Understanding the mechanics is not required to use Aidoo, but it is what tells you where to place your guardrails and how to diagnose unexpected behaviour.

The journey of a question

Take a mundane request: "Which quotations are above €10,000 this month?"

The assistant picks a tool

Claude reads your question and finds it cannot answer from memory. It looks at the Aidoo tools available in the conversation and selects aidoo_query with arguments it builds itself: the sale.order model, a filter on amount and date, the fields to return.

That is the only moment where the AI "decides" anything. Everything that follows is deterministic.

You approve the call

The MCP client (Claude.ai, ChatGPT, your IDE) shows you the call and waits for your consent. You see the tool name and its arguments before anything leaves.

This check belongs to the client, not to Aidoo. In Claude, Settings → Connectors groups the Aidoo tools into read-only and write or delete, and each group can be set to Always allow in one move. You can also decide tool by tool.

Connector settings in Claude: the Aidoo tools grouped into read-only and write or delete, each group settable to Always allow. — In Claude, each group of tools is set in one move, or tool by tool.

Keep Always allow for reads

On read tools, automating the prompt saves time at no risk: they cannot change anything. On the write and delete group, it removes the last point where a human sees the values before they reach Odoo.

The MCP server forwards to the Aidoo API

The MCP server (mcp.aidoo.ai) holds no business logic and does not know your Odoo credentials. It validates the shape of the arguments, then relays the call to the Aidoo API with your session token.

The API applies your rules

This is where everything happens. Before any contact with Odoo, the API checks, in this order:

The subscription is active and the quota is not exceeded
The permission matching the tool is granted to your key
The tool → Odoo method binding is respected: aidoo_query may only call search_read and search_count, never unlink
The model and fields involved are not on your blocklists

A single failed check stops the call. Nothing reaches Odoo.

Odoo runs it, under your key's identity

The API calls your Odoo over XML-RPC, with your own Odoo token, not the workspace connection's. Odoo then applies its own access rights: if your Odoo account has no access to sales orders, the call fails, whatever the Aidoo permissions say.

Aidoo logs and returns

Every call produces an entry in the request log: tool, model, user, timestamp, duration, success or error. The result then goes back to the assistant, which formats it for you.

Three layers of security that stack

The principle: security never rests on the prompt

An assistant can be manipulated by an instruction hidden in data it reads. That is why no Aidoo rule is enforced by the AI: every check runs server-side, on every call, regardless of what the AI believes it is allowed to do.

Layer	Who enforces it	What it controls
Approval	The MCP client	Every tool call, before it is sent
Aidoo permissions	The Aidoo API	Which tools, which models, which fields
Odoo rights	Your Odoo	What the account in use may see and change

An Aidoo permission never widens Odoo rights: it can only narrow them further.

Why the AI does not connect to Odoo directly

Technically, an assistant could talk to Odoo over XML-RPC. That would be a bad idea for three reasons:

Credentials. You would have to hand them to the assistant, and therefore expose them in the conversation context.
Control. Odoo has no notion of "per-tool permission". XML-RPC access grants everything the account can do, including deleting.
Traceability. No central log, no quota, no limit. No way to answer "who changed what, when, from which conversation".

Going through Aidoo keeps your credentials encrypted server-side, filters and logs every call, and lets you revoke access without touching Odoo.

What the assistant knows about your database

At the start of a conversation, the assistant calls aidoo_context. It receives:

your Odoo identity (uid, partner, login, language, timezone)
the active environment: production or staging
the list of tools genuinely available, based on your key's permissions

That last point matters: the assistant knows up front that it cannot create records, rather than discovering it by failing. It will tell you plainly instead of attempting the operation.

Sessions and billing

A session corresponds to one conversation with the connector. Neither the Standard plan nor the free trial sets a request limit.

Agent runs do not count against this quota: they are billed separately, in credits.

What is never sent to the AI

your Odoo credentials, in any form
the binary content of files you upload, see Attachments
data from other workspaces, even if you administer several

What the AI sees are the results of the calls it requested and you approved. Nothing else.

Going further

MCP tool reference: the full inventory
Security & permissions: configuring the guardrails