Skills/PyPI/mcp-server-odoo

mcp-server-odoo@0.9.0

CAUTION· not started

Publisher claims: "A Model Context Protocol server for Odoo ERP systems" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher ivnvxd · publishing for 524 daysInstalls 6,461Last detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
ODOO_API_KEYODOO_PASSWORDConfiguration, not credentials: ODOO_DB, ODOO_LOCALE, ODOO_MCP_ALLOWED_HOSTS, ODOO_MCP_HOST, ODOO_MCP_LOG_FILE, ODOO_MCP_LOG_FORMAT, ODOO_MCP_LOG_JSON, ODOO_MCP_LOG_LEVEL, ODOO_MCP_LOG_REQUEST_BODY, ODOO_MCP_LOG_RESPONSE_BODY, ODOO_MCP_PORT, ODOO_MCP_SLOW_OPERATION_THRESHOLD_MS, ODOO_MCP_TRANSPORT, ODOO_RPC_TRANSPORT, ODOO_URL, ODOO_USER, ODOO_YOLO
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard. It asks for ODOO_API_KEY, ODOO_PASSWORD and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- uvx mcp-server-odoo

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-09 and scored it 72/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Hex-encoded string detected; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsmcp_server_odoo/__main__.py:83 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# os.environ below) would mask .env settings, because load_dotenv()Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hex-encoded string detectedmcp_server_odoo/user_context.py:144 · Hex-encoded string detected — may contain obfuscated payloads_LINE_BREAK_TRANSLATION = dict.fromkeys(map(ord, "\r\n\x0b\x0c\x1c\x1d\x1e\x85\u2028\u2029"), " ")Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathsmcp_server_odoo/__main__.py:81 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# actual values from the environment AND the .env file. EagerlyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server_odoo/logging_config.py:283 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesload_config() loads the .env file — snapshotting in __init__ wouldFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:46 · Collapsed <details> block carrying instructions<summary>macOS/Linux</summary> ```bash curl -LsSf https://astral.sh/uv/install.sh | sh ```Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsmcp_server_odoo/config.py:227 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslooks for .env in current directory.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server_odoo/config.py:214 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file: Optional path to .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server_odoo/logging_config.py:284 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessilently ignore any ODOO_MCP_LOG_* values set only in .env.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server_odoo/config.py:226 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file: Optional path to .env file. If not provided,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server_odoo/config.py:235 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Check if we have a .env file or environment variablesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server_odoo/__main__.py:141 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint("\nPlease check your environment variables or .env file", file=sys.stderr)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)pyproject.toml:34 · MCP server using network transport (SSE/HTTP) — data sent over network# 2.2 is the floor: MCPServer, run_streamable_http_async(session_idle_timeout=...)Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathsmcp_server_odoo/config.py:223 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Load configuration from environment variables and .env file.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_server_foundation.py:533 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Create a test .env file in tmp directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_config.py:169 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileswith tempfile.NamedTemporaryFile(mode="w", suffix=".env", delete=False) as f:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_main_cli.py:89 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/helpers/mcp_test_client.py:265 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint("Copy .env.example to .env and update with your values")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/conftest.py:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Load .env file for testsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Dense URL-encoded contenttests/test_uri_schema.py:87 · Dense URL-encoded content — may be obfuscating payloadsuri = "odoo://res.partner/search?domain=%5B%28%27is_company%27%2C%27%3D%27%2CTrue%29%5D"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Access to sensitive file pathstests/test_config.py:192 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Create a temporary .env file with different valuesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_write_tools.py:925 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Standard-mode config (no YOLO) — relies on .env / environment."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/mcp_client_validation.sh:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesENV_FILE="$PROJECT_ROOT/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_search_resources.py:72 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Load real configuration from .env file."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_auth_matrix.py:55 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesto actual env vars at test time, after .env is loaded by conftest.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/conftest.py:156 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filespytest.skip("Neither ODOO_API_KEY nor ODOO_PASSWORD set. Please configure .env file.")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_main_cli.py:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_server_foundation.py:522 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Integration tests with real .env configuration."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_package_structure.py:19 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_main_cli.py:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Tests for CLI argument / environment / .env precedence in __main__."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/mcp_client_validation.sh:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho "ERROR: No .env file found at $ENV_FILE!"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_advanced_resources.py:467 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Load real configuration from .env file."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_config.py:168 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Create a temporary .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/mcp_client_validation.sh:44 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho "Please create a .env file based on .env.example"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_main_cli.py:76 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/helpers/mcp_test_client.py:264 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint("\nPlease configure these in your .env file")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_integration_e2e.py:138 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Test API key authentication using .env configuration."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_main_cli.py:14 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Values set only in .env must take effect (argparse defaults used toFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_config.py:187 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Test that environment variables override .env file."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/helpers/transport_client.py:39 · Python subprocess execution detectedself.process = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_auth_matrix.py:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# This avoids import-order issues with .env loading.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_config.py:156 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Test loading configuration from .env file."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Dense URL-encoded contenttests/test_uri_schema.py:183 · Dense URL-encoded content — may be obfuscating payloads== "odoo://res.partner/search?domain=%5B%28%27is_company%27%2C%27%3D%27%2CTrue%29%5D"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Access to sensitive file pathstests/test_server_foundation.py:526 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Test server initialization with .env file in isolated environment."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/helpers/server_testing.py:78 · Python subprocess execution detectedself.server_process = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_server_foundation.py:534 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/conftest.py:153 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filespytest.skip("ODOO_URL environment variable not set. Please configure .env file.")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/helpers/mcp_test_client.py:153 · Python subprocess execution detectedprocess = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_integration_e2e.py:125 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_server_foundation.py:547 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Change to temp directory to isolate from project .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/mcp_client_validation.sh:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Look for .env file in the project rootFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/helpers/transport_client.py:141 · Python subprocess execution detectedself.server_process = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈51 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-server-odoo@0.9.0 as of 5d ago. This is the package itself, not its dependencies.

What would make this Verified

8 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim ivnvxd: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Hex-encoded string detected≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  5. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
  6. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim ivnvxdPropose a patch to the maintainer