MCP+ for Dolibarr

MCP+ connects AI assistants like Claude and ChatGPT directly to your Dolibarr — secure, fully auditable and without a single additional server process.

The server speaks the Model Context Protocol (MCP), the open standard AI clients use to access business data. Whether Claude Desktop, Claude Code, claude.ai in the browser or ChatGPT: the assistant sees your tickets, customers, quotations, orders, invoices, contracts, shipments, projects, appointments, members and stock levels — with exactly the permissions you grant, and not one more.

Native Dolibarr module instead of a middle layer

MCP+ runs as a regular Dolibarr module inside your existing installation. There is no external Python or Node server, no bridge, no cloud middle layer — and therefore a whole class of failure points and attack surface less.

• Installed in minutes: enable the module, create a token, done — no extra service to install, monitor and update
• Access through the Dolibarr object classes themselves: business logic, triggers, extrafields and multicompany entity separation apply automatically — no fragile re-implementation on top of the REST API
• No data sharing with third parties: the connection runs directly between your MCP client and your Dolibarr
• Not a single core patch: upgrade-safe on every Dolibarr update

273 tools in 27 categories

Full coverage of the core business objects - reading and (switchable per token) writing:

• Customers / third parties: list, search, read, create, update, delete
• Contacts: list, read, create, update, delete - plus the contact assignments of a document: who is on file as the billing, shipping or project contact, assign and remove
• Products: list, search by label or reference, resolve a reference, create, update, delete — plus purchase prices: every supplier price of a product and the cheapest one per product for the quantity actually being ordered, including quantity price breaks, discount and delivery time
• Quotations: list, search, read, create, add/update/delete lines, validate, close as signed or not signed, generate the PDF
• Sales orders: list, read, create, update, delete, maintain lines, validate, close, cancel, link to a project, generate the PDF
• Invoices: list, read, create drafts, add/update/delete lines, validate, link to a project, generate the PDF - plus payments: look up what is still open, book a payment and post it to the bank account
• Supplier invoices and purchase orders: list, search, read, create, update, maintain lines, validate, approve an order
• Projects and tasks: list, search, read, create, update and delete projects; create and maintain their tasks; record, list and delete time entries
• Calendar: list, search, read, create, update and delete appointments - linked to customer, contact and project
• Tickets: list, search, read including the message history, find unanswered tickets, create, reply (optionally notifying by email), change status
• Stock: list warehouses, look up the current stock of a product per warehouse, get the stock of many products in one call - physical and virtual -, read the movement history, book entries and exits
• Bills of materials: list, search, read, create, update, maintain lines, validate, delete - plus the net needs across all levels including sub-assemblies, for any quantity to produce
• Manufacturing: list, search and read manufacturing orders, create them from a bill of materials, update, validate, cancel, reopen, delete, and book consumption and production
• Categories / tags: list, read, create, update, delete, show their contents, assign and remove records
• Contracts: list, search, read, create, update, maintain lines, validate, delete - plus the lifecycle of each individual service: start and close them one by one or all at once, each with its own dates
• Shipments: list, search, read, create one for a sales order, update, maintain lines, validate, close, reopen, cancel, delete - including the question of how much of the order is still open
• Goods receipts: list, search, read, create one for a purchase order, update, maintain lines, validate, close, reopen, delete - with lot or serial number and the quantity still outstanding
• Supplier proposals: list, search, read, create, update, maintain lines, validate - and record the supplier's answer: accepted, refused or closed
• Members: list, search, read, create, update, validate, terminate, exclude, delete, look up the member types - plus subscriptions: record, list and remove them, with the subscription end date following automatically
• Documents: list, download, attach and delete the files of a record — for invoices, supplier invoices, sales orders, purchase orders, quotations, projects, tasks, customers, contacts, products, tickets, calendar events, contracts, shipments, goods receipts, supplier proposals and members
• Point of sale (TakePOS): read the receipts of a terminal and period, payments with their type and the change given back, takings per day and average receipt, the split by payment type, best selling products, the cash fences and the current takings of a day that is not closed yet - read-only
• Website: list, read, create, update, delete pages and blog posts, put them online or offline, add translations, set the home page, upload images (also through an upload link) and maintain the global files of the website (CSS, JavaScript, HTML header, robots.txt)
• Mass emailing: list, read, create, update, copy and delete campaigns, add recipients from contacts, third parties, members, users or a free address list and remove them again, send a test email and approve the campaign - sending it to everybody stays in Dolibarr
• Users: list, read, create, update, delete
• Reports: all invoices, orders and quotations of a customer at a glance, sales and purchase reports for a period by customer or supplier, product or month, stock value at weighted average price, income and expenses from invoices
• Stock forecast per product: open customer and supplier orders, recent consumption, expected out-of-stock date and a reorder suggestion with urgency
• System: status, connection test, an overview of the defined custom fields, links to every list, card and create form of Dolibarr and (optional, double-locked) passthrough to the Dolibarr REST API

Is there enough material for twelve?

The question that sits between sales and production can now be answered in one go - with the figures from Dolibarr, not with estimates.

• The net needs of an assembly expand every sub-assembly, take batch size, yield and fixed quantities into account and keep parts apart from work steps - and nothing is written for it
• The stock of all components arrives in a single call, physical and virtual: the virtual stock counts open purchase orders, sales orders and manufacturing, so nothing gets ordered twice
• For every missing part the module supplies the supplier, the quantity price break, the discount and the delivery time - and the purchase order line takes price and supplier reference straight from Dolibarr instead of from the conversation
• On request the module counts exactly the way a manufacturing order of the Dolibarr version in use would - including the quirks of older versions, made visible rather than hidden

Document lines with discounts

A line is built exactly as it would be in the Dolibarr form: description or product, quantity, unit price, tax rate and a discount in percent. The discount can be set when a line is added, changed later on, and it comes back when the document is read - on quotations, sales orders, invoices as well as supplier invoices and purchase orders.

