odoo-safe-mcp 2.0.0__tar.gz

odoo_safe_mcp-2.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Odoo Safe MCP Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

odoo_safe_mcp-2.0.0/PKG-INFO

@@ -0,0 +1,132 @@
+Metadata-Version: 2.4
+Name: odoo-safe-mcp
+Version: 2.0.0
+Summary: Deterministic AI Firewall and Model Context Protocol (MCP) Server for Odoo ERP with Human-in-the-Loop approvals.
+Home-page: https://odoosafemcp.stream
+Author: Odoo Safe MCP
+Author-email: Odoo Safe MCP <soporte@odoosafemcp.stream>
+License: MIT
+Project-URL: Homepage, https://odoosafemcp.stream
+Project-URL: Documentation, https://odoosafemcp.stream/#how
+Project-URL: Repository, https://github.com/makelele29/odoo-safe-mcp
+Project-URL: Bug Tracker, https://github.com/makelele29/odoo-safe-mcp/issues
+Project-URL: Get Pro API Key, https://odoosafemcp.stream/#pricing
+Keywords: odoo,erp,mcp,model-context-protocol,ai-agents,claude,cursor,security,human-in-the-loop
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Office/Business :: Financial :: Accounting
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: mcp>=1.2.0
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: pydantic>=2.6.0
+Requires-Dist: python-dotenv>=1.0.0
+Dynamic: author
+Dynamic: home-page
+Dynamic: license-file
+Dynamic: requires-python
+
+# 🛡️ Odoo Safe MCP — The AI Firewall for Odoo ERP
+
+Connect AI Agents (Claude Desktop, Cursor, n8n, LangChain) to **Odoo ERP (v14 to v19+)** without risking accounting disasters, accidental record deletions (`unlink`), or unauthorized invoice validations (`action_post`).
+
+[![PyPI version](https://img.shields.io/badge/pypi-v2.0.0-blue.svg)](https://pypi.org/project/odoo-safe-mcp/)
+[![Odoo Compatibility](https://img.shields.io/badge/Odoo-14.0%20to%2019.0-875A7B.svg)](https://www.odoo.com)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](https://opensource.org/licenses/MIT)
+
+---
+
+## ⚠️ Why you should NEVER connect a raw MCP server to Odoo
+
+Odoo's native permissions were designed for humans, not LLMs. If you give an AI agent an API key for a standard sales or accounting user so it can read data or draft quotes, **that same key can execute `unlink` (delete records) or `action_post` (legally post invoices to tax authorities)**.
+
+One LLM hallucination can corrupt your `account.move` ledger or wipe out `res.partner` records. **Odoo Safe MCP** acts as a deterministic firewall between your AI agent and Odoo's JSON-RPC/XML-RPC API.
+
+---
+
+## 🚦 How the Security Traffic Light Works
+
+| Risk Level | Odoo Methods | Action Taken | Tier |
+| :--- | :--- | :--- | :--- |
+| **🟢 GREEN (Safe Read)** | `search`, `read`, `search_read`, `fields_get`, `read_group`, `name_search`, `name_get`, `search_count`, `default_get` | Instant execution via local JSON-RPC. | **Free (Open Source)** |
+| **🟡 YELLOW (Guarded Drafts)** | `create` on `crm.lead`, `sale.order`, `purchase.order` | Enforces `state='draft'` and injects an AI audit note into the Odoo Chatter (`message_post`). | **Pro Guard** |
+| **🔴 RED (Critical / Destructive)** | `unlink` (any model), `action_post`, `action_confirm`, `button_validate`, `write` on `account.move` | **Pauses execution.** Sends an interactive **Approve / Reject** button to Slack or MS Teams. | **Pro Guard** |
+| **⛔ BLACKLIST (Zero-Day Protection)** | Mutations on `res.users`, `res.groups`, `ir.rule`, `ir.model.access` | **Blocked unconditionally** (even with Pro). Prevents privilege escalation. | **Hard Block** |
