</a>
|
|
|
|
<div class="badge">Architecture · Odoo · AI Agents</div>
|
|
<h1>Direct Odoo API vs MCP — Why Direct Access Wins for AI Agents</h1>
|
|
|
|
<div class="meta">
|
|
<span>📅 June 11, 2026</span>
|
|
<span>📖 6 min read</span>
|
|
<span>🏷️ Odoo, MCP, API, AI Agents, Security</span>
|
|
</div>
|
|
|
|
<p>
|
|
If you want your AI agent to talk to your Odoo ERP, you have two choices: give it <strong>direct API access</strong>
|
|
to Odoo's XML-RPC endpoint, or route everything through an <strong>MCP (Model Context Protocol) server</strong> that
|
|
acts as a middle layer.
|
|
</p>
|
|
|
|
<p>
|
|
The MCP approach is trendy — it's an open standard from Anthropic, adopted by Claude, ChatGPT, VS Code, Cursor, and
|
|
others. It promises a "USB-C port for AI" — a universal connector so any AI app can talk to any tool through a
|
|
single protocol.
|
|
</p>
|
|
|
|
<p>
|
|
But trendy isn't always better. After building both approaches at derez.ai, here's why we believe
|
|
<strong>direct Odoo API access via a dedicated agent user</strong> is the superior choice — especially for
|
|
startups running Odoo Community Edition.
|
|
</p>
|
|
|
|
<h2>How MCP Works with Odoo</h2>
|
|
|
|
<p>
|
|
An Odoo MCP server (like <code>tuanle96/mcp-odoo</code>, <code>ivnvxd/mcp-server-odoo</code>, or
|
|
<code>hachecito/odoo-mcp-improved</code>) sits between your AI agent and Odoo. The agent talks to the MCP server
|
|
via the MCP protocol, and the MCP server translates those requests into Odoo XML-RPC calls.
|
|
</p>
|
|
|
|
<pre><code>Agent → MCP Server → Odoo API</code></pre>
|
|
|
|
<p>
|
|
The MCP server exposes a fixed set of "tools" — predefined operations like
|
|
<code>search_records</code>, <code>create_record</code>, <code>read_record</code>, etc. The agent can only
|
|
do what these tools allow.
|
|
</p>
|
|
|
|
<h2>How Direct API Access Works</h2>
|
|
|
|
<p>
|
|
With the derez.ai approach, your agent authenticates directly against Odoo's XML-RPC API using its
|
|
<strong>own dedicated Odoo user account</strong>. There's no middle layer — the agent reads, writes, and
|
|
queries Odoo models directly, subject only to the user's Odoo access rights.
|
|
</p>
|
|
|
|
<pre><code>Agent → Odoo API (as "Agent User")</code></pre>
|
|
|
|
<div class="pro-tip">
|
|
<p><strong>Pro Tip:</strong> A dedicated agent user in Odoo Community Edition costs $0. No per-user license fee.
|
|
Create one with exactly the module rights your agent needs — CRM, Sales, Contacts — and lock everything else.
|
|
Your agent operates within that permission boundary, just like any human employee.</p>
|
|
</div>
|
|
|
|
<h2>Head-to-Head Comparison</h2>
|
|
|
|
<div class="compare-grid">
|
|
<div class="compare-card mcp">
|
|
<h3>⚠ MCP Approach</h3>
|
|
<ul>
|
|
<li>Extra middleware server to deploy and maintain</li>
|
|
<li>Network hop adds latency per request</li>
|
|
<li>Exposes only predefined "tools" — limited surface</li>
|
|
<li>MCP server has its own Odoo API credentials</li>
|
|
<li>Security relies on MCP server implementation</li>
|
|
<li>Breaks if MCP server goes down</li>
|
|
<li>Agent can't discover new models dynamically</li>
|
|
</ul>
|
|
</div>
|
|
<div class="compare-card direct">
|
|
<h3>✅ Direct API (derez.ai)</h3>
|
|
<ul>
|
|
<li>Zero middleware — agent talks directly to Odoo</li>
|
|
<li>No extra latency — same speed as any Odoo client</li>
|
|
<li>Full access to all Odoo models and methods</li>
|
|
<li>Uses a real Odoo user account with native permissions</li>
|
|
<li>Security = Odoo's battle-tested ACL system</li>
|
|
<li>One less service to monitor and maintain</li>
|
|
<li>Agent can query any model its user has rights to</li>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
|
|
<h2>1. Security — Direct API Wins by Design</h2>
|
|
|
|
<p>
|
|
This is the single most important difference.
|
|
</p>
|
|
<p>
|
|
With an MCP server, security depends on how well the MCP server itself handles permissions. The MCP server
|
|
typically authenticates against Odoo with a single set of credentials — often a broad API key — and then
|
|
decides which "tools" to expose. If the MCP server has a bug, your agent gains unrestricted access to
|
|
everything the server's credentials allow.
|
|
</p>
|
|
<p>
|
|
With direct API access, your agent authenticates as a <strong>real Odoo user</strong>. That user has
|
|
<strong>Odoo-native access rights</strong> — the same granular system you already use for your employees.
|
|
The agent can only see and do what that specific user is allowed to. There is no extra layer to compromise.
|
|
</p>
|
|
|
|
<div class="pro-tip">
|
|
<p><strong>Pro Tip:</strong> In Odoo Community Edition, create a user called "Hermes Agent" and enable only
|
|
the modules it needs — CRM read, Contacts read/write, Sales read. Everything else (Accounting, Inventory,
|
|
HR) stays locked. Your agent cannot access data you didn't explicitly grant.</p>
|
|
</div>
|
|
|
|
<h2>2. Performance — Fewer Layers, Fewer Milliseconds</h2>
|
|
|
|
<p>
|
|
Every MCP call adds a round-trip: Agent → MCP Server → Odoo API → MCP Server → Agent. That's two network hops
|
|
instead of one. For a single query this is negligible. For an agent making 20-50 API calls during a complex
|
|
workflow (research a lead, update the CRM, check inventory, create a quote, send an email), the latency
|
|
compounds quickly.
