# public_access_portal_invoices Get list of portal invoices (/my/invoices). Returns HTML page content. Agent View of the PolicyLayer registry record for `public_access_portal_invoices`. HTML page: https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/public-access-portal-invoices ## Facts - Tool: `public_access_portal_invoices` - Server: Odoo Claude MCP (`rosenvladimirov/odoo-claude-mcp`) — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp.md - Homepage: https://github.com/rosenvladimirov/odoo-claude-mcp - Risk category: Read (Low risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 0 - Recommended policy verdict: Allowed ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "public_access_portal_invoices", "arguments": {} } } ``` ## Why public_access_portal_invoices is rated Low This tool retrieves and returns invoice data via a portal endpoint—a query operation with no modification, deletion, or execution. Severity is medium rather than low because invoices may contain sensitive financial information (amounts, customer details, payment status), and unauthorized access could expose confidential business or customer data. From the tool's own definition: "Tool name 'public_access_portal_invoices' and description 'Get list of portal invoices (/my/invoices). Returns HTML page content' indicate data retrieval with no side effects." ## Use case AI agents call public_access_portal_invoices to retrieve information from Odoo Claude MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere. ## Recommended policy (PolicyLayer) Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Odoo Claude MCP: ```json { "version": "1", "default": "deny", "tools": { "public_access_portal_invoices": {} } } ``` ## Other tools on Odoo Claude MCP (245) - `cf_dns_delete` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/cf-dns-delete.md - `cf_tunnel_route_remove` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/cf-tunnel-route-remove.md - `ee_unlink` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/ee-unlink.md - `google_calendar_delete_event` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/google-calendar-delete-event.md - `memory_delete` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/memory-delete.md - `module_deploy_rollback` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/module-deploy-rollback.md - `odoo_disconnect` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/odoo-disconnect.md - `odoo_fp_remove_action` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/odoo-fp-remove-action.md - `odoo_stock_initial_delete` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/odoo-stock-initial-delete.md - `odoo_stock_mo_delete_draft` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/odoo-stock-mo-delete-draft.md - `odoo_unlink` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/odoo-unlink.md - `odoo_web_logout` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/odoo-web-logout.md - `odoo_website_remove_snippet` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/odoo-website-remove-snippet.md - `provision_revoke_api_key` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/provision-revoke-api-key.md - `s3_bucket_delete` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/s3-bucket-delete.md - `s3_object_delete` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/s3-object-delete.md - `s3_objects_delete_prefix` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/s3-objects-delete-prefix.md - `secrets_revoke` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/secrets-revoke.md - `session_handoff_cancel` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/session-handoff-cancel.md - `session_link_revoke` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/session-link-revoke.md - `session_revoke` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/session-revoke.md - `telegram_agent_unenroll` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/telegram-agent-unenroll.md - `telegram_sub_remove` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/telegram-sub-remove.md - `tenant_restore` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/tenant-restore.md - `user_connection_delete` — Destructive — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/user-connection-delete.md - `ai_invoice_pipeline_run` — Execute — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/ai-invoice-pipeline-run.md - `ai_invoice_plugins_reload` — Execute — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/ai-invoice-plugins-reload.md - `ai_pipeline_run` — Execute — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/ai-pipeline-run.md - `ai_pipeline_step_execute` — Execute — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/ai-pipeline-step-execute.md - `ai_tokenize_collection` — Execute — https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp/ai-tokenize-collection.md - …and 215 more: https://policylayer.com/tools/rosenvladimirov-odoo-claude-mcp.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=rosenvladimirov-odoo-claude-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/rosenvladimirov-odoo-claude-mcp