+
+---
+
+## 🚀 Quickstart (2 Minutes)
+
+### 1. Install via `pip` or run directly with `uvx`
+
+```bash
+pip install "odoo-safe-mcp==2.0.0"
+```
+
+### 2. Add to your Claude Desktop or Cursor configuration
+
+Edit your `claude_desktop_config.json` (or `.cursor/mcp.json`):
+
+```json
+{
+  "mcpServers": {
+    "odoo-erp": {
+      "command": "uvx",
+      "args": ["odoo-safe-mcp@2.0.0"],
+      "env": {
+        "ODOO_URL": "https://your-company.odoo.com",
+        "ODOO_DB": "your-database-name",
+        "ODOO_USERNAME": "ai-bot@your-company.com",
+        "ODOO_API_KEY": "your_odoo_user_api_key",
+        "ODOO_DRY_RUN": "false",
+        "ODOO_SAFE_GUARD_KEY": "optional_pro_license_key_for_write_access"
+      }
+    }
+  }
+}
+```
+
+> ⚠️ **Production Best Practice (Version Pinning):** Always pin the exact version in `uvx` (`odoo-safe-mcp@2.0.0`). Running unpinned `uvx odoo-safe-mcp` downloads upstream changes on every launch, which could lead to breaking changes or unexpected behavior in automated production pipelines.
+>
+> **Note:** Without `ODOO_SAFE_GUARD_KEY`, the server runs in **Strict Read-Only Mode (🟢 Green Level)**. Set `"ODOO_DRY_RUN": "true"` to test and simulate `YELLOW` and `RED` policies locally with zero risk to your database.
+
+---
+
+## 🔓 Unlock Guarded Write Access, AI Defender & Slack Approvals (Pro & Partner Tiers)
+
+Need your agents to create draft quotes, prepare vendor bills, audit payloads with **Llama 3 8B AI Defender**, or request atomic human approval on Slack before posting invoices?
+
+| Plan | Price | Databases | Key Features |
+| :--- | :--- | :--- | :--- |
+| **Community** | **€0 / forever** | 1 Local DB | Strict Read-Only Mode (🟢 Green), Zero-Risk Dry-Run Simulation (`ODOO_DRY_RUN=true`), Credential Sanitization |
+| **Pro Guard** | **€49 / month** | Up to 5 DBs | Guarded Drafts (🟡 Yellow), Slack Interactive Approvals (🔴 Red), D1 Audit Log, **Llama 3 8B AI Defender Included** |
+| **Partner Agency** | **€149 / month** | Up to 25 DBs | Multi-tenant Agency Isolation, Custom Slack Signing Secret, MS Teams Alerts, Llama 3 AI Defender |
+
+1. Get your **License Key** at **[odoosafemcp.stream/#pricing](https://odoosafemcp.stream/#pricing)**.
+2. Connect your Slack webhook in 1 click via the Cloudflare D1 Activation Portal.
+3. Add `ODOO_SAFE_GUARD_KEY` to your environment variables.
+
+---
+
+## 📄 License & Terms of Service
+
+Distributed under the **MIT License** — Free forever for read-only local execution and Dry-Run simulation.
+
+### Limitation of Liability, GDPR Privacy & Trademark Disclaimer
+> **IMPORTANT NOTICE:** `odoo-safe-mcp` and its associated Enterprise Guard backend are provided on an **"AS IS" and "AS AVAILABLE"** basis without warranties of any kind, either express or implied, including but not limited to implied warranties of merchantability, fitness for a particular purpose, and non-infringement.
+>
+> 1. **Auxiliary Control Layer & Human-in-the-Loop Responsibility:** This software operates strictly as an auxiliary deterministic filter and does not replace native database security, accounting audits, or operational vigilance. The human supervisor who clicks **"Approve"** in Slack or Microsoft Teams is the sole legal and accounting authorizer of the resulting ERP mutation.
