Skip to content

Security

Credentials

  • Odoo credentials are read from the environment (ODOO_URL, ODOO_DB, ODOO_LOGIN, ODOO_API_KEY/ODOO_PASSWORD) or, in multi-tenant HTTP mode, from per-request headers (X-Odoo-Url/Db/Login + Bearer).
  • Secrets are never persisted to disk by this project and are never written to logs. The tenant cache key is url|db|login — the secret is not part of it.
  • The Settings object redacts the credentials in repr()/str() so that an accidental log does not leak them (guaranteed by tests/test_security_redaction.py).
  • Prefer API keys (Odoo ≥ 14) over passwords. Use least-privilege Odoo users.

Dedicated user for the agent

Create an Odoo user specific to the agent (e.g. ai-bot@yourcompany.com) with only the permissions it needs. Generate the API key from that user and rotate it periodically. This limits the blast radius if the key leaks.

Data model: nothing goes to Anthropic

The MCP server runs on your infrastructure and talks directly to your Odoo instance. Your company's data does not pass through Transgenia's nor Anthropic's servers. The plugin is only the code you run.

Automatic checks (CI)

The .github/workflows/security.yml workflow runs on every push/PR:

  • gitleaks — scans history and diffs for committed secrets.
  • leak-guard — looks for forbidden internal/tenant markers (client data, infrastructure hosts, tax identifiers, hardcoded credentials) and fails the build if they appear. The repository is vendor-neutral: it contains only the generic tooling plus the public brand/authorship and the services offering.
  • .gitignore excludes .env, *.env, virtual environments and build output so that local credentials are not committed by accident.

Transport

  • Use Odoo URLs with HTTPS. Both XML-RPC and JSON-RPC run over the URL you provide.
  • The server logs only to stderr; stdout is reserved for the MCP channel.

Reporting a vulnerability

Write to dev@transgenia.org with details and reproduction steps. Please do not open public issues for security reports. We aim to acknowledge receipt within 5 business days.