Connect your ERP to an AI agent via MCP: Odoo, Sage, Dynamics

For years, connecting an artificial intelligence tool to an ERP meant writing custom integrations, maintaining private APIs and accepting that any software update would break the connector. In 2024 Anthropic published the Model Context Protocol (MCP), an open standard that changes that equation: instead of point-to-point integrations, the AI agent connects to the ERP through an MCP server that exposes typed tools, and the agent decides when and how to use them based on the conversation context. In 2025 Microsoft, Google, OpenAI and the main ERP vendors began publishing their own MCP servers or announcing their roadmaps. In 2026, connecting Odoo, Sage or Dynamics to an AI agent via MCP is no longer a laboratory experiment: it is a feasible project for an SME with normal technical resources.

This article explains what the MCP protocol is, why it simplifies ERP integration with AI, how it is deployed on the three most common systems in Spanish SMEs and which use cases deliver real returns from the first quarter.

What MCP is and why it matters for ERP and AI integration

The Model Context Protocol is an open-source client-server protocol that standardises how a large language model (LLM) accesses external tools, files and structured data. Before MCP, each AI provider defined its own «tool calling» schema; the developer had to adapt the connector to each model. With MCP, the server declares its tools in a standard JSON format, and any compatible client (Claude, GPT-4o, Gemini, open-source models with MCP support) can use them without changes.

Applied to an ERP, the MCP server acts as a typed access layer: it exposes operations such as get_order, list_pending_invoices, update_delivery_status or create_customer_quote. The AI agent calls those operations securely, with the permissions defined by the system administrator. The ERP does not «know» there is an AI on the other side; it simply receives requests to its REST or RPC API just like any other integration.

Key differences compared with a traditional integration

How the MCP server works for ERP: basic architecture

The architecture has three components: the MCP client (the AI agent or the application hosting it), the MCP server (a process that translates agent requests into ERP calls) and the ERP itself with its native API.

The MCP server can run on the same network as the ERP (on-premise or private cloud) or be exposed as a cloud microservice with OAuth 2.0 authentication. Communication between the MCP client and server uses JSON-RPC over HTTP/SSE (Server-Sent Events for streaming) or over stdio when the process runs locally. In production, the typical setup is an HTTPS endpoint with a Bearer token per tenant.

Flow of a typical query

1. The user types: «How much do we owe supplier García Logistics at month end?»
2. The agent identifies that it needs data from the ERP accounts payable module.
3. It calls the get_supplier_balance tool on the MCP server with the parameter name="García Logistics".
4. The MCP server translates this into an ERP API call (for example, GET /api/account.move?partner=García+Logistics&state=posted in Odoo).
5. The MCP server returns the structured result to the agent.
6. The agent composes the response in natural language, adds the breakdown by due date and, if permitted, offers to initiate the payment.

The end-to-end response time — including the LLM call — is typically between 3 and 8 seconds for simple queries and between 10 and 20 seconds for queries that chain several tools. If your use case requires an immediate response (for example, in a voice channel), the architecture is complemented with pre-calculated data caches.

Implementation with Odoo (versions 16 and 17)

Odoo is the most widely deployed open-source ERP in Spanish SMEs. Since version 16 it exposes a stable JSON-RPC API and an optional REST API that supports authentication via per-user API keys. In 2025 the community published several MCP servers for Odoo; in 2026 Odoo S.A. published its own official MCP server in version 17.1.

Steps to connect Odoo to an AI agent

1. Generate an API key for the agent's technical user (menu Settings → Users → API Key). Apply minimum permissions: only the models the agent needs to read or write.
2. Deploy the Odoo MCP server: install the odoo-mcp-server package (available on PyPI or as a community module) on a server accessible to the agent. Configure the Odoo URL, database and API key in environment variables.
3. Declare the required tools in the server configuration file: for example, enable sale.order, account.move, stock.picking and disable the rest to reduce the attack surface.
4. Connect the agent to the MCP server: in the MCP client configuration (Claude Desktop, a Teams bot, an n8n workflow with MCP node) add the server URL and Bearer token.
5. Test with read-only queries before enabling write tools.

With Odoo 17, the MCP integration is mature enough for production in the sales, purchasing, invoicing and warehouse modules. The manufacturing module (MRP) requires additional mapping because its data model is more complex.

Implementation with Sage (Sage 50, Sage 200 and Sage X3)

The Sage ecosystem has three tiers with different levels of API openness. Sage 50 offers integration via ODBC or via the cloud API (Sage Business Cloud API) with OAuth 2.0 authentication. Sage 200 has a REST API since version 2021 R2, more complete and suitable for the MCP server. Sage X3 has a SOAP API and a REST API (Web Services module) which is the recommended basis for MCP in enterprise deployments.

In practice, the most common pattern for Spanish SMEs using Sage 200 is to deploy the MCP server on the same Windows server where Sage runs (as a Windows service or as a Docker container on Windows Server 2022), and have the agent consume it from the corporate network. For secure remote access, it is tunnelled through a reverse HTTPS proxy with a TLS certificate.

A critical point with Sage: the Sage 200 REST API does not natively expose all fields. In some modules (analytical accounting, project management) the MCP server must call SQL Server stored procedures directly, with the maintenance risks that implies. It is advisable to define the scope before starting.

