[Cotlet](https://cotlet.dev/index.md) · [Integrations](https://cotlet.dev/integrations.md) · [How it works](https://cotlet.dev/how-it-works.md) · [Security](https://cotlet.dev/security.md) · [For developers](https://cotlet.dev/for-developers.md) · [For automation agencies](https://cotlet.dev/for-agencies.md) · [Blog](https://cotlet.dev/blog.md) · [API docs](https://cotlet.dev/docs.md) · [Help center](https://cotlet.dev/help.md) · [Changelog](https://cotlet.dev/changelog.md) · [Contact](https://cotlet.dev/contact.md) · [Pricing](https://cotlet.dev/pricing.md) · [Sign up](https://cotlet.dev/signup) # Toast API and MCP server: Let your AI agent handle the Toast back office. > Toast has no MCP server, and its Standard API access gives a restaurant read-only credentials (checked 28 Oct 2026). Write access goes through your Toast account rep as a custom integration. Cotlet runs 10 Toast tools hosted, over MCP for agents and REST for scripts, in your own Toast Web login. Menus, 86 list, sales, schedules and time entries for your Toast restaurant. Use it in ChatGPT, Claude or any AI agent over MCP, or in n8n, Make and scripts over REST. [MCP setup](https://cotlet.dev/integrations/toast-api-mcp-server.md#connect) [REST API guide](https://cotlet.dev/integrations/toast-api-mcp-server.md#rest-api) - Free 7-day trial, no card - Unofficial, not affiliated with Toast - Page: https://cotlet.dev/integrations/toast-api-mcp-server ## What can you automate in Toast? - 86 an item or bring it back - Set menu hours for a holiday - Fix missed clock-outs - Copy last week's shifts - Publish the schedule after your OK - Compare weekly sales ## Does Toast have an MCP server or an API? - Standard API access needs Restaurant Management Suite Essentials or higher and the Manage Integrations permission. Its 14 scopes all end in :read. Toast lists stock:write and labor.shifts:write only for clients it certifies, and no scope at all for menu hours, time entries or publishing a schedule. - Toast IQ, Toast's own assistant in Toast Web, can 86 items and "adjust a server's clockout" after you confirm. It works only inside Toast: there is no API or MCP to call it from your agent. - Zapier has no Toast app. Make has a community app maintained by MAXMEL Tech, and n8n only a community node under a business license. | What you need | Standard API access | Toast IQ | Cotlet | |---|---|---|---| | Read menus, stock, time entries, shifts | Yes, with credentials | Yes, in chat | Yes | | 86 an item or put it back | No | Yes, after a confirm | Yes | | Change menu hours | No | Not stated | Yes, after your OK | | Fix a missed clock-out | No | Yes, after a confirm | Yes, after your OK | | Create and publish shifts | No | Edits shifts | Yes, after your OK | | Your own agent, on a schedule | A server you run | Only inside Toast | Hosted, any MCP client | | What your Toast account needs | RMS Essentials or higher | U.S. customers | A Toast Web login | Checked 28 Oct 2026. Sources: [Toast Support: Standard API Access](https://support.toasttab.com/en/article/Standard-API-Access), [Toast Developer guide: Scopes](https://doc.toasttab.com/doc/devguide/apiScopes.html), [Toast Developer guide: Standard API access scopes](https://doc.toasttab.com/doc/devguide/devApiAccessScopes.html), [Toast IQ assistant announcement (29 Oct 2025)](https://www.nasdaq.com/press-release/toast-expands-toast-iq-smart-features-smart-ai-assistant-2025-10-29) ## How does Cotlet connect to Toast? 1. **Sign in to Toast.** Use your own account in its Cotlet Cloud Browser. 2. **Choose MCP or REST.** Connect your agent or create a Cotlet API key. 3. **Run your workflow.** Ask your agent or send an HTTP request. We never keep your Toast password, and no schedule, clock-out or menu-hour change goes live until you approve it. ## Connect Toast to your agent or workflow Use MCP with your AI agent, or HTTP requests in n8n, Make, Zapier and scripts. Follow the MCP setup below or jump to the REST guide. 1. **Log in to Toast Web once.** Make a Cotlet account, open Toast in its Cloud Browser, log in with a manager login and press Enable for agents. 2. **Add the Cotlet address.** Enter https://cotlet.dev/mcp/v1 where your agent lists its MCP servers or connectors. 3. **Let the agent through.** Chat apps open a Cotlet sign-in page. Code editors, n8n and scripts use an API key you make in the console. Toast shares `https://cotlet.dev/mcp/v1` with every other app on your Cotlet account. Turned Toast on after you connected? Refresh the connector so its tools appear. Claude: ``` Settings > Connectors > Add custom connector URL: https://cotlet.dev/mcp/v1/connect Claude Code: claude mcp add --transport http cotlet-toast \ https://cotlet.dev/mcp/v1 \ --header "Authorization: Bearer $COTLET_API_KEY" ``` ChatGPT: ``` Settings > Apps & Connectors > Create MCP server URL: https://cotlet.dev/mcp/v1/connect Authentication: OAuth ``` Cursor: ``` // ~/.cursor/mcp.json { "mcpServers": { "cotlet-toast": { "url": "https://cotlet.dev/mcp/v1", "headers": { "Authorization": "Bearer ${env:COTLET_API_KEY}" } } } } ``` Codex: ``` # ~/.codex/config.toml [mcp_servers.cotlet-toast] url = "https://cotlet.dev/mcp/v1" bearer_token_env_var = "COTLET_API_KEY" ``` n8n: ``` MCP Client Tool (inside an AI Agent) Transport: HTTP Streamable URL: https://cotlet.dev/mcp/v1 Auth: Bearer, Tool: toast_read ``` Make, Zapier: ``` Make: MCP Client > Call a tool Zapier: MCP Client by Zapier > Run Tool Server URL: https://cotlet.dev/mcp/v1 Token: Tool: toast_write ``` ## How to use the Toast REST API ### Create your Cotlet API key Create a Cotlet API key with access to Toast and its read operations. Store it as `COTLET_API_KEY` in your