Give an AI access to your Odoo: the MCP module vs Make/Zapier, and what's safe

The short answer: if your Odoo runs on Odoo.sh or your own server — including the free, open-source Odoo Community edition you self-host [17] — install the free MCP Server module [1][2], connect it read-only, and you have the best version of this on the table — no per-call meter, no data leaving your box, and a consent screen where unchecking "Allow creating and modifying data" means "write tools are not even listed" [1]. If your Odoo is on Odoo Online, stop: Odoo's own documentation says "Odoo Online is incompatible with custom modules or modules from the Odoo Apps Store" [3], and the Make/Zapier alternative needs the External API, which Odoo says is "only available on Custom Odoo pricing plans" [4]. That is the whole comparison in two sentences: your hosting decides your option, and read-only decides your risk.

At a glance (checked 25 Aug 2026)

All prices in USD as each vendor's own page displays them. Terms change — click the sources.

One conflict worth naming. The module's Apps-store availability table ticks Odoo Online, Odoo.sh and On Premise [1]. Odoo's own administration docs say the opposite about Odoo Online [3]. When a marketplace tile and the vendor's documentation disagree, believe the documentation — and if you're on Odoo Online, ask the publisher in writing before you buy anything.

What you're actually buying

The MCP module: a door, not a robot

MCP (Model Context Protocol) is a standard way for an AI app — Claude, ChatGPT, Copilot, Cursor and others [1] — to call tools inside your systems. The module turns your Odoo into one of those tool servers. It exposes twelve tools: seven that read (search_records, get_record, get_fields, list_models, aggregate_records and friends) and five that write (create_record, update_record, delete_record, post_message, and an admin-only call_model_method) [1].

Two things make it more grown-up than the demos suggest. First, "every call runs as a real Odoo user" and "Odoo ACLs and record rules always apply" [1] — so the AI cannot see or do anything the user account behind it couldn't. Second, the consent screen has a checkbox: "Allow creating and modifying data". Uncheck it and the session gets the mcp:read scope, where "write tools are not even listed and any write attempt is refused" [1]. That is a real, enforced boundary, not a prompt asking the model nicely.

It is free to install on Odoo Apps [1][2] — worth saying plainly, because the same store lists paid MCP modules from US$10.22 up to US$265.94 (flat figures, no monthly label) [2]. Two things keep that "free" honest. The module ships under Odoo's Proprietary Licence (OPL-1) [1]: free to run, but not open source, so you can't fork it and you depend on its publisher. The platform under it, though, genuinely can be free — Odoo Community is the free, open-source edition you self-host, and Enterprise is the paid subscription you'd upgrade to [17]. The module's only Odoo dependency is the core Discuss app [1], so a Community instance on your own VPS runs it with zero licence cost. The realistic bill is your server and your time, not a subscription.

Make and Zapier: the same reach, none of the gate

Both platforms talk to Odoo over its External API. Make's Odoo app wants your hostname, database name, and "either the API key you copied in the section above, or the password you use to log in" [7]. Odoo's docs are blunt about what that key is: "it is equivalent to your password" [4].

That matters more than it sounds. Make's Odoo app ships 20 modules, one of which is a generic "Make an API Call" [7]. There is no read-only scope to uncheck. Whatever that key can do, an AI step in your scenario can do. Zapier's Odoo CRM app is the opposite problem: one trigger and two actions [10] — nowhere near enough to answer "what did we sell last quarter".

Zapier does have its own MCP server, included "on all Zapier plans", where "Each MCP tool call uses two tasks from your plan's quota" [9]. On the free 100-task tier that is 50 AI calls a month. It is a meter on curiosity.

The decision-flips

1. Hosting decides your menu. Odoo Online can't install the module [3] and needs the Custom plan for the API [4]. Odoo.sh and on-premise can do either.
2. Only one option can be locked read-only. The module's mcp:read scope [1] has no equivalent in a pasted API key [4][7].
3. Only one option is unmetered. Credits [6] and tasks [8][9] price your questions. Your own server doesn't.

