What the oec.sh MCP server does
The oec.sh MCP server gives an MCP client access to an oec.sh organization, including its servers, projects, and environments. Read tools expose organization plan and usage information, server readiness and metrics, environment health, deployment history, runtime logs, task progress, backups, webhooks, support tickets, and release notes. Runtime logs can return up to 1,000 recent lines from an environment's Odoo or PostgreSQL log.
Write tools can deploy an environment, restart or start or stop it, update Odoo modules, create backups, and create or modify projects and environments. The supplied tool set also includes task polling and task-log retrieval, so an assistant can follow asynchronous operations after receiving a task ID. The server does not add permissions beyond the API key and organization plan used for each request.
How it works
The oec.sh MCP server forwards tool calls to the oec.sh Public API using the supplied API key. A read-only key exposes read tools, while a full-access key also enables write tools. Project-scoped keys restrict access to one project; organization-scoped keys can cover the organization and are required for some organization-level operations.
Local mode uses stdio and runs through Node.js 22 or newer. Hosted mode uses streamable HTTP at https://mcp.oec.sh/mcp; the client sends the key in an Authorization header for each request. Write operations that begin work return a task ID, which the assistant can pass to the wait and task-log tools. Deployments, restarts, stops, quick updates, and certain update operations are marked destructive so supporting clients can request approval.
Setup and configuration
An oec.sh organization on the Starter plan or higher and an API key from the dashboard are required. For local mode, set OECSH_API_KEY in the MCP client's environment and start npx -y @oecsh/mcp-server. Claude Code, Claude Desktop, and Cursor are documented local clients. Do not commit configuration files containing the key.
OECSH_ALLOW enables selected opt-in tools with comma-separated values such as destructive or backup-download; it is empty by default. Hosted clients can enable the same options with the X-OECSH-Allow header. OECSH_API_URL changes the local API address and defaults to the production public API URL; the documentation advises changing it only when requested by oec.sh support.
Tools and capabilities
- Inspect organization limits and usage, servers, projects, and environments.
- Read live server or container metrics, runtime logs, health, and deployment history.
- Track asynchronous tasks through status, waiting, progress, and step logs.
- Deploy branches, restart environments, update modules, and start or stop environments.
- Start manual backups and review backup information.
- Read changelog entries, webhooks, webhook deliveries, and eligible support tickets.
List operations support pagination with a limit from 1 to 100 and a cursor from the previous response.
Limitations and notes
Server metrics apply to servers owned by the organization, not shared servers. Support-ticket tools require an organization-scoped key with support tickets enabled. Opt-in tools are disabled unless explicitly enabled, and some require a confirmation value matching the resource name. Hosted mode cannot serve clients that only connect through OAuth, including claude.ai web connectors. API-key permissions, scope, plan, quotas, rate limits, and audit logging remain enforced by oec.sh.