Odoo

Getting an API key

1. In Odoo open your user menu → My Profile → Account Security and create a new API key. In the New API Key dialog set Duration to Persistent Key (offered to administrators), or to the longest duration offered (up to 3 Months for other users). Since Odoo 18 API keys expire, and the dialog preselects 1 Day: such a key stops working the next day with "Invalid apikey". Odoo shows the key once.
2. Put it in ODOO_API_KEY, your instance URL in ODOO_URL (e.g. https://mycompany.odoo.com, no trailing slash) and the database name in ODOO_DB. On Odoo Online the database name is usually the subdomain.

This adapter uses the JSON-2 API, which Odoo introduced in 19 and which is the only Odoo HTTP surface a generic REST engine can speak: POST {url}/json/2/{model}/{method} with the key as a bearer token and the database in an X-Odoo-Database header. On Odoo 18 and older that route does not exist: use the Odoo 14-18 (JSON-RPC) connector, which talks to the classic /jsonrpc endpoint.

Domains are Odoo's query language. A domain is a list of triples: [["state","=","sale"],["amount_total",">",1000]], implicitly AND-ed. | and ! prefix operators express OR and NOT. odoo_search_read takes one verbatim, which is what makes this connector able to answer questions the purpose-built tools do not cover.

Always pass fields. Odoo models have hundreds of columns and omitting fields returns all of them, which will exhaust the agent's context on a handful of rows. Start with odoo_fields_get to see what exists.

Fields Odoo 19 dropped or renamed. Naming a field the model does not have, in fields, a domain or values, fails the whole call with Invalid field 'x' on 'model'. The usual ones: res.partner has no mobile any more (use phone) and no title; sale.order.line taxes are tax_ids, not tax_id. After such an error, check the model with odoo_fields_get and retry without the field rather than repeating it.

Totals and grouping: Odoo 19 has no public read_group (the JSON-2 API answers 404). Call formatted_read_group through odoo_call_method instead, with kwargs such as {"domain": [["state","=","posted"]], "groupby": ["company_id"], "aggregates": ["amount_total:sum", "__count"]}. Aggregates are field:function (sum, avg, min, max, count_distinct) plus __count.

Permissions follow the user. The API key inherits its owner's access rights and record rules. A restricted user sees fewer rows, not an error — so an agent reporting 'no open orders' may simply be looking through the wrong account.

Self-hosted, which is the thing to plan for.

• On AnythingMCP Cloud the instance must be reachable from the public internet on a real hostname with a valid TLS certificate. A self-signed certificate will fail: the connector offers no trust-anything switch.
• On an internal host (odoo.intern, 10.0.0.x), self-host AnythingMCP on the same network and add that host to SSRF_ALLOWED_HOSTS, or the outbound guard refuses the call before it is made.

Writes: odoo_create and odoo_write change the live database, and Odoo's automations (mail, stock moves, accounting entries) fire as if a person had done it.