Teams are wiring AI agents into everything, but Odoo has no safe front door for them. The out-of-the-box options are the raw XML-RPC and JSON-RPC endpoints, which hand an agent full CRUD over every model the connecting user can touch — no notion of "read this, but only propose that," no per-agent scoping, no human approval step before an agent posts a journal entry or confirms a sales order. Point a general-purpose LLM at those endpoints and you either over-grant (the agent can silently unlink() records or mass-write fields) or under-deliver (you lock it down so hard it can do nothing useful). Odoo's own automated actions and server actions are powerful but they run inside Odoo on your triggers; they are not a way for an external agent to reason, ask, and act conversationally against live ERP data.

ECOSIRE builds you a dedicated MCP (Model Context Protocol) server that sits in front of Odoo and speaks the protocol Claude, ChatGPT, and other agent runtimes already understand. Instead of exposing the whole ORM, we define a curated catalog of tools — for example search_contacts, get_open_invoices, create_lead, draft_quotation — each mapped to specific models and actions and each carrying its own input schema. Under the hood every tool call is executed through Odoo's authenticated API against real models.Model records, so it respects your existing ir.model.access.csv rights and record rules; we layer a second gate on top so an agent can never reach beyond the tools you approved, regardless of what the underlying user account technically permits. Read tools return clean, shaped payloads (not raw dumps); write tools are split into guarded-write and approval-gated modes, so a mutation can be configured to execute immediately, to require a human "approve" click, or to be written to a draft/staging state for review.

Authentication is per agent, not shared. Each connected agent (or each end user behind it) gets its own credential and its own permission profile, so a customer-support agent sees helpdesk and contact tools while a finance agent sees invoicing tools — and the two can be revoked independently. Every tool invocation is logged: which agent, which tool, which arguments, which records were touched, and whether an approval gate fired. That audit trail lives in Odoo as first-class records with views and, where useful, QWeb-rendered reports, so your team reviews agent activity the same way they review any other Odoo document. We can also expose read-only MCP "resources" (saved reports, KPI snapshots) alongside the action tools so agents can ground their answers in your real data before they act.

Because this is build-to-order, we scope it to your Odoo. On a short call we map the exact models, actions, and approval rules you want exposed, confirm whether you are on Community or Enterprise (which affects which apps' models are in play — e.g. accounting, subscriptions, quality), and pin the target version(s) among Odoo 17.0, 18.0, and 19.0. We then build the MCP server plus its companion Odoo module (__manifest__.py, models for logging and permission profiles, ir.model.access.csv, record rules, views), stand it up on staging for UAT, and hand it over installed on your instance. Typical delivery is 2–4 weeks from confirmed scope, and you keep the source and the git repo.