Skip to main content
CodeCobra’s agent can talk to your real Odoo databases through the MCP (Model Context Protocol) bridge. Adding an environment lets the agent read records, run searches, and — if you opt in — write changes in your live Odoo instance instead of only the disposable onboard pod. This guide walks you through every step. No prior MCP knowledge needed.
You can add an Odoo environment in two places:
  • During project creation, in the Odoo step of the setup wizard.
  • Anytime later, in Project → Settings → Odoo Environments.
Both flows use the same form and validation. The wizard is identical to the settings page — pick whichever is easier.

​
Before you start

You’ll need three things:
  1. The base URL of your Odoo instance — the same address you’d type into a browser, e.g. https://acme.odoo.com or https://erp.example.com.
  2. An Odoo user that the agent will log in as. We strongly recommend creating a dedicated user instead of reusing your admin account — see Create a dedicated user below.
  3. An API key for that user (or, on legacy Odoo, the user’s password).
CodeCobra encrypts your API key at rest, but the agent can only do what the linked Odoo user is allowed to do. Tier (Read / Write / Delete) controls what kinds of actions the agent can attempt — it does not restrict which records the agent can see. Scoping by record / model / module is configured on the Odoo side via groups and record rules.

​
Create a dedicated Odoo user

Skip this if you already have a user you want the agent to act as.
1

Open Odoo's user list

In your Odoo instance, go to Settings → Users & Companies → Users and click New.
2

Fill in the basics

  • Name: CodeCobra Agent (or whatever you want to see in audit logs)
  • Email / login: a unique address, e.g. codecobra@yourcompany.com
  • User type: Internal User
3

Grant the right access rights

Under the Access Rights tab, give the user only the modules and record-rule groups the agent should be able to touch. If you only want read access, do not grant any manager roles.For a first try, copy the access rights from a normal employee account — that’s usually enough for the agent to explore data without being able to break anything sensitive.
4

Save

Click Save. You’ll come back to this user in a moment to create the API key.

​
Generate an API key

Odoo 14+ supports per-user API keys, which are safer than passwords.
1

Open the user's preferences

Click the user’s avatar in the top-right corner of Odoo (while logged in as that user) and choose My Profile (or Preferences).
2

Open the Account Security tab

Find the Account Security tab. You’ll see a section labelled Developer API Keys.
3

Create a new key

Click New API Key. Give it a name like CodeCobra and a sensible expiration (e.g. 1 year).Odoo will ask you to re-enter the password to confirm.
4

Copy the key — it's only shown once

Copy the generated key immediately. You won’t be able to view it again — if you lose it, you’ll have to delete the key and create a new one.Paste it into a temporary note; you’ll need it in the next section.
No API key? The user’s password works too — paste either one into the same field. On very old Odoo (≤13) without API keys, the password is your only option; we still recommend a dedicated low-privilege user.

​
Find the database name

Most users only have one database, in which case CodeCobra will detect it automatically. Some self-hosted setups host multiple databases on a single Odoo instance — here’s how to be sure:
  • Odoo Online (*.odoo.com): the database name is the subdomain. acme.odoo.com → acme.
  • Self-hosted: open /web/database/manager on your Odoo instance (e.g. https://erp.example.com/web/database/manager). Each row is a database; the column on the left is the name.
  • Already logged in? In Odoo, open Settings → Technical → Database Structure → Database (or look at the Sentry / Grafana setup your team uses).
If the form shows a Database field asking you to type a name, your Odoo doesn’t share its database list and CodeCobra couldn’t work it out (list_db = False in odoo.conf is a common production setting). It’s not a bug — type the name in by hand.

​
Add the environment in CodeCobra

1

Open the form

  • From the project setup wizard: on the Odoo step, click Add Odoo environment.
  • From an existing project: open Settings → Odoo Environments, then click New Odoo environment — or Add existing connection to reuse one you already set up under Settings → Connections.
2

Fill in the connection fields

  • Access — see Access tiers below. Default to Read only if you’re not sure.
  • Odoo URL — paste the URL exactly as you’d open it in a browser. CodeCobra will auto-add https:// if you forget the scheme. A green checkmark next to the field confirms the URL responds to Odoo’s XML-RPC endpoint.
  • Odoo login — the email / login of the Odoo user you created above.
  • Password or API key — paste the key you copied in the previous section, or the user’s password. Either works.
  • Database — you usually won’t see this field at all: CodeCobra detects the database the same way your browser does, checking as soon as you’ve filled in the fields above. It only appears when the server hosts several databases (pick from the list) or when detection fails (type the name in).
3

Save

Click Save. CodeCobra first checks the connection — it reaches the /xmlrpc/2/common endpoint, signs in with your login + key, and detects the database if you left it blank — and only then stores the environment. If the check fails you get a plain-language explanation (and a Save anyway escape hatch); see Troubleshooting.The credential is encrypted with the project’s Fernet key and stored in the database. The plaintext key never leaves your browser after this point.