+> 2. **Customer Responsibilities:** The user and customer retain sole and exclusive responsibility for configuring least-privilege permissions on the Odoo user account linked to `ODOO_API_KEY`, monitoring AI agent behavior, and maintaining independent, verified daily database backups.
+> 3. **Liability Cap:** To the maximum extent permitted by applicable law, the cumulative aggregate liability of the authors, contributors, and operators for any direct, indirect, incidental, special, or consequential damages (including data loss, accounting discrepancy, lost revenue, or business interruption) shall be strictly capped at the total fee actually paid by the customer for the software during the **one (1) month immediately preceding the event** giving rise to liability (maximum €49 for Pro Guard, €149 for Partner Agency, or €0 for Community Tier).
+> 4. **GDPR / RGPD Zero-Data-Retention Architecture:** Read-only (`GREEN`) queries execute locally on the user's machine and never transit through the Enterprise Guard cloud. Paused (`RED`) payloads are encrypted in transit and at rest using `AES-GCM-256` and are **purged immediately (`PURGED_AFTER_RESOLUTION`)** upon approval, rejection, or 24-hour TTL expiration. Audit logs store only cryptographic `SHA-256` payload hashes and technical metadata.
+> 5. **Trademark & Non-Affiliation Disclaimer:** This project is an independent software product and is **not affiliated with, sponsored by, or endorsed by Odoo S.A.** `Odoo` is a registered trademark of Odoo S.A. `Slack` is a registered trademark of Slack Technologies, LLC. `Microsoft Teams` is a registered trademark of Microsoft Corporation.
+

odoo_safe_mcp-2.0.0/README.md

@@ -0,0 +1,95 @@
+# 🛡️ Odoo Safe MCP — The AI Firewall for Odoo ERP
+
+Connect AI Agents (Claude Desktop, Cursor, n8n, LangChain) to **Odoo ERP (v14 to v19+)** without risking accounting disasters, accidental record deletions (`unlink`), or unauthorized invoice validations (`action_post`).
+
+[![PyPI version](https://img.shields.io/badge/pypi-v2.0.0-blue.svg)](https://pypi.org/project/odoo-safe-mcp/)
+[![Odoo Compatibility](https://img.shields.io/badge/Odoo-14.0%20to%2019.0-875A7B.svg)](https://www.odoo.com)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](https://opensource.org/licenses/MIT)
+
+---
+
+## ⚠️ Why you should NEVER connect a raw MCP server to Odoo
+
+Odoo's native permissions were designed for humans, not LLMs. If you give an AI agent an API key for a standard sales or accounting user so it can read data or draft quotes, **that same key can execute `unlink` (delete records) or `action_post` (legally post invoices to tax authorities)**.
+
+One LLM hallucination can corrupt your `account.move` ledger or wipe out `res.partner` records. **Odoo Safe MCP** acts as a deterministic firewall between your AI agent and Odoo's JSON-RPC/XML-RPC API.
