AI assistants become useful in business only when access is specific, reviewable, and limited to the task. The VPCS Cloud MCP Platform provides that control layer for Odoo, Kite Connect, GitHub, and company knowledge—through one secure Model Context Protocol endpoint.
Why a bounded MCP platform matters
Connecting an AI client directly to broad APIs creates an avoidable trust problem. The client may need to search Odoo records, review a portfolio, inspect an approved GitHub repository, or retrieve company knowledge—but it does not need generic shell access, raw SQL, unrestricted HTTP, or a hidden path to write operations.
VPCS Cloud MCP applies a default-deny model. A request must pass the permitted identity, approved client, exact OAuth scopes, and tool policy before a tool can appear in tools/list or run through tools/call. This makes the exposed capability set smaller, easier to audit, and aligned with the user’s actual job.
Production architecture
The hosted endpoint at mcp.vpcscloud.com combines Cloudflare OAuth and protected origin routing with application-level authorization. Supported MCP clients include Claude, ChatGPT, Gemini, and GitHub Copilot, subject to the identity and scope grants configured for each client.
The validated production release exposes 28 bounded tools:
- 8 Odoo tools for constrained business-data workflows, with live proof kept separate from fixture-only composite validation.
- 14 Kite Connect tools for read-oriented account, holdings, positions, margins, market-data, and research workflows.
- 3 GitHub tools limited to approved repositories and defined repository-reading tasks.
- 2 knowledge tools for company-context discovery and retrieval.
- 1 platform-proof tool for controlled end-to-end verification.
Four gates before a tool is available
- Identity: only explicitly approved user identities can enter the workflow.
- Client: the calling MCP application must match an approved client registration.
- Scope: the token must contain the exact scope required by the tool family.
- Tool policy: the individual tool must be allowed for that identity-client-scope combination.
These checks apply both when advertising available tools and when executing them. A tool that is outside the grant is not merely discouraged in a prompt; it is filtered or denied by the platform boundary.
Odoo access without a generic back door
The Odoo provider is designed around bounded business operations rather than arbitrary model access. Production evidence distinguishes the primitive operations validated against a live Odoo environment from higher-level composites validated with fixtures. That distinction prevents test evidence from being presented as a broader production claim than it supports.
There is no generic SQL tool, unrestricted shell, or open-ended HTTP proxy in the exposed set. This keeps assistants focused on approved workflows while normal Odoo permissions and company controls continue to apply underneath.
Read-oriented portfolio intelligence with Kite Connect
The repository now includes the reusable $vinay-kite-portfolio skill. It orchestrates the bounded Kite tools into a structured portfolio-review workflow: current holdings and positions, available margins, technical indicators, fundamentals, relevant news, US-market effects, FII/DII flows, target weights, and conditional buy/hold/trim/exit guidance.
This is a repository workflow addition, separate from the currently tagged production platform release. It is intentionally read-only: it can organize evidence and recommendations, but it never places a trade without a separate, explicit authorization path. Kite sessions also retain their normal daily authentication requirements.
Evidence-aware by design
A secure integration is not proven by a successful happy-path demo alone. The platform’s validation approach records both positive and negative evidence: what an approved client can access, what a different identity or scope cannot access, and which capabilities are live-proven versus fixture-proven. This makes release decisions and future expansion easier to review.
The safest useful agent is not the one with the most tools. It is the one with the smallest verified toolset that can complete the job.
Where the platform fits
- Odoo operations: let approved assistants retrieve and act on narrowly defined ERP context without exposing a general administration interface.
- Portfolio research: combine current account context with market and research signals through read-oriented tools.
- Repository support: inspect approved code and documentation while keeping repository scope explicit.
- Company knowledge: answer product, service, support, and operational questions from maintained knowledge sources.
- Multi-client teams: apply the same server-side authorization model across supported AI applications.
Explore the platform
The project repository is maintained at infovpcs/vpcscloud-mcp-platform; repository visibility is controlled by the project owner. To discuss a secure Odoo, knowledge, GitHub, or financial-research MCP deployment, visit VPCSCloud or contact VPerfectCS.