Implementation with Microsoft Dynamics 365 Business Central

Business Central is Microsoft's ERP most widely used in Spanish mid-sized SMEs with between 20 and 200 employees. It has a complete OData v4 API, documented on Microsoft Learn, with native OAuth 2.0 support via Microsoft Entra ID. In March 2025, Microsoft published the official ms-business-central-mcp repository on GitHub, with predefined tools for sales, finance, inventory and projects.

The advantage of Business Central for this architecture is that the MCP server can run as an Azure Function (no server to maintain) and inherits the identity of the Microsoft 365 tenant. If you already have Copilot for Microsoft 365 active, the MCP agent can coexist in the same Teams environment without an additional infrastructure licence.

Write access in Business Central requires specific profile permissions. Before enabling write tools (creating orders, approving invoices), it is essential to review the existing approval flows in Business Central so the agent does not inadvertently bypass them. The recommended configuration is for the agent to propose the action and for the user to confirm it in a second step, rather than executing directly.

If you want to go deeper into the integration of AI agents with your ERP, our team first analyses the API status of your specific version before committing to a scope.

Use cases with real returns in the SME

Not all AI agent + ERP use cases deliver the same returns. These are the ones that show the fastest results in real deployments during 2025 and 2026:

Order and invoice status queries in natural language

Customer service or sales teams can ask directly: «Which orders from Ferretería López have gone more than 5 days without being fulfilled?» and get the answer without entering the ERP. This reduces between 4 and 8 minutes per query in teams with high call frequency for follow-up.

Purchasing and replenishment assistant

The agent checks the configured minimum stock, the current stock and the supplier delivery lead time, and generates the draft purchase order. The purchasing manager reviews and approves. This flow is especially useful in companies with more than 500 active references where manual management of reorder points consumes hours every week.

Customer or project profitability analysis

Combining the ERP's invoicing and cost modules, the agent can answer: «What is the actual gross margin on project 2025-047 after allocating the hours from the last three months?» in seconds, without the controller having to extract data to Excel.

Automation of repetitive administrative tasks

Approving delivery notes matched against the original order, generating recurring invoices, updating customer price lists by segment: these are tasks where the agent can execute in bulk with occasional human supervision, rather than a fully manual process.

Security and access control: what cannot be missing

The MCP server introduces a new access point to the ERP. Before going to production, review at least these four points:

• Principle of least privilege: the agent's technical user in the ERP only has permission over the modules and fields it needs. Do not use the administrator account.
• Call auditing: the MCP server must log every tool invoked, who invoked it (user or agent session) and what parameters were passed. Many open-source MCP servers do not implement this by default; it must be added.
• MCP client authentication: the server must not be accessible without a token. In production, use short-lived tokens (maximum TTL of 24 hours) with automatic rotation.
• Review of write tools: before enabling any tool that modifies data in the ERP, design the human confirmation flow. An agent that deletes records or approves invoices without supervision can cause real operational damage.

In the context of the European AI Act, agents that make autonomous decisions about financial or customer data may be classified as limited-risk or high-risk AI systems depending on the use case. Although most of the cases described here would fall under limited or minimal risk, it is advisable to document the agent's capabilities and the controls implemented. From Summum Consultoría we accompany the risk assessment in accordance with the AI Act when the agent has autonomous decision-making capability.

Typical implementation timelines and effort

The ranges include MCP server deployment, tool configuration, integration testing and training for the team that will use the agent. They do not include developing the agent from scratch or ERP implementation. These timelines assume the ERP API is active and documented in the client's installation.

Frequently asked questions

Do I need a cloud ERP to use MCP, or does it also work with an on-premise installation?

MCP works with both modalities. In on-premise installations, the MCP server is deployed on the same network and the AI agent accesses it from within the perimeter or through a secure tunnel. The ERP does not need to be in the cloud, although cloud installations make it easier to expose the endpoint. What is necessary is that the ERP has an accessible API: REST, JSON-RPC or OData. If your version of Sage or Dynamics is old and lacks a modern API, that is the first step to address.

Can the AI agent modify data in the ERP or only read it?

It can do both, depending on the permissions you configure on the MCP server and in the ERP itself. In most first-phase deployments, only read tools are enabled to build confidence. Write tools (creating orders, updating records, approving invoices) are added in a second phase, always with a human confirmation step before the action is executed. Giving the agent write permission without a supervision mechanism is never recommended.

What happens to my customers' and suppliers' data that the agent sees in the ERP?

The MCP server acts as an intermediary: data is not stored on the MCP server beyond the time needed to respond to the request. However, it does pass through the language model the agent uses. If that model is an external cloud service (such as the Anthropic API or Azure OpenAI), customer data travels outside your perimeter. To prevent this there are two options: (1) deploy a proprietary LLM in your own infrastructure, or (2) use data anonymisation on the MCP server before sending data to the model. In sectors with sensitive data (health, finance, minors' data) this decision has direct implications under the GDPR.

Is MCP compatible with n8n or Power Automate to combine the agent with other workflows?

Yes. Since late 2024, n8n has an MCP client node that allows invoking tools from any MCP server within an automation workflow. Power Automate does not yet have a native MCP connector, but it can call the MCP server via the generic HTTP connector with Bearer authentication. In deployments where n8n already exists, connecting it to the ERP's MCP server is especially efficient because the agent can be combined with triggers (a new order in the ERP activates the workflow) without additional infrastructure. The n8n automation team at Summum IA can help you design this type of hybrid architecture.