# API Gateway compared with the alternatives

*Checked on 2026-10-15. Prices are the Odoo Apps Store's prices in euros on
that day (visitors outside the euro area see them converted); features are
as each vendor's own public page describes them. If something here is out of
date, write to support@bambooforge.dev and we will correct it.*

## At a glance

|  | BambooForge API Gateway | OCA fastapi and ai_oca_mcp (free) | Odoo's built-in API and MCP server | RAG Solutions Claude Connector |
|---|---|---|---|---|
| Price | EUR 129, once per Odoo series | Free (LGPL-3 or AGPL-3) | Part of Odoo; on Odoo's subscriptions, the external API needs the Custom plan | EUR 180, once; "no subscription required" |
| Odoo series | 16.0, 17.0, 18.0, 19.0, 20.0 | `fastapi` and `endpoint` 16.0 to 19.0, `ai_oca_mcp` 16.0 only; nothing installable on 20.0 yet | JSON-2 on 19.0 and 20.0 (XML-RPC on every series); the MCP server on 20.0 | 15.0 to 20.0 |
| Edition and hosting | Community or Enterprise; Odoo.sh or your own server | Odoo.sh or your own server | JSON-2 in Community, and in Enterprise on the Custom plan; the MCP server in Enterprise only | Not on Odoo Online |
| Sign-in | A bearer key, or OAuth2 client credentials with short-lived tokens; an expiry, and per-minute and per-day caps | API-key or JWT add-ons for `fastapi`; a key per client for MCP | An API key as a bearer token; for MCP, a key with the MCP scope and an expiry | OAuth 2.0 (recommended), an Odoo API key, or credentials |
| REST and OpenAPI | `/api/v1` on every allowed model: list, read, aggregate, create, change, delete and listed actions; an OpenAPI 3.1 file per key and a built-in explorer | A framework: you write the API as an addon and FastAPI describes it in OpenAPI; `endpoint` runs a code snippet on a route you define; `base_rest` is deprecated from 16.0 | JSON-2 at `/json/2/<model>/<method>`, with a `/doc` page and a playground; XML-RPC and JSON-RPC are deprecated, to be removed in Odoo 22 (fall 2028) | Not described |
| Webhooks | On create, change and delete, signed with a timestamp; retried after 1, 5 and 30 minutes, then 2, 6 and 24 hours; replay | `ai_oca_bridge` (16.0 to 18.0) posts to outside AI systems such as n8n | Automation rules, 17.0 and later: one unsigned post with a 1-second timeout ("send and forget"), a failure only logged; incoming webhooks as a trigger | Not described |
| MCP | `/api/mcp`: list, describe, search, read and aggregate tools; writes only as proposals a person applies under their own rights | `ai_oca_mcp` (16.0): tools you define in code (`ai_tool` ships two), a key per client, a server log | `/mcp` on 20.0 Enterprise: tools are server actions; "Get Fields", "Get Models", "Search", "Read group" and an initial-context tool by default, more by marking server actions "Available in MCP" | Inside Odoo, at `/mcp/sse` |
| What a caller can reach | Only the models, fields, rows and actions listed on its key, under a filter it cannot widen; writes at once or held for review, per model; delete off by default | What the API you write exposes | Everything its user may do, under the user's access rights, record rules and field access; Odoo recommends dedicated bot users | Each user's own key; "Write access follows each user's Odoo permissions"; access rules managed by AI; a tool control panel |
| Log | Every call by door: key, model, arguments, status, rows, duration, estimated token cost, IP; a Revoke button on each line; kept 180 days | An MCP server log; request and response logs with `api_log` (16.0 to 18.0) | Not described | Not described |
| Left out, as each page says | Binary fields and secrets (always stripped); string domains (JSON lists only); writes to ownership, company, security or archive fields | OAuth 2.0 for MCP clients such as Claude Desktop, "not supported directly" | The external API on the One App Free and Standard plans | Not listed |
| Also included | No outside service, account, telemetry or CDN: nothing leaves the server but your webhooks | Not described | Not described | Dashboards, website editing and SEO, "AI Developer Mode" (apps, fields and views by chat), records from scanned documents |