+
+---
+
+## 🚦 How the Security Traffic Light Works
+
+| Risk Level | Odoo Methods | Action Taken | Tier |
+| :--- | :--- | :--- | :--- |
+| **🟢 GREEN (Safe Read)** | `search`, `read`, `search_read`, `fields_get`, `read_group`, `name_search`, `name_get`, `search_count`, `default_get` | Instant execution via local JSON-RPC. | **Free (Open Source)** |
+| **🟡 YELLOW (Guarded Drafts)** | `create` on `crm.lead`, `sale.order`, `purchase.order` | Enforces `state='draft'` and injects an AI audit note into the Odoo Chatter (`message_post`). | **Pro Guard** |
+| **🔴 RED (Critical / Destructive)** | `unlink` (any model), `action_post`, `action_confirm`, `button_validate`, `write` on `account.move` | **Pauses execution.** Sends an interactive **Approve / Reject** button to Slack or MS Teams. | **Pro Guard** |
+| **⛔ BLACKLIST (Zero-Day Protection)** | Mutations on `res.users`, `res.groups`, `ir.rule`, `ir.model.access` | **Blocked unconditionally** (even with Pro). Prevents privilege escalation. | **Hard Block** |
+
+---
+
+## 🚀 Quickstart (2 Minutes)
+
+### 1. Install via `pip` or run directly with `uvx`
+
+```bash
+pip install "odoo-safe-mcp==2.0.0"
+```
+
+### 2. Add to your Claude Desktop or Cursor configuration
+
+Edit your `claude_desktop_config.json` (or `.cursor/mcp.json`):
+
+```json
+{
+  "mcpServers": {
+    "odoo-erp": {
+      "command": "uvx",
+      "args": ["odoo-safe-mcp@2.0.0"],
+      "env": {
+        "ODOO_URL": "https://your-company.odoo.com",
+        "ODOO_DB": "your-database-name",
+        "ODOO_USERNAME": "ai-bot@your-company.com",
+        "ODOO_API_KEY": "your_odoo_user_api_key",
+        "ODOO_DRY_RUN": "false",
+        "ODOO_SAFE_GUARD_KEY": "optional_pro_license_key_for_write_access"
+      }
+    }
+  }
+}
+```
+
+> ⚠️ **Production Best Practice (Version Pinning):** Always pin the exact version in `uvx` (`odoo-safe-mcp@2.0.0`). Running unpinned `uvx odoo-safe-mcp` downloads upstream changes on every launch, which could lead to breaking changes or unexpected behavior in automated production pipelines.
+>
+> **Note:** Without `ODOO_SAFE_GUARD_KEY`, the server runs in **Strict Read-Only Mode (🟢 Green Level)**. Set `"ODOO_DRY_RUN": "true"` to test and simulate `YELLOW` and `RED` policies locally with zero risk to your database.
+
+---
+
+## 🔓 Unlock Guarded Write Access, AI Defender & Slack Approvals (Pro & Partner Tiers)
+
+Need your agents to create draft quotes, prepare vendor bills, audit payloads with **Llama 3 8B AI Defender**, or request atomic human approval on Slack before posting invoices?
+
+| Plan | Price | Databases | Key Features |
+| :--- | :--- | :--- | :--- |
+| **Community** | **€0 / forever** | 1 Local DB | Strict Read-Only Mode (🟢 Green), Zero-Risk Dry-Run Simulation (`ODOO_DRY_RUN=true`), Credential Sanitization |
+| **Pro Guard** | **€49 / month** | Up to 5 DBs | Guarded Drafts (🟡 Yellow), Slack Interactive Approvals (🔴 Red), D1 Audit Log, **Llama 3 8B AI Defender Included** |
+| **Partner Agency** | **€149 / month** | Up to 25 DBs | Multi-tenant Agency Isolation, Custom Slack Signing Secret, MS Teams Alerts, Llama 3 AI Defender |
+
+1. Get your **License Key** at **[odoosafemcp.stream/#pricing](https://odoosafemcp.stream/#pricing)**.
+2. Connect your Slack webhook in 1 click via the Cloudflare D1 Activation Portal.
+3. Add `ODOO_SAFE_GUARD_KEY` to your environment variables.
+
+---
+
+## 📄 License & Terms of Service
+
+Distributed under the **MIT License** — Free forever for read-only local execution and Dry-Run simulation.
+
+### Limitation of Liability, GDPR Privacy & Trademark Disclaimer
+> **IMPORTANT NOTICE:** `odoo-safe-mcp` and its associated Enterprise Guard backend are provided on an **"AS IS" and "AS AVAILABLE"** basis without warranties of any kind, either express or implied, including but not limited to implied warranties of merchantability, fitness for a particular purpose, and non-infringement.
+>
+> 1. **Auxiliary Control Layer & Human-in-the-Loop Responsibility:** This software operates strictly as an auxiliary deterministic filter and does not replace native database security, accounting audits, or operational vigilance. The human supervisor who clicks **"Approve"** in Slack or Microsoft Teams is the sole legal and accounting authorizer of the resulting ERP mutation.