Singapore-specific notes

• Write access has an IRAS edge here that it doesn't have elsewhere. Under the GST InvoiceNow Requirement, "GST-registered businesses are required to use InvoiceNow-Ready Solutions to transmit invoice data directly to IRAS for tax administration", phased "From 1 November 2025" for newly incorporated voluntary registrants, "From 1 April 2026" for all new voluntary registrations, and from "1 Apr 2028" through "1 Apr 2031" for everyone else by turnover band [13]. An AI that posts a wrong invoice in your Odoo is not just a bookkeeping error you can quietly reverse — depending on your phase, that data is on its way to IRAS. This is the single strongest argument for read-only. (Which tools actually transmit.)
• PDPA: self-hosting keeps the transfer question from arising. Section 26(1) of the PDPA "provides that an organisation must not transfer any personal data to a country or territory outside Singapore except in accordance with requirements prescribed under the PDPA to ensure that organisations provide a standard of protection to personal data so transferred that is comparable to the protection under the PDPA" [14]. Odoo on your own Singapore VPS with the module installed keeps customer records where they are. Note the honest limit: the AI client is still an overseas service, and the records it reads land in its context. Read-only shrinks that surface; it does not delete it.
• Support is on European hours. The module's publisher lists "offices in Germany, Portugal and the United Kingdom" [16]. No Singapore presence, no SGT support window. Budget for that when something breaks on a Monday morning.
• Not grant territory. A free module and a self-serve Make or Zapier subscription aren't the shape of thing grants fund; see the grant-path reality and /grants before anyone quotes you an "AI ERP integration" package.
• Billing is in USD on Make and Zapier [6][8], so add FX and GST on imported services to both.

Which one for which business

• Odoo.sh or self-hosted, and you want reports: the free module, read-only. This is the clean win and it costs nothing [1][2].
• Odoo Online: neither, for now. You'd be upgrading to the Custom plan [4][5] to buy a worse version of this. Wait.
• You already run Make for other chores: you can reach Odoo today [7] — but treat the API key as a password [4] and put the AI step before a human, not after.
• You want an AI to actually execute transactions: stop and read the next section twice. Then do it in a staging database first.
• Zapier only: the Odoo CRM app's three operations [10] won't carry a reporting use case. Compare Make and Zapier properly before you pick a platform for this.
• Comfortable with Docker and a VPS: you're the reader this module was built for. (Same territory as self-hosted n8n.)

The write-access problem, stated honestly

Anthropic's own documentation for connecting Claude to remote MCP servers says: "Malicious MCP servers may include hidden instructions that try to make Claude perform unintended actions", "Only connect Claude to servers built and hosted by organizations and applications you trust", and "Review Claude's tool approval requests carefully and only click 'Allow always' when using a server and tool that you trust to run unsupervised" [11]. The MCP specification itself states that "Hosts must obtain explicit user consent before invoking any tool" and that tool descriptions "should be considered untrusted, unless obtained from a trusted server" [12].

Read that against what a write-enabled ERP connection means. The AI reads a customer email or a supplier PDF; that text can contain instructions; the model has create_record and update_record in its hands; and Odoo has no undo button for a posted journal entry. The module's own docs also warn that custom tools "bypass a model's Allow Read/Create/Write/Delete flags" [1] — the guardrails are real, and they have edges.

None of this makes write access unusable. It makes "Allow always" the wrong click. Custom connectors are available on Claude "Free, Pro, Max, Team, and Enterprise plans", with free users "limited to one custom connector" [11] — so you can test this at zero cost before deciding anything.

Practitioner note, and the honest boundary of it: this site's founder builds custom Odoo v17 modules and runs self-hosted Docker stacks, so the install-and-upgrade reality below is his day job — but per how we research, everything here is desk research against the pages in the Sources list. Nobody here has run this module in production, and nothing on this page wears a Tested badge.

That install reality: a module is a dependency you now own. It's published for 16.0 through 19.0 [1][2], and every Odoo major version is a migration. A module that lags a release leaves you choosing between the module and the upgrade. Free to install is not free to keep.

You might need neither if…

…you ask your Odoo fewer than about five ad-hoc questions a month, and they're the same five. Odoo already has saved filters, group-by and pivot views. Build those five views once, pin them to a dashboard, and you have replaced the entire use case for zero dollars and zero new attack surface — permanently, not until the credits run out.

The other "neither": if you're on Odoo Online, the honest answer today is buy nothing. The module can't be installed [3] and the API needs a plan upgrade [4]. Revisit when your hosting changes, not before. And if your reporting question is really "where did the money go this month", a daily snapshot to Telegram is cheaper than any of this.

Your first 30 minutes, step by step

1. Find out where your Odoo lives. Odoo Online, Odoo.sh, or your own server. If it's Odoo Online, you're done — see the section above.
2. Write down the three questions you'd actually ask. "Top 10 customers by revenue this quarter." "Which invoices are over 60 days?" If they're all answerable by a pivot view, build the pivot view and stop.
3. Make a dedicated Odoo user for the AI — not your admin account. Give it access to the models your three questions touch and nothing else. Odoo's ACLs and record rules are what actually bound this [1].
4. Install the module on a staging database first, never production. On Odoo.sh that's a staging branch; self-hosted, that's a copy.
5. Connect read-only. At the consent screen, leave "Allow creating and modifying data" unchecked [1]. Confirm the write tools genuinely don't appear.
6. Ask your three questions — where you already know the answers. Check every number against Odoo's own view. This step is the whole evaluation; do not skip it because the first answer looked confident.
7. Only then consider writes — in staging, on a reversible model, with tool approval on every call [11]. If you can't articulate how you'd detect a wrong write within 24 hours, you're not ready for write access.

