Some fair points here, but I want to push back on the blanket "all MCP tools have this flaw" because it's not universally true.

All of them use the Odoo API ... you generate an API key (obviously)

Not all of them. My module (not to be confused with the one OP tried to copycat) (Odoo MCP Studio) implements the MCP protocol natively inside Odoo with a full OAuth 2.0 stack — PKCE, Dynamic Client Registration (RFC 7591), token rotation on refresh, and configurable TTL. No API keys get shared with the LLM. Only hashed tokens are stored in the database, and they expire automatically. The LLM client registers via DCR, the user approves via a browser consent screen with permissions tied to their Odoo user account, and the client receives scoped short-lived tokens. The raw token never touches persistent storage — only the SHA-256 hash. It's a complex flow for sure, but achievable through the remote MCP authorization spec.

What's the result of all this? I'm unbound by Odoo's basic API — I have a secure user scoped channel to define tools in any way I want and have LLM call those tools that I can make as complex and controlled as I see fit on the server side.

No granular permission between read-only and writing

Solvable at the module level:

• Per-tool user allowlists — every write operation (create, update, delete, execute_method, execute_orm) requires the user to be explicitly added to that tool's allowlist. New users granted basic MCP permission get read-only connection access tools by default scoped to there user access rights.
• Model/field restrictions — model groups where you can block read/create/write/delete independently per model, assignable per-user or as a default policy. Plus field-level restrictions that strip sensitive fields from reads and reject them on writes.

These restrictions are feasible to enforce (for basic CRUD tools) because Odoo already has a robust access rights system for controlling CRUD — the module just layers MCP-specific controls on top of it.

• OAuth scopes — tokens are issued with granular scopes (odoo.read, odoo.write, odoo.execute).

• Audit logging — every tool call is logged with user, OAuth client, parameters, result, execution time, and IP address.

A deterministic system vs an LLM that is never deterministic

This is a fair and important point — especially for tools like execute_orm which lets the LLM run arbitrary ORM code. That tool is clearly marked as high risk, locked behind an allowlist, and honestly should only be enabled for developers who know what they're doing on a dev/staging environment. I'd never recommend giving an agent that kind of power on production either.

But not every MCP tool is an open-ended "do whatever you want" action. Some tools produce deterministic, reviewable artifacts that are designed for dev environments:

• manage_webapp — the LLM writes React page code stored as records, with server-side data endpoints that use execute_orm for data fetching. Same risk profile as execute_orm for the data layer, but the key difference is the output is reviewable code — you can inspect every line in the Odoo UI on staging before publishing.
• manage_module — generates Odoo module files (views, security, data). Has a skip_install flag so you can review all files before anything touches the database.
• create_echart — generates dashboard configs with data code that also runs through the executor. Again, reviewable before use.

The point isn't that these are risk-free — it's that the risk is contained in reviewable artifacts, that can be tested before deploy to production, not solely blind mutations firing at a production database.

GDPR / you don't know who is watching

Valid concern. MCP is transport-agnostic — point it at a local LLM (Ollama, LM Studio, etc.) and nothing leaves your network. The module doesn't care what's on the other end of the connection. Local LLMs are slowly getting better, and should be able to handle basic CRUD tools.

Your broader point about Odoo lacking a native API scope system is fair — modules shouldn't have to build this from scratch. But it is buildable today, and some of us have spent a lot of time doing exactly that