+> 2. **Customer Responsibilities:** The user and customer retain sole and exclusive responsibility for configuring least-privilege permissions on the Odoo user account linked to `ODOO_API_KEY`, monitoring AI agent behavior, and maintaining independent, verified daily database backups.
+> 3. **Liability Cap:** To the maximum extent permitted by applicable law, the cumulative aggregate liability of the authors, contributors, and operators for any direct, indirect, incidental, special, or consequential damages (including data loss, accounting discrepancy, lost revenue, or business interruption) shall be strictly capped at the total fee actually paid by the customer for the software during the **one (1) month immediately preceding the event** giving rise to liability (maximum €49 for Pro Guard, €149 for Partner Agency, or €0 for Community Tier).
+> 4. **GDPR / RGPD Zero-Data-Retention Architecture:** Read-only (`GREEN`) queries execute locally on the user's machine and never transit through the Enterprise Guard cloud. Paused (`RED`) payloads are encrypted in transit and at rest using `AES-GCM-256` and are **purged immediately (`PURGED_AFTER_RESOLUTION`)** upon approval, rejection, or 24-hour TTL expiration. Audit logs store only cryptographic `SHA-256` payload hashes and technical metadata.
+> 5. **Trademark & Non-Affiliation Disclaimer:** This project is an independent software product and is **not affiliated with, sponsored by, or endorsed by Odoo S.A.** `Odoo` is a registered trademark of Odoo S.A. `Slack` is a registered trademark of Slack Technologies, LLC. `Microsoft Teams` is a registered trademark of Microsoft Corporation.
+

odoo_safe_mcp-2.0.0/odoo_safe_mcp/__init__.py

@@ -0,0 +1,7 @@
+"""
+Odoo Safe MCP — The AI Firewall for Odoo ERP
+Connect AI agents to Odoo ERP with human-in-the-loop safety and deterministic safeguards.
+"""
+
+__version__ = "2.0.0"
+__all__ = ["__version__"]

odoo_safe_mcp-2.0.0/odoo_safe_mcp/rules.py

@@ -0,0 +1,343 @@
+"""
+Rules Engine & Traffic Light System for Odoo Safe MCP.
+
+Classifies Odoo RPC calls into:
+  - GREEN: Safe Read (Free Open Source, instant local JSON-RPC execution)
+  - YELLOW: Guarded Drafts (Forces state='draft' and Chatter audit note)
+  - RED: Critical / Destructive / Unknown / Wizards (Requires human Slack approval)
+  - FORBIDDEN / BLOCKED: Permanent lockdown for sensitive models (res.users, ir.config_parameter, etc.)
+"""
+
+from __future__ import annotations
+
+import copy
+from dataclasses import dataclass, field
+from enum import Enum
+from typing import Any, Dict, List, Optional, Tuple
+
+
+class RiskLevel(str, Enum):
+    GREEN = "GREEN"          # Safe read
+    YELLOW = "YELLOW"        # Guarded draft creation
+    RED = "RED"              # Critical / destructive / state change / wizards / unknown
+    BLOCKED = "BLOCKED"      # Privilege escalation / security violation (alias)
+    FORBIDDEN = "FORBIDDEN"  # Forbidden operation (res.users, security models)
+
+
+# Methods safe for read-only consumption on non-sensitive business models
+GREEN_METHODS = {
+    "search",
+    "read",
+    "search_read",
+    "fields_get",
+    "read_group",
+    "name_search",
+    "name_get",