FAQ

Is the module really free, or is that a trial? Odoo's own store shows "FREE" for the much. Consulting module [1][2]. The same store sells other MCP modules from US$10.22 to US$265.94 [2]. Free here means free to install; your Odoo licence, hosting and upgrade labour are the actual costs.

Can I skip the module and just point Make at Odoo? Yes, if your Odoo plan has the External API — Odoo says that's "only available on Custom" plans, "not available on One App Free or Standard" [4]. You'll paste a key that "is equivalent to your password" [4] into a platform whose Odoo app includes a generic "Make an API Call" [7]. It works. It has no read-only mode.

What stops the AI from deleting my records? Three things, in order of reliability: the Odoo user's own access rights and record rules [1]; the read-only mcp:read scope, where write tools aren't offered at all [1]; and per-call tool approval in your AI client [11]. The first two are enforced by software. The third depends on you not clicking "Allow always" [11].

Will this let an AI file my GST return? Don't let it. Under the GST InvoiceNow Requirement, invoice data is transmitted directly to IRAS on a published phase-in from 1 Nov 2025 to 1 Apr 2031 [13]. Machine-generated entries flowing to the tax authority without a human reading them is a category of mistake worth staying well clear of.

Which AI apps can connect? The module lists Claude, ChatGPT, Microsoft Copilot, Perplexity, Mistral Le Chat, Cursor and VS Code [1]. On Claude specifically, custom connectors work on Free, Pro, Max, Team and Enterprise, with Free limited to one connector [11].

Next step

Answer one question before you install anything: where does your Odoo run? On Odoo Online, close this tab and keep your money [3][4]. On Odoo.sh or your own server, spend thirty minutes on the seven steps above — a staging database, a limited user, read-only consent, and three questions you already know the answers to. If the answers are right, you have a genuinely useful reporting assistant for free. If you then want write access, earn it in staging first.

Sources

1. Odoo Apps — MCP Server module (much. Consulting): apps.odoo.com/apps/modules/19.0/mcp_server — fetched 25 Aug 2026
2. Odoo Apps — modules matching "mcp server", with list prices: apps.odoo.com/apps/modules/browse?search=mcp+server — fetched 25 Aug 2026
3. Odoo docs — Odoo Online: odoo.com/documentation/19.0/administration/odoo_online.html — fetched 25 Aug 2026
4. Odoo docs — External API (plan restriction, API keys): odoo.com/documentation/17.0/developer/reference/external_api.html — fetched 25 Aug 2026
5. Odoo pricing: odoo.com/pricing — fetched 25 Aug 2026 (page geolocates its currency; see note below)
6. Make pricing: make.com/en/pricing — checked on the live page 25 Aug 2026 (the page blocks automated fetching; figures — US$10.59/mo monthly, US$9/mo annual — read directly on the live page)
7. Make — Odoo app documentation: apps.make.com/odoo — fetched 25 Aug 2026
8. Zapier pricing: zapier.com/pricing — fetched 25 Aug 2026
9. Zapier MCP: zapier.com/mcp — fetched 25 Aug 2026
10. Zapier — Odoo CRM integration: zapier.com/apps/odoo/integrations — fetched 25 Aug 2026
11. Claude support — custom connectors (remote MCP): support.claude.com/en/articles/11175166-about-custom-connectors-remote-mcp — fetched 25 Aug 2026
12. MCP specification — Security and Trust & Safety: modelcontextprotocol.io/specification/2025-06-18 — fetched 25 Aug 2026
13. IRAS — GST InvoiceNow Requirement FAQ (version 16 Apr 2026): iras.gov.sg/media/docs/default-source/uploadedfiles/gst/frequently-asked-questions-for-gst-invoicenow-requirement.pdf — fetched 25 Aug 2026
14. PDPC — Advisory Guidelines ch.19, The Transfer Limitation Obligation: pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/the-transfer-limitation-obligation---ch-19-(270717).pdf — fetched 25 Aug 2026
15. Odoo affiliate program: odoo.com/affiliate — fetched 25 Aug 2026
16. much. Consulting: muchconsulting.com — fetched 25 Aug 2026
17. Odoo docs — Community vs Enterprise (Enterprise requires a paid subscription code; Community is the free, open-source base): odoo.com/documentation/19.0/administration/on_premise/community_to_enterprise.html — fetched 25 Aug 2026

A note on source 5: Odoo's pricing page serves a currency based on where the request comes from, and it would not return Singapore dollars for us on 25 Aug 2026. We have therefore quoted Odoo's plan names and feature boundaries from it — "One App Free", "Standard", "Custom", and External API sitting under Custom — but no Odoo licence figure. Check current pricing in SGD on the page yourself before budgeting.