# Odoo External API vs Puzzle API and MCP (slim)

> Odoo External scores 55.8 (C) to Puzzle's 46.2 (D) for accounting ledgers. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/odoo-vs-puzzle.md (~4,850 tokens) · this version ~2,930 tokens · JSON https://www.anchorterminal.com/compare/odoo-vs-puzzle.json · canonical https://www.anchorterminal.com/compare/odoo-vs-puzzle
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Odoo External API scores 55.8 (C) on agent readiness against Puzzle API and MCP's 46.2 (D), and leads in 5 of 7 scored categories. Puzzle API and MCP leads on schema & documentation and security & auth. Both do accounting ledgers.

- Odoo External API: C 55.8, rank #857 of 1510 · https://www.anchorterminal.com/tools/odoo.min.md
- Puzzle API and MCP: D 46.2, rank #1180 of 1510 · https://www.anchorterminal.com/tools/puzzle.min.md
- Odoo External API, good for An agent working inside a company that already runs Odoo, where invoices, bills, journal entries, stock and sales sit in one database behind one endpoint pattern. Ahead on Reliability, 44 against 15; Agent ergonomics, 67 against 56; Payments & pricing, 22 against 15; Maintenance & community, 73 against 53; Transparency & trust, 91 against 49. Also Open source.
- Puzzle API and MCP, good for Startups already on Puzzle who want an assistant to answer finance questions and draft bookkeeping. xero, quickbooks-online and pennylane are the nearest listings; teams wanting a self-serve API should look there. Ahead on Schema & documentation, 65 against 51; Security & auth, 73 against 61. Also A hosted endpoint, with nothing to install.

| Category | Odoo External API | Puzzle API and MCP |
| --- | --- | --- |
| Reliability (16%) | 44 | 15 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 51 | 65 |
| Agent ergonomics (13%) | 67 | 56 |
| Security & auth (14%) | 61 | 73 |
| Payments & pricing (10%) | 22 | 15 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 73 | 53 |
| Transparency & trust (7%) | 91 | 49 |

| Fact (where they differ) | Odoo External API | Puzzle API and MCP |
| --- | --- | --- |
| Kind | HTTP API | MCP server |
| Vendor | Odoo SA | Puzzle Financial Inc. |
| Hosted endpoint | no (local only) | `https://app.puzzle.io/mcp` |
| Transports | HTTP | Streamable HTTP |
| Auth | API key | OAuth |
| Licence | Community edition LGPL-3.0. The Enterprise edition (the full Accounting app and the AI app with the MCP server) is proprietary under the Odoo Enterprise Subscription Agreement | none |
| llms.txt | no | yes |
| MCP registry | not listed | `io.puzzle/puzzle` |
| Last release | 2026-11-04 | 2026-10-05 |
| Terms last updated | no date given | 2023-06-01 |
| Privacy policy last updated | 2026-09-24 | 2025-12-19 |
| Terms restrict automated access | not found in the text | yes |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 55k stars | none |