+    "search_count",
+    "default_get",
+    "check_access_rights",
+    "fields_view_get",
+    "get_views",
+    "load_views",
+}
+
+# Models where ANY access (even READ) is strictly forbidden to prevent credential/secret exfiltration
+READ_AND_WRITE_FORBIDDEN_MODELS = {
+    "res.users",
+    "res.apikeys",
+    "ir.config_parameter",
+    "ir.mail_server",
+    "fetchmail.server",
+    "payment.provider",
+    "payment.acquirer",
+    "payment.token",
+}
+
+# Critical system models where mutations (create/write/unlink/custom) are strictly forbidden
+PROTECTED_SYSTEM_MODELS = READ_AND_WRITE_FORBIDDEN_MODELS | {
+    "res.groups",
+    "ir.model.access",
+    "ir.rule",
+    "ir.module.module",
+    "ir.actions.server",
+    "ir.cron",
+    "base.automation",
+    "ir.model",
+    "ir.model.fields",
+    "ir.ui.view",
+}
+
+# Backward compatibility alias
+BLACKLIST_MODELS = PROTECTED_SYSTEM_MODELS
+
+# Sensitive field names that must never be read via fields list
+FORBIDDEN_SENSITIVE_FIELDS = {
+    "password",
+    "password_crypt",
+    "api_key",
+    "totp_secret",
+    "oauth_access_token",
+    "smtp_pass",
+    "stripe_secret_key",
+}
+
+# Strict Whitelist: Only these models can be created under YELLOW (Guarded Drafts)
+YELLOW_CREATE_MODELS = {
+    "sale.order",
+    "purchase.order",
+    "crm.lead",
+}
+
+# Critical methods that always trigger RED level alerts
+CRITICAL_RED_METHODS = {
+    "unlink",
+    "action_post",
+    "action_confirm",
+    "button_validate",
+    "action_invoice_open",
+    "action_invoice_paid",
+    "action_cancel",
+    "button_immediate_transfer",
+    "button_approve",
+    "copy",
+    "web_save",
+    "name_create",
+}
+
+UPGRADE_URL = "https://odoosafemcp.stream/#pricing"
+
+
+@dataclass
+class RuleEvaluationResult:
+    level: RiskLevel
+    allowed: bool
+    requires_guard_proxy: bool
+    reason: str
+    sanitized_args: List[Any] = field(default_factory=list)
+    sanitized_kwargs: Dict[str, Any] = field(default_factory=dict)
+    audit_note: Optional[str] = None
+    inject_chatter_note: bool = False
+
+    def to_dict(self) -> Dict[str, Any]:
+        return {
+            "level": self.level.value,
+            "allowed": self.allowed,
+            "requires_guard_proxy": self.requires_guard_proxy,
+            "reason": self.reason,
+            "sanitized_args": self.sanitized_args,
+            "sanitized_kwargs": self.sanitized_kwargs,
+            "audit_note": self.audit_note,
+            "inject_chatter_note": self.inject_chatter_note,
+        }
+
+
+def _enforce_draft_on_dict(item: Dict[str, Any], model: str) -> None:
+    if model in {"sale.order", "purchase.order"}:
+        item["state"] = "draft"
+
+
+def _sanitize_yellow_payload(
+    model: str, method: str, args: List[Any], kwargs: Dict[str, Any]
+) -> Tuple[List[Any], Dict[str, Any], str]:
+    """
+    Enforces state='draft' for sales and purchase orders across positional args,
+    keyword vals/vals_list, and context default_state to prevent bypasses.
+    """
+    new_args = copy.deepcopy(args)
+    new_kwargs = copy.deepcopy(kwargs)
+    audit_note = f"[Odoo Safe MCP] Created via AI Agent ({model}.{method}) under Guarded Drafts policy."