​
Access tiers

Each environment has a tier that decides which MCP tools the agent can call against it.
Write and Delete let the agent change real records. As an extra guard, every change to one of your environments also requires an explicit in-chat approval from you before it runs — the agent describes exactly what it’s about to change and asks first, once per conversation turn. Restrictions inside Odoo (record rules, user groups) still apply — the tier only widens the kinds of operations the agent will attempt.

​
How environments are named

There is no name field. An environment is shown by its host — acme.odoo.com — and only when two environments on the same list share a host does the database (and, if needed, the login) get appended, in smaller type: acme.odoo.com · acme-staging. The agent refers to environments by the same label.

​
Who can use a connection

An environment is a connection that belongs to whoever added it. Your connections are listed under your account Settings → Connections, and you can put the same one on several projects.
  • Private by default. Only you can use a connection you added, even on a shared workspace project. Teammates don’t see it at all; workspace owners and admins see it in the project’s list, marked as yours, so they can remove it or lower its access.
  • Sharing. A workspace owner or admin can mark one of their own connections as Shared on a project so everyone with access to that project can use it. Nobody can share someone else’s connection.
  • Ceilings. The access tier you set on the connection itself is the most any project can ever grant. On each project, the owner can set a lower tier; workspace owners and admins can lower it further but never raise it. In a chat you can only go down from there.
  • Roles. Each person’s workspace or project role sets the most their messages may do in connected environments. When someone with the Restricted role sends a message, for example, every connected environment is read-only for that turn, whatever its tier. The next message from someone else in the same chat gets their own access.
  • It follows you. If you leave the workspace, are removed as a collaborator on the project, or your account is deactivated, every connection you shared stops working immediately and disappears from the project’s list. Teammates who need the environment add their own connection.
  • Removing. The connection owner or a workspace owner/admin can remove a connection from a project; that only detaches it — the credential stays under the owner’s Settings → Connections until they delete it there.

​
Use an environment in a chat

Once an environment is saved, every chat in that project can point the agent at it:
  1. Click the + button just below the message box.
  2. Under Odoo environments, tick the environments the agent should have access to in this conversation. You can pick more than one.
  3. The Onboard pod option always stays available — it’s the disposable Odoo that ships with every chat.
  4. Type your message. The agent will see the selected environments and can call MCP tools against them.
You can change the selection at any time mid-chat. The agent only sees the environments that are ticked when it runs the next turn.

​
Troubleshooting

The XML-RPC endpoint never responded. Common causes:
  • Wrong URL — make sure you can open the same URL in a browser and see the Odoo login page.
  • VPN / firewall — the CodeCobra backend must be able to reach your Odoo instance from the public internet. Self-hosted instances behind a corporate VPN won’t work without a tunnel.
Self-signed or expired certificates are fine — CodeCobra connects to your server regardless of its certificate (the URL still has to be https://).
The server replied but Odoo refused the login. Check:
  • Did you copy the API key without trailing whitespace?
  • Is the login field the user’s email/login (not the display name)?
  • Did you pick the right database?
  • Is the user Active in Odoo (not archived)?
Your Odoo instance has list_db = False in odoo.conf (a common production setting). It’s not a bug — type the database name in by hand. See Find the database name above.
Tier (Read / Write / Delete) only controls the kinds of operations the agent will attempt. Visibility of specific records is controlled by the linked Odoo user’s groups and record rules. Open Odoo as that user and confirm you can see what you expect to see — if you can’t see it as that user, the agent won’t either.
These come straight from Odoo. Read the message carefully — most are self-explanatory (e.g. “Access Denied”, “Database does not exist”). If you can’t make sense of it, copy the full text and contact support.

​
Edit, test, or delete an environment

In Project → Settings → Odoo Environments:
  • The Test button on each row re-runs authentication against the live server. Useful when an API key has been rotated.
  • Edit (owner only) lets you change everything. Leave the Password or API key field blank to keep the existing secret — only fill it in to rotate. Every save re-checks the connection and warns you if it stopped working.
  • Remove (owner, or a workspace owner/admin) takes the environment off this project. Any chat that had it selected will lose access on the next message. To delete the credential itself, go to Settings → Connections.

​
Security notes

  • Secrets are encrypted with Fernet using a per-deployment key (ODOO_ENCRYPTION_KEY). Plaintext keys never appear in logs or API responses — every response shows has_secret: true instead of the key itself.
  • A connection is only usable by its owner until a workspace owner/admin who owns it shares it on a specific project. Members of other projects cannot see or use it.
  • Restricting the agent’s footprint inside Odoo is your responsibility via Odoo groups, record rules, and a dedicated user. Tier is a coarse on/off for write actions, not a security boundary.

​
Next steps

Create a task

Use your new Odoo environment in a real chat.

Explore Odoo

Watch the agent introspect your live data.