Why the edge:
- Transparency & trust, Odoo External API +42: Odoo External API 91 (The Community edition, including the JSON-2 controller, is LGPLv3. The full Accounting app and the MCP server are proprietary Enterprise code under a published agreement (24). Privacy policy effective 24 September 2026 with retention periods (logs 12 months, a cancelled database destroyed after 3 weeks, backups at least 3 months) and data protection terms inside the subscription agreement. No stand-alone DPA was read (27). XML-RPC and JSON-RPC removal is dated to Odoo 22 in autumn 2028 and Online 21.1 in winter 2027, unchanged in the 20.0 docs on 4 November, and a support table gives each version's end date. These are dated notices with no stated notice period, which this run scores 15, keeping 20 for a written deprecation policy with notice periods (15, was 18). Subprocessors (OVH, Google Cloud, Amazon and others) and production and backup locations for five hosting regions are listed (18). 24+27+15+18 = 84.); Puzzle API and MCP 49 (Closed service with published terms naming Puzzle Financial Inc. (15). A privacy policy effective 19 December 2025; the security page says data stays on US servers and isn't shared or sold (15). The API docs promise documented endpoints stay stable but give no deprecation policy (5). Sub-processors not found, though the server location is stated (8). 15 + 15 + 5 + 8 = 43.)
- Reliability, Odoo External API +29: Odoo External API 44 (Graded as the hosted service, Odoo Online, on the hosted lines. On 4 November status.odoo.com served only a placeholder ("dumb placeholder for a nicer status page") embedding the OdooStatus timeline on X, with no components and no history. A status page without components takes 10 in this run (10, unchanged in value; on 8 October it listed component states with no history page). With no monitors or components there is no record to read for the 90 days from 6 August (5). The acceptable use policy, re-read on 4 November, still gives about 1 call a second with no parallel calls as typically acceptable, a guide and not an enforced figure, and audit logs are limited to one request every 5 minutes (10). No 429 or Retry-After handling and no idempotency keys were found. The docs do say each call is one transaction that rolls back on error (4). The cloud SLA page sets a 99.9 per cent monthly uptime target and says its objectives are not legally binding, per the 8 October check, not re-read on 4 November (the page answered 403) (5). JSON-2 has been generally available since Odoo 19.0 (10). 10+5+10+4+5+10 = 44.); Puzzle API and MCP 15 (Hosted reading. status.puzzle.io exists but answered 403 to our reader, so no status page or history could be read (0, then 5 for no readable history). No rate limits found in the API docs (0). The errors page documents 409 RESOURCE_PROCESSING with retry later and 500 with retry, but no 429 or idempotency guidance (5). No SLA (0). MCP read access is live, write access is a beta, and the API docs say the API is under development (5). 0 + 5 + 0 + 5 + 0 + 5 = 15.)
- Maintenance & community, Odoo External API +20: Odoo External API 73 (Nightly 20.0 build dated 4 November 2026 on nightly.odoo.com, and Odoo 20.0 released September 2026 (30). The 20.0 release plus daily nightly builds in the last 90 days (20). Commits on the 20.0 branch to 3 November 2026 in a blob-less clone. GitHub shows about 3,800 open issues per the 8 October check, and reply times couldn't be read (12). No official SDK. The MCP server is built in, and we did not find it in the MCP registry (3). Public CI on runbot.odoo.com across community, enterprise, upgrade and security checks, pass rate not read (8). 30+20+12+3+8 = 73.); Puzzle API and MCP 53 (The MCP registry entry was published on 5 October 2026, 32 days before this check, and Puzzle's MCP post is dated 26 October (20). No release log, so changes in the 90 days can't be counted beyond the registry entry and the MCP launch (5). A help centre and support contact, but no public changelog or issue tracker (8). io.puzzle/puzzle sits under a domain-verified namespace in the official registry (15). No SDK or package to judge (5). 20 + 5 + 8 + 15 + 5 = 53.)
- Schema & documentation, Puzzle API and MCP +14: Odoo External API 51 (No OpenAPI file. Each database serves a JSON description of its models, fields and method signatures at `/doc-bearer/index.json` and `/doc-bearer/<model>.json`, which needs a key, and the docs section on it reads "Under construction" (12). No llms.txt on www.odoo.com or under the documentation (0). The JSON-2 page explains bot users, transactions and when one method should replace two calls, and the ORM reference documents each generic method. The MCP tools have one-line descriptions (12). Method signatures are typed in the ORM reference, but arguments travel as a free JSON body and search domains are nested lists with no schema (6). Examples in Python, JavaScript and Bash, and one documented error object with 401, 403, 404 and 422 named (10). Docs are versioned by release (19.0, 20.0) with release notes and a dated removal plan for XML-RPC, but there is no API changelog of its own (11).); Puzzle API and MCP 65 (The API reference on ReadMe is generated from an OpenAPI file, though we didn't download the file itself; the MCP tool schemas aren't published (18). llms.txt and Markdown pages on puzzle-api.readme.io (10). Endpoint descriptions name the required scope and explain defaults such as cash basis (14). Typed parameters with documented limits, such as companies capped at 100 a page (11). An error table with HTTP codes and errorContext shapes, and example requests (12). No changelog or version scheme found (0). 18 + 10 + 14 + 11 + 12 + 0 = 65.)
- Security & auth, Puzzle API and MCP +12: Odoo External API 61 (Per-user API keys in a header, shown once, revocable, with a mandatory expiry of at most three months, `rpc` and MCP scopes and rotation by API. Scopes are coarse, and what a key can touch follows the user's access rights (25). The docs recommend a dedicated bot user with minimum rights, and the MCP server hides write tools until an administrator exposes them. The API itself has no confirmation step (14). Records hold text written by customers and suppliers, and no prompt-injection guidance was found (3). Odoo Online admin activity logs through `get_audit_logs`, and records keep the creating and writing user. No per-call log for the operator was found (8). Signed security.txt and a responsible disclosure policy, re-read on 4 November, that says the first answer generally comes within 48 hours and that advisories go out privately to customers before public disclosure on GitHub, a hall of fame with no cash bounty, and CSA STAR Level 1. No SOC 2 or ISO 27001 report for Odoo itself was found. NVD lists no CVE against Odoo's own code published in the 12 months to 4 November. The GitHub list of Security-labelled issues the policy links couldn't be read (11, kept as partly met).); Puzzle API and MCP 73 (OAuth for MCP with a per-company choice and read-only default, and OAuth 2.0 with granular scopes on the API, defaulting to read-only scopes (28). Read-only by default, writes an opt-in beta with confirmation for each change (18). Bank descriptions and vendor names are third-party text, and no prompt-injection guidance was found (3). Every API request is logged per the docs, and a firm activity endpoint returns an audit log (12). A SOC 2 claim in the API docs and a bug bounty policy page; no security.txt (12). 28 + 18 + 3 + 12 + 12 = 73.)
- Agent ergonomics, Odoo External API +11: Odoo External API 67 (`fields` on `read` and `search_read` and `limit` size a response, and the MCP server exposes five tools by default out of about 30 (22). Search domains, `offset`, `limit`, `order` and grouped aggregates. The default limit is every matching record (18). Errors are JSON with the Python exception name, message and arguments and a matching HTTP status, with a traceback in place of stable error codes (12). No idempotency keys. A call commits or rolls back as a whole, calls cannot share a transaction, and MCP tools carry a "Readonly Tool" flag (8). Few required parameters and plain HTTP examples in three languages, with no official SDK (7).); Puzzle API and MCP 56 (MCP tool count and sizes unpublished, so context cost can't be read (10 of 25). API list endpoints page with count and after or limit, and filter by date and status (16). Error codes and errorContext name the field or resource at fault (17). No idempotency keys found; the MCP server asks for confirmation before writes (8). No official SDKs; few required parameters on reads (5). 10 + 16 + 17 + 8 + 5 = 56.)