+
+    if method == "create":
+        # 1. Sanitize positional args[0]
+        if new_args:
+            first_arg = new_args[0]
+            if isinstance(first_arg, dict):
+                _enforce_draft_on_dict(first_arg, model)
+                new_args[0] = first_arg
+            elif isinstance(first_arg, list):
+                for item in first_arg:
+                    if isinstance(item, dict):
+                        _enforce_draft_on_dict(item, model)
+                new_args[0] = first_arg
+
+        # 2. Sanitize kwargs['vals'] or kwargs['vals_list'] (prevents kwargs bypass)
+        if isinstance(new_kwargs.get("vals"), dict):
+            _enforce_draft_on_dict(new_kwargs["vals"], model)
+        elif isinstance(new_kwargs.get("vals"), list):
+            for item in new_kwargs["vals"]:
+                if isinstance(item, dict):
+                    _enforce_draft_on_dict(item, model)
+
+        if isinstance(new_kwargs.get("vals_list"), list):
+            for item in new_kwargs["vals_list"]:
+                if isinstance(item, dict):
+                    _enforce_draft_on_dict(item, model)
+
+        # 3. Sanitize kwargs['context']['default_state']
+        if isinstance(new_kwargs.get("context"), dict) and model in {"sale.order", "purchase.order"}:
+            if "default_state" in new_kwargs["context"]:
+                new_kwargs["context"]["default_state"] = "draft"
+
+    return new_args, new_kwargs, audit_note
+
+
+def _sanitize_green_read_kwargs(kwargs: Dict[str, Any]) -> Dict[str, Any]:
+    """Strip any forbidden credential fields from 'fields' parameter in read/search_read."""
+    new_kwargs = copy.deepcopy(kwargs)
+    fields_param = new_kwargs.get("fields")
+    if isinstance(fields_param, list):
+        new_kwargs["fields"] = [
+            f for f in fields_param
+            if isinstance(f, str) and f.strip().lower() not in FORBIDDEN_SENSITIVE_FIELDS
+        ]
+    return new_kwargs
+
+
+def evaluate_odoo_call(
+    model: str,
+    method: str,
+    args: Optional[List[Any]] = None,
+    kwargs: Optional[Dict[str, Any]] = None,
+) -> RuleEvaluationResult:
+    """
+    Evaluates whether an Odoo execute_kw call is permitted, its intrinsic risk tier,
+    and applies automated safety sanitization.
+
+    Returns a RuleEvaluationResult with level: GREEN, YELLOW, RED, or FORBIDDEN.
+    """
+    args = list(args) if args is not None else []
+    kwargs = dict(kwargs) if kwargs is not None else {}
+    norm_model = (model or "").strip().lower()
+    norm_method = (method or "").strip().lower()
+
+    # 0. Block empty or private/dunder method calls (e.g. '_check_credentials', '__import__')
+    if not norm_model or not norm_method or norm_method.startswith("_"):
+        return RuleEvaluationResult(
+            level=RiskLevel.FORBIDDEN,
+            allowed=False,
+            requires_guard_proxy=False,
+            reason=(
+                f"⛔ SECURITY ALERT: Calling private or invalid method '{method}' on '{model}' "
+                "is permanently FORBIDDEN."
+            ),
+            sanitized_args=args,
+            sanitized_kwargs=kwargs,
+            inject_chatter_note=False,
+        )
+
+    # 1. FORBIDDEN: Block reading OR writing secret/credential models (res.users, ir.config_parameter, etc.)
+    if norm_model in READ_AND_WRITE_FORBIDDEN_MODELS:
+        return RuleEvaluationResult(
+            level=RiskLevel.FORBIDDEN,
+            allowed=False,
+            requires_guard_proxy=False,
+            reason=(
+                f"⛔ SECURITY ALERT: Direct access to sensitive model '{norm_model}' is permanently FORBIDDEN "
+                "by Odoo Safe MCP to prevent credential/token exfiltration or privilege escalation."
+            ),
+            sanitized_args=args,
+            sanitized_kwargs=kwargs,
+            inject_chatter_note=False,
+        )
+
+    # 2. FORBIDDEN: Prevent mutation of access control, groups, modules, views, automations and crons
+    if norm_model in PROTECTED_SYSTEM_MODELS:
+        if norm_method not in GREEN_METHODS:
+            return RuleEvaluationResult(
+                level=RiskLevel.FORBIDDEN,
+                allowed=False,
+                requires_guard_proxy=False,
+                reason=(
+                    f"⛔ SECURITY ALERT: Direct mutations on sensitive system model '{model}' "
+                    f"(method: '{method}') are permanently FORBIDDEN by Odoo Safe MCP to prevent "
+                    "privilege escalation, even with a Pro license."
