# @suco/odoo-surface-mcp User-equivalent Odoo access for AI agents via MCP - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 0.6.1 - **Author:** Unknown - **License:** Apache-2.0 - **npm:** @suco/odoo-surface-mcp - **Source:** https://github.com/solutionsunity/odoo-surface-mcp - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-10-04T19:34:45.743Z - **Version scanned:** 0.6.1 - **CVEs:** none found by OSV at scan time ## Tools 40 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `ping` — [DEBUG] Check MCP↔Odoo connectivity. Returns version and latency. - `echo` — [DEBUG] Reflect payload back. Tests MCP tool-call roundtrip. - `inspect_view` — [DEBUG] Return the compiled arch XML for a model's view. - `inspect_action` — [DEBUG] get_model_actions' result plus the raw attributes of every form button - `inspect_fields` — [DEBUG] Return all fields on a model — including technical fields not filtered by view visibility. - `dump_cache` — [DEBUG] Show cache stats and all live keys. - `clear_cache` — [DEBUG] Clear all cache entries. Next call rebuilds from Odoo. - `restart_mcp` — [DEBUG] Exit the MCP server process. The MCP client detects the disconnect and - `get_models` — List primary models the user can navigate to via menus (get_models()), - `get_model_actions` — Return all actions available on a model: server actions (Action menu), - `get_model_interface` — Single-call planning helper: returns form-view field metadata AND all model actions - `list_skills` — List all atomic skills (canonical recipes for ONE thing). Returns name, summary, - `get_skills` — Return one or more skills in full: frontmatter + markdown body + used_in back-references. - `find_skill` — Find skills matching a situation. Filters by model, field_type, and/or operation against - `list_workflows` — List all multi-step workflows. Returns name, summary, applies_to, and the skills each workflow composes. - `get_workflows` — Return one or more workflows in full: frontmatter + markdown body. - `create` - `update` - `execute_action` - `archive` - `post_message` — Post a plain-text message or internal note on a record (requires mail.thread). - `schedule_activity` — Schedule an activity on a record. - `get_available_actions` — Return the buttons and actions that are actually visible for a specific record - `list_records` — Return a paginated list of records — as the list view or the Export dialog would show them. - `read_group` — Count and aggregate records per group — as the list view grouped by a field shows them. - `get_record` — Return form-view field values for a single record. - `search_records` — Find records by name — "which record is called X" — with the model's own name matching - `get_fields` — Return metadata for all fields visible in a model's form or list view. - `get_defaults` — Return the default field values Odoo would pre-fill when clicking New. - `get_filters` — Return saved filters and favourites available for a model's list view. - `list_snippets` — List available website building-block snippets. - `get_snippet` — Fetch the ready-to-inject HTML for a website building-block snippet. - `list_attachments` — Search ir.attachment records for any model. Returns metadata only — never binary data. - `fetch_and_upload` - `download_binary` — Download a binary field value from an Odoo record to a local absolute path on the MCP server filesystem. - `upload_binary` - `translation_get` — Read all language translations for a translatable field on a record. - `translation_update` - `translation_audit` — Audit translation coverage and integrity for translatable field(s) across one or more records. - `list_pages` — List website pages. Returns id, name, url, is_published, view_id, website_id for each page. ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"odoo-surface\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"@suco/odoo-surface-mcp\"\n ],\n \"env\": {\n \"ODOO_PASSWORD\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `ODOO_PASSWORD` — Odoo Password (required) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 1 credential (1 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Extensive blast radius — mutates data; holds an api key. - Floor 47, ceiling 47 (tier: extensive) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/%40suco%2Fodoo-surface-mcp - Install plan: https://forgeregistry.com/api/v1/packages/%40suco%2Fodoo-surface-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/%40suco%2Fodoo-surface-mcp - HTML page: https://forgeregistry.com/registry/%40suco%2Fodoo-surface-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.