BambooForge Labs

API Gateway compared with the alternatives

One key, three doors: a REST API with an OpenAPI file for Postman, n8n, Make and Zapier; signed webhooks that retry until delivered; and an MCP server for Claude and ChatGPT - each key limited to the models, fields and rows you list, with a review queue for writes and a log of every call.

Read the manualOpen the live demoBuy on the Odoo Apps Store

Checked on 2026-10-15. Prices are the Odoo Apps Store's prices in euros on that day (visitors outside the euro area see them converted); features are as each vendor's own public page describes them. If something here is out of date, write to support@bambooforge.dev and we will correct it.

At a glance

BambooForge API Gateway

OCA fastapi and ai_oca_mcp (free)

Odoo's built-in API and MCP server

RAG Solutions Claude Connector

Price

EUR 129, once per Odoo series

Free (LGPL-3 or AGPL-3)

Part of Odoo; on Odoo's subscriptions, the external API needs the Custom plan

EUR 180, once; "no subscription required"

Odoo series

16.0, 17.0, 18.0, 19.0, 20.0

fastapi and endpoint 16.0 to 19.0, ai_oca_mcp 16.0 only; nothing installable on 20.0 yet

JSON-2 on 19.0 and 20.0 (XML-RPC on every series); the MCP server on 20.0

15.0 to 20.0

Edition and hosting

Community or Enterprise; Odoo.sh or your own server

Odoo.sh or your own server

JSON-2 in Community, and in Enterprise on the Custom plan; the MCP server in Enterprise only

Not on Odoo Online

Sign-in

A bearer key, or OAuth2 client credentials with short-lived tokens; an expiry, and per-minute and per-day caps

API-key or JWT add-ons for fastapi; a key per client for MCP

An API key as a bearer token; for MCP, a key with the MCP scope and an expiry

OAuth 2.0 (recommended), an Odoo API key, or credentials

REST and OpenAPI

/api/v1 on every allowed model: list, read, aggregate, create, change, delete and listed actions; an OpenAPI 3.1 file per key and a built-in explorer

A framework: you write the API as an addon and FastAPI describes it in OpenAPI; endpoint runs a code snippet on a route you define; base_rest is deprecated from 16.0

JSON-2 at /json/2/<model>/<method>, with a /doc page and a playground; XML-RPC and JSON-RPC are deprecated, to be removed in Odoo 22 (fall 2028)

Not described

Webhooks

On create, change and delete, signed with a timestamp; retried after 1, 5 and 30 minutes, then 2, 6 and 24 hours; replay

ai_oca_bridge (16.0 to 18.0) posts to outside AI systems such as n8n

Automation rules, 17.0 and later: one unsigned post with a 1-second timeout ("send and forget"), a failure only logged; incoming webhooks as a trigger

Not described

MCP

/api/mcp: list, describe, search, read and aggregate tools; writes only as proposals a person applies under their own rights

ai_oca_mcp (16.0): tools you define in code (ai_tool ships two), a key per client, a server log

/mcp on 20.0 Enterprise: tools are server actions; "Get Fields", "Get Models", "Search", "Read group" and an initial-context tool by default, more by marking server actions "Available in MCP"

Inside Odoo, at /mcp/sse

What a caller can reach

Only the models, fields, rows and actions listed on its key, under a filter it cannot widen; writes at once or held for review, per model; delete off by default

What the API you write exposes

Everything its user may do, under the user's access rights, record rules and field access; Odoo recommends dedicated bot users

Each user's own key; "Write access follows each user's Odoo permissions"; access rules managed by AI; a tool control panel

Log

Every call by door: key, model, arguments, status, rows, duration, estimated token cost, IP; a Revoke button on each line; kept 180 days

An MCP server log; request and response logs with api_log (16.0 to 18.0)

Not described

Not described

Left out, as each page says

Binary fields and secrets (always stripped); string domains (JSON lists only); writes to ownership, company, security or archive fields

OAuth 2.0 for MCP clients such as Claude Desktop, "not supported directly"

The external API on the One App Free and Standard plans

Not listed

Also included

No outside service, account, telemetry or CDN: nothing leaves the server but your webhooks

Not described

Not described

Dashboards, website editing and SEO, "AI Developer Mode" (apps, fields and views by chat), records from scanned documents

Two more MCP apps sell on the store for 20.0. MuK's "MuK MCP OAuth" (EUR 85, with 30 days of support; one database per licence) adds an OAuth 2.1 sign-in, with consent on every authorisation and a read-only option, to the free MuK MCP Server. KSRO Labs' "Odoo MCP Server (PRO)" (EUR 280; 14.0 to 20.0) has 32 tools, among them deletes, batch and background jobs, CSV and XLSX exports, portal pages and a module builder, behind per-key, per-model permissions with field allowlists and domain filters, and an audit trail.

Choose which, and when

  • Choose OCA's modules if you have developers to write the API you need, want LGPL-3 or AGPL-3 code at no licence cost, and run 16.0 to 19.0 (16.0 for MCP). Nothing in these repositories installs on 20.0 today.

  • Choose Odoo's own API if you are on 19.0 or 20.0 (Community, or Enterprise on the Custom plan) and your integrations may act with their user's full rights; on 20.0 Enterprise it adds an MCP server inside Odoo, and from 17.0 its "send and forget" webhooks from automation rules may be all you need.

  • Choose RAG Solutions if you want an MCP connector built around Claude, with dashboards, website editing and apps built by chat, and no subscription.

  • Choose MuK if you run the free MuK MCP Server and want an OAuth 2.1 sign-in with consent on each authorisation and read-only grants.

  • Choose KSRO if you want its 32 MCP tools - deletes, bulk and background jobs, exports, portal pages, a module builder - behind per-key, per-model permissions and an audit trail.

  • Choose ours if you are on any of Odoo 16.0 to 20.0, Community or Enterprise, and want one key to serve REST with an OpenAPI 3.1 file, signed and retried webhooks and MCP, each limited to the models, fields, rows and actions you list, with agent writes held for a person, every call in a log and no outside service - and your callers need neither binary fields nor string domains, and your agents need not write without review.

Sources

Read on 2026-10-15.