Odoo External API vs Puzzle API and MCP

Odoo External API 91

The Community edition, including the JSON-2 controller, is LGPLv3. The full Accounting app and the MCP server are proprietary Enterprise code under a published agreement (24). Privacy policy effective 24 September 2026 with retention periods (logs 12 months, a cancelled database destroyed after 3 weeks, backups at least 3 months) and data protection terms inside the subscription agreement. No stand-alone DPA was read (27). XML-RPC and JSON-RPC removal is dated to Odoo 22 in autumn 2028 and Online 21.1 in winter 2027, unchanged in the 20.0 docs on 4 November, and a support table gives each version's end date. These are dated notices with no stated notice period, which this run scores 15, keeping 20 for a written deprecation policy with notice periods (15, was 18). Subprocessors (OVH, Google Cloud, Amazon and others) and production and backup locations for five hosting regions are listed (18). 24+27+15+18 = 84.

Puzzle API and MCP 49

Closed service with published terms naming Puzzle Financial Inc. (15). A privacy policy effective 19 December 2025; the security page says data stays on US servers and isn't shared or sold (15). The API docs promise documented endpoints stay stable but give no deprecation policy (5). Sub-processors not found, though the server location is stated (8). 15 + 15 + 5 + 8 = 43.

Odoo External API 44

Graded as the hosted service, Odoo Online, on the hosted lines. On 4 November status.odoo.com served only a placeholder ("dumb placeholder for a nicer status page") embedding the OdooStatus timeline on X, with no components and no history. A status page without components takes 10 in this run (10, unchanged in value; on 8 October it listed component states with no history page). With no monitors or components there is no record to read for the 90 days from 6 August (5). The acceptable use policy, re-read on 4 November, still gives about 1 call a second with no parallel calls as typically acceptable, a guide and not an enforced figure, and audit logs are limited to one request every 5 minutes (10). No 429 or Retry-After handling and no idempotency keys were found. The docs do say each call is one transaction that rolls back on error (4). The cloud SLA page sets a 99.9 per cent monthly uptime target and says its objectives are not legally binding, per the 8 October check, not re-read on 4 November (the page answered 403) (5). JSON-2 has been generally available since Odoo 19.0 (10). 10+5+10+4+5+10 = 44.

Puzzle API and MCP 15

Hosted reading. status.puzzle.io exists but answered 403 to our reader, so no status page or history could be read (0, then 5 for no readable history). No rate limits found in the API docs (0). The errors page documents 409 RESOURCE_PROCESSING with retry later and 500 with retry, but no 429 or idempotency guidance (5). No SLA (0). MCP read access is live, write access is a beta, and the API docs say the API is under development (5). 0 + 5 + 0 + 5 + 0 + 5 = 15.

Odoo External API 73

Nightly 20.0 build dated 4 November 2026 on nightly.odoo.com, and Odoo 20.0 released September 2026 (30). The 20.0 release plus daily nightly builds in the last 90 days (20). Commits on the 20.0 branch to 3 November 2026 in a blob-less clone. GitHub shows about 3,800 open issues per the 8 October check, and reply times couldn't be read (12). No official SDK. The MCP server is built in, and we did not find it in the MCP registry (3). Public CI on runbot.odoo.com across community, enterprise, upgrade and security checks, pass rate not read (8). 30+20+12+3+8 = 73.

Puzzle API and MCP 53

The MCP registry entry was published on 5 October 2026, 32 days before this check, and Puzzle's MCP post is dated 26 October (20). No release log, so changes in the 90 days can't be counted beyond the registry entry and the MCP launch (5). A help centre and support contact, but no public changelog or issue tracker (8). io.puzzle/puzzle sits under a domain-verified namespace in the official registry (15). No SDK or package to judge (5). 20 + 5 + 8 + 15 + 5 = 53.

Odoo External API 51

No OpenAPI file. Each database serves a JSON description of its models, fields and method signatures at /doc-bearer/index.json and /doc-bearer/<model>.json, which needs a key, and the docs section on it reads "Under construction" (12). No llms.txt on www.odoo.com or under the documentation (0). The JSON-2 page explains bot users, transactions and when one method should replace two calls, and the ORM reference documents each generic method. The MCP tools have one-line descriptions (12). Method signatures are typed in the ORM reference, but arguments travel as a free JSON body and search domains are nested lists with no schema (6). Examples in Python, JavaScript and Bash, and one documented error object with 401, 403, 404 and 422 named (10). Docs are versioned by release (19.0, 20.0) with release notes and a dated removal plan for XML-RPC, but there is no API changelog of its own (11).

Puzzle API and MCP 65

The API reference on ReadMe is generated from an OpenAPI file, though we didn't download the file itself; the MCP tool schemas aren't published (18). llms.txt and Markdown pages on puzzle-api.readme.io (10). Endpoint descriptions name the required scope and explain defaults such as cash basis (14). Typed parameters with documented limits, such as companies capped at 100 a page (11). An error table with HTTP codes and errorContext shapes, and example requests (12). No changelog or version scheme found (0). 18 + 10 + 14 + 11 + 12 + 0 = 65.

Odoo External API 61

Per-user API keys in a header, shown once, revocable, with a mandatory expiry of at most three months, rpc and MCP scopes and rotation by API. Scopes are coarse, and what a key can touch follows the user's access rights (25). The docs recommend a dedicated bot user with minimum rights, and the MCP server hides write tools until an administrator exposes them. The API itself has no confirmation step (14). Records hold text written by customers and suppliers, and no prompt-injection guidance was found (3). Odoo Online admin activity logs through get_audit_logs, and records keep the creating and writing user. No per-call log for the operator was found (8). Signed security.txt and a responsible disclosure policy, re-read on 4 November, that says the first answer generally comes within 48 hours and that advisories go out privately to customers before public disclosure on GitHub, a hall of fame with no cash bounty, and CSA STAR Level 1. No SOC 2 or ISO 27001 report for Odoo itself was found. NVD lists no CVE against Odoo's own code published in the 12 months to 4 November. The GitHub list of Security-labelled issues the policy links couldn't be read (11, kept as partly met).

Puzzle API and MCP 73

OAuth for MCP with a per-company choice and read-only default, and OAuth 2.0 with granular scopes on the API, defaulting to read-only scopes (28). Read-only by default, writes an opt-in beta with confirmation for each change (18). Bank descriptions and vendor names are third-party text, and no prompt-injection guidance was found (3). Every API request is logged per the docs, and a firm activity endpoint returns an audit log (12). A SOC 2 claim in the API docs and a bug bounty policy page; no security.txt (12). 28 + 18 + 3 + 12 + 12 = 73.

Odoo External API 67

fields on read and search_read and limit size a response, and the MCP server exposes five tools by default out of about 30 (22). Search domains, offset, limit, order and grouped aggregates. The default limit is every matching record (18). Errors are JSON with the Python exception name, message and arguments and a matching HTTP status, with a traceback in place of stable error codes (12). No idempotency keys. A call commits or rolls back as a whole, calls cannot share a transaction, and MCP tools carry a "Readonly Tool" flag (8). Few required parameters and plain HTTP examples in three languages, with no official SDK (7).

Puzzle API and MCP 56

MCP tool count and sizes unpublished, so context cost can't be read (10 of 25). API list endpoints page with count and after or limit, and filter by date and status (16). Error codes and errorContext name the field or resource at fault (17). No idempotency keys found; the MCP server asks for confirmation before writes (8). No official SDKs; few required parameters on reads (5). 10 + 16 + 17 + 8 + 5 = 56.