+                ),
+                sanitized_args=args,
+                sanitized_kwargs=kwargs,
+                inject_chatter_note=False,
+            )
+
+    # 3. YELLOW TIER: Strict Whitelist - Only guarded draft creation on sales, purchases, leads
+    if (norm_model in YELLOW_CREATE_MODELS) and (norm_method == "create"):
+        san_args, san_kwargs, note = _sanitize_yellow_payload(
+            norm_model, norm_method, args, kwargs
+        )
+        return RuleEvaluationResult(
+            level=RiskLevel.YELLOW,
+            allowed=True,
+            requires_guard_proxy=True,
+            reason="Guarded Draft Creation: enforced state='draft' and AI audit note.",
+            sanitized_args=san_args,
+            sanitized_kwargs=san_kwargs,
+            audit_note=note,
+            inject_chatter_note=True,
+        )
+
+    # 4. GREEN TIER: Safe Read Operations on standard business models
+    if norm_method in GREEN_METHODS:
+        san_kwargs = _sanitize_green_read_kwargs(kwargs)
+        return RuleEvaluationResult(
+            level=RiskLevel.GREEN,
+            allowed=True,
+            requires_guard_proxy=False,
+            reason="Safe read-only operation. Executed instantly via local JSON-RPC.",
+            sanitized_args=args,
+            sanitized_kwargs=san_kwargs,
+            inject_chatter_note=False,
+        )
+
+    # 5. RED TIER: All other mutations, accounting, deletions, wizards, or unknown methods (Fail-safe to RED)
+    is_critical = norm_method in CRITICAL_RED_METHODS or norm_model.startswith("account.")
+    reason = (
+        f"Critical operation ('{norm_model}.{norm_method}'): Human-in-the-Loop approval required via Slack."
+        if is_critical
+        else f"Unguarded mutation or wizard ('{norm_model}.{norm_method}'): Routed through Pro Guard Proxy."
+    )
+    return RuleEvaluationResult(
+        level=RiskLevel.RED,
+        allowed=True,
+        requires_guard_proxy=True,
+        reason=reason,
+        sanitized_args=args,
+        sanitized_kwargs=kwargs,
+        inject_chatter_note=True,
+    )
+
+
+def evaluate_rule(
+    model: str,
+    method: str,
+    args: Optional[List[Any]] = None,
+    kwargs: Optional[Dict[str, Any]] = None,
+    has_pro_license: bool = False,
+) -> RuleEvaluationResult:
+    """
+    Evaluates whether an Odoo execute_kw call is permitted in the MCP server context,
+    taking into account the client's Pro License status.
+    """
+    decision = evaluate_odoo_call(model=model, method=method, args=args, kwargs=kwargs)
+
+    if decision.level in (RiskLevel.FORBIDDEN, RiskLevel.BLOCKED):
+        return decision
+
+    if decision.level == RiskLevel.GREEN:
+        return decision
+
+    # If mutation is YELLOW or RED but user has no Pro license -> Strict Read-Only Mode
+    if not has_pro_license:
+        return RuleEvaluationResult(
+            level=decision.level,
+            allowed=False,
+            requires_guard_proxy=False,
+            reason=(
+                f"🔒 Odoo Safe MCP (Free Tier) operates in Strict Read-Only Mode. "
+                f"Method '{method}' on model '{model}' is classified as {decision.level.value}.\n"
+                f"To enable guarded write access and Human-in-the-Loop Slack approvals, "
+                f"get a Pro API Key at {UPGRADE_URL} and configure ODOO_SAFE_GUARD_KEY."
+            ),
+            sanitized_args=decision.sanitized_args,
+            sanitized_kwargs=decision.sanitized_kwargs,
+            inject_chatter_note=False,
+        )
+
+    return decision