How to connect ChatGPT to an ERP system: APIs, MCP and security

Connecting ChatGPT to an ERP or CRM does not necessarily require replacing the software a company already uses.

An integration can enable users to check orders, retrieve inventory information, look up customer records or prepare document drafts.

In 2026, OpenAI supports custom MCP servers in ChatGPT. Write actions depend on workspace permissions and server configuration; custom server connections are available to Business and Enterprise/Edu workspaces.

Odoo 20 also documents an MCP server for connecting AI clients to its ERP environment.

However, the availability of a connector does not mean every business operation is automatically supported or safe.

APIs allow applications to retrieve or modify information through interfaces provided by business software.

Model Context Protocol (MCP) is a standard for exposing tools to AI assistants. An MCP server can call an ERP's existing APIs while enforcing the required permissions.

Consider a request: “Check order 125 and confirm whether the products are available.”

In a system designed for this task, ChatGPT requests a tool call, the server retrieves authorized information and returns structured data. The model then uses that result to prepare its answer.

There is also another approach for building an independent business application: using the OpenAI API with function calling, where the application's backend executes the requested operations.

MCP and function calling are different integration mechanisms, although they can address similar use cases.

An integration should separate read-only tools from actions that modify records or produce financial consequences.

Checking an order's status is different from confirming it. Preparing a quotation draft is different from sending it to a customer.

OpenAI's MCP server documentation requires authorization checks on the server for every request, rather than relying on the model to decide what users can access.

Sensitive workflows also need identity verification, limited permissions, input validation, audit logs and approval before consequential actions.

Prompt injection is another concern. Malicious instructions embedded in retrieved content can attempt to influence the assistant's behavior.

Restricting available tools and avoiding unrestricted database access helps reduce that risk.

For a small or medium-sized company, an initial integration might cover only order-status queries, inventory lookups or quotation drafts that require human review.

Before implementation, the team should verify available APIs, data exposure, access controls and the handling of errors and duplicate requests.

If the existing ERP lacks suitable interfaces, MCP alone will not solve that limitation.

We explored this boundary in our Research Note on when to integrate an ERP instead of replacing it.

A carefully designed integration gives AI access to specific business functions while keeping the ERP responsible for authoritative data and operational rules.