• A complete document including its discounts is therefore written in one go, with nobody having to correct it by hand afterwards
• A discount outside 0 to 100 percent is refused and reported instead of producing a line with a nonsensical amount
• Changing a line without naming a discount leaves the existing discount untouched - exactly like the other fields of a line

Foreign currencies and your own PDF templates

Quotations, sales orders and invoices can be written in another currency, and their PDF comes out of the template you use in Dolibarr - straight from the conversation.

• A document takes the currency of the customer, like in the Dolibarr form, or the currency you name - with the rate from the multicurrency setup or one you give
• Prices can be entered in your own currency or in the currency of the document; Dolibarr converts the other one
• Currency and rate of a draft can be changed later; an unknown currency or a missing rate is reported instead of quietly leaving the document in the wrong currency
• The PDF is generated with the template of your choice, including your own, attached to the record like with the Generate button - the assistant only receives the file name, so the call stays fast

Archive the original document, not just its data

A document belongs to the record it accounts for. MCP+ stores files exactly where Dolibarr expects them: on the Documents tab of the record, including its entry in the file index.

• Small files go straight through the assistant — for the actual PDF there is the single-use upload link: the assistant creates it for the matching record, you open it and drop the file in. No Dolibarr login needed, the link itself is the key
• The file travels straight from your machine to Dolibarr instead of through the assistant, so the untouched original document reaches the archive whatever its size
• Every link works exactly once, expires after a configurable time and is bound to one single record. The same link also accepts a direct upload from a script
• Size limit, lifetime and a separate IP allow-list for uploads live in the module settings; every upload is in the audit log with its file, record and IP

Your custom fields included

Custom fields (extrafields) are not second class here: their values come along when a record is read and can be set when creating or updating one - for customers, contacts, products, quotations, orders, invoices, supplier documents, projects, tasks, appointments, tickets, users, warehouses and categories.

• A dedicated tool lists the fields defined for each type of record with key, label, type and allowed values - the assistant looks the field names up instead of guessing them
• An unknown field name is reported back, not silently dropped: what is reported as saved really is saved

Extensible with your own modules

Not everything that matters to a business is part of standard Dolibarr. Your own module — with customer specific reports, key figures or workflows, for example — registers its own tool category with MCP+ through a Dolibarr hook, and the assistant can use it right away.

• The module's tools behave like the built-in ones: allowed or blocked per token through scopes, requestable by OAuth clients, write tools hidden for read-only tokens, every call in the audit log
• MCP+ itself stays unchanged and upgrade-safe — the module ships its own tools, nothing in MCP+ needs to be adapted
• A faulty extension does not take the server down: it is skipped, and the setup page shows for every registered category whether it is active or why not

Security in layers

Every request passes a fixed chain of security checks before a single record is read:

• Per-client tokens: every client gets its own token — the database stores only the SHA-256 hash, the plaintext is visible exactly once
• Permissions on three levels: Dolibarr rights of the service user, tool categories (scopes) per token, and a read-only mode that hides and blocks all write tools
• Two separate IP whitelists (IPv4/IPv6, CIDR): one for static tokens, a dedicated one for OAuth connections — allowing the Anthropic/OpenAI ranges never loosens the restrictive token whitelist
• Correct client IP resolution behind reverse proxies (trusted proxy list, X-Forwarded-For not spoofable)
• Rate limit per token per minute, body size limit, origin check against DNS rebinding
• Token hardening: expiration date, per-token IP restriction, one-click revocation
• Error hygiene: internals never reach the client — they go to the server log only

OAuth 2.1 for claude.ai and ChatGPT

Cloud clients cannot store static headers — so MCP+ ships a complete OAuth 2.1 authorization server:

• Connect straight from the claude.ai connector dialog or from ChatGPT: enter the URL, approve in Dolibarr, done
• Consent page inside Dolibarr: per connection you decide the service user, the scopes and whether it is read-only
• Standards-compliant and secure: mandatory PKCE S256, dynamic client registration (RFC 7591), discovery per RFC 8414/9728, refresh token rotation per OAuth 2.1
• Every OAuth connection shows up as a regular token in the admin — same overview, same revocation, same audit log

Complete traceability

You can always see what an AI client did in your system:

• Audit log of every single request: time, token, client IP, method, tool, parameters, result, duration
• Dedicated log tab with filters (token, IP, tool, status, date range), sorting and paging — rejected access attempts are visible too
• Configurable retention with automatic and manual purge (GDPR-friendly)

Broad compatibility

One code base, many environments:

• Dolibarr 20.0 to 24.0 with one and the same module — including care for every API difference between the versions
• Works with any MCP client: Claude Desktop, Claude Code, claude.ai, ChatGPT and every standards-compliant client (Streamable HTTP, JSON-RPC 2.0)
• Multicompany-ready: tokens are bound to an entity, access stays cleanly separated

More than the MCP server of Dolibarr 24

Dolibarr 24 ships its own MCP server – as an experimental feature with 29 tools. MCP+ does everything this server does and runs from Dolibarr 20 on. On top of that:

• an own access per person and AI program instead of one shared key, with permissions per area, read-only mode and a complete audit log
• tickets, projects and time tracking, calendar events, documents, contracts, shipments, bills of materials, manufacturing, members and point of sale
• custom fields read and written on every object
• clear error messages to the AI, so it can correct itself
• reports with correct periods, a stock forecast with a really computed virtual stock

Why MCP+ instead of other solutions?

Typical MCP integrations for Dolibarr are external server processes (usually Python/Node) accessing the REST API with a single API key. The difference at a glance: