[nobuQuartile]

Adds ai_tool_read, ai_oca_mcp and their common dependency ai_tool, all copied verbatim from OCA/ai.

ai_tool_read (OCA/ai#122, open) adds generic ai_tool tools that let an AI agent read any model and field the calling user can access, while keeping personal or otherwise sensitive fields out of reach:

• list_models: lists the models the current user is allowed to read.
• get_fields: describes a model's readable fields and reports the fields forbidden to AI under hidden.
• search_read: searches and reads records of a model, excluding forbidden and binary fields.

A per-field flag AI Read Forbidden (ai_no_read) on ir.model.fields keeps a field out of these tools' results, together with the fields exposing its value (related, _inherits, computed). Relational values are returned as IDs. Searches are not restricted; the module README lists the cases that can still reveal a forbidden value. The tools run with the user's own access rights (no sudo), so ACLs, record rules and field groups still apply.

ai_oca_mcp (OCA/ai 16.0) exposes Odoo AI tools as an MCP (Model Context Protocol) server, so that external AI clients such as n8n or custom agents can call Odoo functions through the standard MCP protocol. Authentication uses per-client API keys. Claude Desktop requires OAuth 2.0, which this module does not support.

ai_tool (OCA/ai 16.0) is the base infrastructure for registering callable functions as AI tools, used by MCP servers, automation flows or other AI integrations.

Sources, one line per commit. When squash-merging, keep these lines in the commit message:

Vendored from OCA/ai@c1bd4f39b3ec5e6f7857b1c79394ec595efa3ced (16.0)
Vendored from OCA/ai@1e4cac32194acf4c247e311e47f22ba13cf818f1 (refs/pull/122/head)
Vendored from OCA/ai@c1bd4f39b3ec5e6f7857b1c79394ec595efa3ced (16.0)

In order: ai_tool, ai_tool_read, ai_oca_mcp. ai_tool_read comes from the head of the still-open OCA/ai#122; re-sync it from 16.0 once that PR merges.

Assisted-by: Claude Opus 5.5

QT6693