Two more MCP apps sell on the store for 20.0. MuK's "MuK MCP OAuth" (EUR 85,
with 30 days of support; one database per licence) adds an OAuth 2.1 sign-in,
with consent on every authorisation and a read-only option, to the free MuK
MCP Server. KSRO Labs' "Odoo MCP Server (PRO)" (EUR 280; 14.0 to 20.0) has 32
tools, among them deletes, batch and background jobs, CSV and XLSX exports,
portal pages and a module builder, behind per-key, per-model permissions with
field allowlists and domain filters, and an audit trail.

## Choose which, and when

- **Choose OCA's modules** if you have developers to write the API you need,
  want LGPL-3 or AGPL-3 code at no licence cost, and run 16.0 to 19.0 (16.0
  for MCP). Nothing in these repositories installs on 20.0 today.
- **Choose Odoo's own API** if you are on 19.0 or 20.0 (Community, or
  Enterprise on the Custom plan) and your integrations may act with their
  user's full rights; on 20.0 Enterprise it adds an MCP server inside Odoo,
  and from 17.0 its "send and forget" webhooks from automation rules may be
  all you need.
- **Choose RAG Solutions** if you want an MCP connector built around Claude,
  with dashboards, website editing and apps built by chat, and no
  subscription.
- **Choose MuK** if you run the free MuK MCP Server and want an OAuth 2.1
  sign-in with consent on each authorisation and read-only grants.
- **Choose KSRO** if you want its 32 MCP tools - deletes, bulk and background
  jobs, exports, portal pages, a module builder - behind per-key, per-model
  permissions and an audit trail.
- **Choose ours** if you are on any of Odoo 16.0 to 20.0, Community or
  Enterprise, and want one key to serve REST with an OpenAPI 3.1 file, signed
  and retried webhooks and MCP, each limited to the models, fields, rows and
  actions you list, with agent writes held for a person, every call in a log
  and no outside service - and your callers need neither binary fields nor
  string domains, and your agents need not write without review.

## Sources

Read on 2026-10-15.

- Our manual: https://docs.bambooforge.dev/bambooforge_ai_bridge/
- OCA rest-framework: https://github.com/OCA/rest-framework (its 20.0 branch
  holds no installable module yet), with the READMEs of fastapi at
  https://github.com/OCA/rest-framework/blob/19.0/fastapi/README.rst and of
  base_rest at
  https://github.com/OCA/rest-framework/blob/18.0/base_rest/README.rst
- OCA web-api: https://github.com/OCA/web-api/blob/19.0/endpoint/README.rst
- OCA ai: https://github.com/OCA/ai, with the READMEs of ai_oca_mcp at
  https://github.com/OCA/ai/blob/16.0/ai_oca_mcp/README.rst and of
  ai_oca_bridge at https://github.com/OCA/ai/blob/18.0/ai_oca_bridge/README.rst
- Odoo's external API:
  https://www.odoo.com/documentation/20.0/developer/reference/external_api.html
- Odoo's MCP server:
  https://www.odoo.com/documentation/20.0/applications/productivity/ai/mcp_server.html
- Odoo's webhooks:
  https://www.odoo.com/documentation/20.0/applications/studio/automated_actions/webhooks.html
  and the code that sends them,
  https://github.com/odoo/odoo/blob/20.0/odoo/addons/base/models/ir_actions.py
- Odoo's plans: https://www.odoo.com/pricing-plan
- RAG Solutions: https://apps.odoo.com/apps/modules/20.0/rag_odoo_mcp_server
- MuK: https://apps.odoo.com/apps/modules/20.0/muk_mcp_oauth, and the free
  MuK MCP Server in the store's search,
  https://apps.odoo.com/apps/modules/browse?search=mcp&order=Purchases&series=20.0
- KSRO Labs: https://apps.odoo.com/apps/modules/20.0/mcp_server_odoo