|
|
</p>
|
|
<p>
|
|
Direct access eliminates the middle hop entirely. Your agent reads from and writes to Odoo as fast as any
|
|
native Odoo client.
|
|
</p>
|
|
|
|
<h2>3. Flexibility — Full Model Access vs. Predefined Tools</h2>
|
|
|
|
<p>
|
|
An MCP server exposes a curated set of tools. If your agent needs to do something the MCP server author
|
|
didn't anticipate — query a custom module, call a specific workflow method, search across models — you're
|
|
blocked until the MCP server adds that tool, or you fork the repo and build it yourself.
|
|
</p>
|
|
<p>
|
|
With direct API access, your agent can call <strong>any Odoo model method</strong> its user has rights to.
|
|
Custom modules, third-party apps, Odoo's own <code>search_read</code>, <code>create</code>, <code>write</code>,
|
|
<code>unlink</code> — everything is available. The only boundary is the user's Odoo permission settings,
|
|
not the imagination of an MCP server developer.
|
|
</p>
|
|
|
|
<h2>4. Maintenance — One Less Service to Run</h2>
|
|
|
|
<p>
|
|
An MCP server is a running service. It needs a process manager, logging, monitoring, updates, and
|
|
occasional debugging when something breaks. Every version of Odoo may require MCP server updates to handle
|
|
API changes or new modules.
|
|
</p>
|
|
<p>
|
|
Direct API access requires nothing except the Odoo instance itself — which you're already running. No Docker
|
|
containers, no environment variables for the MCP server, no "why is the MCP server returning 500" debugging
|
|
sessions at 2 AM.
|
|
</p>
|
|
|
|
<h2>5. Auditability — Native Odoo Logging</h2>
|
|
|
|
<p>
|
|
When your agent acts through an MCP server, Odoo sees the MCP server's API credentials — not the agent
|
|
itself. All actions appear under a single service account. You lose the ability to audit "what did the
|
|
agent do vs. what did a human do."
|
|
</p>
|
|
<p>
|
|
With direct access via a dedicated user, every action your agent takes is logged in Odoo under the
|
|
<strong>agent user's name</strong>. You can run standard Odoo audit reports, check the user's history,
|
|
and see exactly which records were read, created, or modified — all without any special monitoring setup.
|
|
</p>
|
|
|
|
<h2>When Would You Use MCP?</h2>
|
|
|
|
<p>
|
|
To be fair, MCP isn't all downsides. It makes sense in specific scenarios:
|
|
</p>
|
|
<ul>
|
|
<li><strong>Multi-platform agents</strong> — If your agent needs to connect to dozens of different tools
|
|
(Odoo, GitHub, Jira, Slack, Google Drive), MCP provides a unified interface for all of them.</li>
|
|
<li><strong>No Odoo API access</strong> — If you're using Odoo Online (SaaS) where direct API access is
|
|
restricted, an MCP server can bridge that gap.</li>
|
|
<li><strong>Ephemeral AI sessions</strong> — Short-lived chat sessions where setting up a real Odoo user
|
|
is overkill.</li>
|
|
</ul>
|
|
|
|
<h2>Our Take at derez.ai</h2>
|
|
|
|
<p>
|
|
For the combination of <strong>Odoo Community Edition + a dedicated Hermes Agent</strong>, direct API access
|
|
is the clear winner. Here's the core insight:
|
|
</p>
|
|
<p>
|
|
Odoo Community Edition already has a permission system that's mature, granular, and free. Adding an MCP
|
|
server on top doesn't enhance security — it <em>replaces</em> Odoo's native ACL with a second,
|
|
independently-maintained permission layer that has to be kept in sync. That's not defense-in-depth;
|
|
that's an extra attack surface.
|
|
</p>
|
|
<p>
|
|
A dedicated Odoo user with precise module-level rights, authenticating directly via XML-RPC, gives your
|
|
agent everything it needs and nothing it doesn't — <strong>using the same security model you already trust
|
|
for your human employees</strong>.
|
|
</p>
|
|
|
|
<div class="pro-tip">
|
|
<p><strong>Pro Tip:</strong> The agent user approach also means you can revoke or modify the agent's access
|
|
at any time from Odoo's standard Users menu — no need to reconfigure an MCP server, restart a Docker
|
|
container, or update environment variables. Just uncheck a permission box and the change is immediate.</p>
|
|
</div>
|
|
|
|
<div class="cta-box">
|
|
<h3>Try It Yourself — $9.50 Off</h3>
|
|
<p>Deploy an Odoo-connected Hermes Agent in 10 Minutes. Direct XML-RPC access, dedicated agent user,
|
|
full granular permissions. Use coupon code <strong>BLOG950</strong> for $9.50 off your first month.</p>
|
|
<a href="https://derez.ai/#pricing" class="btn">Buy Agent →</a>
|
|
</div>
|
|
|
|
<p style="margin-top:48px;padding-top:24px;border-top:1px solid #1a1a2e;font-size:0.85rem;color:#555;">
|
|
<a href="https://derez.ai" style="color:#00f5ff">derez.ai</a> — Deploy your AI agent in 10 Minutes. ·
|
|
<a href="https://derez.ai/odoo-hermes-agent.html">Odoo Integration Guide</a> ·
|
|
<a href="https://derez.ai/odoo-hermes-agent-startups.html">Odoo + Hermes for Startups</a>
|
|
</p>
|
|
</div>
|
|
</body>
|
|
</html> |