Odoo MCP Server — agentic threat model
The Odoo MCP Server presents a high-risk profile due to its direct integration with critical ERP systems (accounting, inventory, sales). Without robust, external access controls and human-in-the-loop verification, compromised or misaligned agents could execute unauthorized business transactions or exfiltrate highly sensitive corporate data.
OWASP AIVSS score rationale
| Autonomy of Action | 0.70 | |
| Goal-Driven Planning | 0.50 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.80 | |
| Persistent Memory | 0.20 | |
| Contextual Awareness | 0.50 | |
| Dynamic Identity | 0.60 | |
| Multi-Agent Interactions | 0.40 | |
| Non-Determinism | 0.40 | |
| Opacity & Reflexivity | 0.30 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — The MCP server itself is model-agnostic, but the upstream LLM driving it is vulnerable to prompt injection, which could be leveraged to bypass intent alignment and trigger unauthorized ERP actions.
Not certain from the listing — The server queries Odoo ERP databases directly. Threats include unauthorized data exfiltration of sensitive sales, customer, and accounting data, as well as potential ORM/injection vulnerabilities if inputs are not sanitized.
Connects agents to Odoo via the Model Context Protocol (MCP). The primary threat is tool misuse, where an LLM misinterprets instructions or is manipulated into executing destructive ERP actions like deleting inventory records or modifying sales orders.
Not certain from the listing — Typically deployed locally or in a container alongside the agent. Threats include insecure storage of Odoo API credentials/passwords and lack of network isolation between the MCP host and the ERP instance.
Not certain from the listing — No built-in evaluation, guardrails, or transaction monitoring are mentioned. Gaps in logging could allow malicious or erroneous ERP transactions to execute without an audit trail.
The agent's security boundary relies entirely on the Odoo user/role it authenticates as. Over-privileged service accounts represent a severe compliance and security risk, as the agent inherits all read/write permissions of that user.
Designed to expose ERP capabilities to an agent ecosystem. A compromised or rogue upstream agent could abuse the trust relationship with this MCP server to execute cascading, unauthorized business-process actions across multiple Odoo modules.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).