environment or automation platform's credential store. Connect Toast in Cotlet and enable it for agents. Account access: Your own Toast Web account (menu editing, sales reports, labor reports and scheduling each need the matching permission or the Admin or Manager role). ### Make your first Toast API request REST: ``` curl "https://cotlet.dev/api/v1/toast/menus?location=Main+Street" \ -H "Authorization: Bearer $COTLET_API_KEY" ``` ### Read menus and apply the operation limits A successful REST call puts the tool output in `result`. This illustrative response excerpt omits call IDs, messages and credit details. Illustrative response excerpt: ``` { "status": "success", "app": "toast", "tool": "list_menus", "result": { "location": "Main Street", "menus": [ { "name": "Lunch", "availability": "Specific days and time", "hours": [ { "day": "Monday", "start": "11:00", "end": "15:00" } ] }, { "name": "Dinner", "availability": "Specific days and time", "hours": [ { "day": "Monday", "start": "17:00", "end": "22:00" } ] }, { "name": "Drinks", "availability": "All day", "hours": [] } ] } } ``` Returns each menu from Menus > Menu management > Menu manager with the days and times it is available. Availability is set per menu in Toast, never per item, group or modifier. Any Toast Web user who can open the menus can call it. Replace `Main Street` with your own location; multi-location accounts need the correct location selection. Keep the same selection when continuing a list. Compare changed record values as well as identifiers when refreshing your destination. ### Toast workflows for agents and automations | Tool | Connect through | Example workflow | |---|---|---| | n8n | HTTP Request | List the items of a menu with their stock status. Use `list_menu_items` in your configured business report. | | Make | HTTP > Make a request | Read the Sales summary report for a date range. Use `get_sales_summary` in your configured business report. | | Python or Node.js | REST API | List scheduled shifts for a date range. Use `list_shifts` in your configured business report. | Send `Authorization: Bearer ` in request headers. You configure the schedule, destination and record comparisons. Cotlet reads Toast; your workflow steps write to your chosen destination. These HTTP workflows do not require a native Cotlet connector or a prebuilt template. Python and Node.js can use the same HTTP requests without an AI agent. Keep access keys in credentials, outside shared workflow exports. The [API and MCP reference](https://cotlet.dev/integrations/toast-api-mcp-server.md#tools) lists operations and inputs. The [REST API guide](https://cotlet.dev/docs/api.md) explains authentication, errors and approvals. ## Toast API endpoints and MCP tools ### Menus and the 86 list One location per call. Hours belong to a whole menu, because Toast sets none per item. Stock changes publish at once and do not wait for your OK. - **List menus** (`list_menus`, read): List the menus of a location with their availability. - **List menu items** (`list_menu_items`, read): List the items of a menu with their stock status. - **Set item stock** (`set_item_stock`, write): Mark a menu item In stock, Out of stock or Limited stock. - **Set menu hours** (`set_menu_availability`, write, asks first): Set the days and times a menu is available. ### Sales summary The totals of the Sales summary report. Needs the Sales reports permission. - **Get sales summary** (`get_sales_summary`, read): Read the Sales summary report for a date range. ### Time entries Edits sync to Toast Payroll and change what someone is paid, so the fix asks first. - **List time entries** (`list_time_entries`, read): List worked shifts with clock-in and clock-out times. - **Fix time entry** (`update_time_entry`, write, asks first): Change the clock-in or clock-out time of a worked shift. ### Scheduling Needs the Admin or Manager role. New shifts stay unpublished until you publish them. - **List shifts** (`list_shifts`, read): List scheduled shifts for a date range. - **Create shift** (`create_shift`, write, asks first): Add a shift to the schedule, published or not. - **Publish shifts** (`publish_shifts`, write, asks first): Publish selected shifts so employees see them. Inputs, REST path and example response of every tool: https://cotlet.dev/integrations/toast-api-mcp-server#tools ## Who can see my Toast session, and how do I revoke it? - **What we store.** Your logged-in Toast Web profile, AES-256-GCM, in Finland. Not the password. - **What your agent gets.** The 10 Toast tools. No cookie, no client secret. - **What the session sees.** What your Toast Web role sees: menus, reports, hours, the schedule. - **What no tool touches.** Payments, refunds, payroll runs, deposits and bank details. - **If Toast asks for a code.** Toast Web asks for an MFA code now and then. You enter it, we never do. - **How to cut access.** Disable for agents, reset the browser, or change the login's password in Toast. Toast allows a shared Toast Web login and tells you to "limit the permissions assigned to that account". Do the same here: a login with menu, reports, labor and scheduling access. Leave off the 8.X Account Admin permissions: Toast makes MFA mandatory for them, and no tool needs them. Our site scores A+ on Qualys SSL Labs, securityheaders.com and Mozilla Observatory ([live results](https://cotlet.dev/security.md)). We have no SOC 2 report or third-party pentest yet. ## Is it against Toast's terms? Account safety > including but not limited to the use of automated systems or software (e.g. screen scraping) to extract data from the Toast Platform or other aspects of the Services > > [Toast Merchant Agreement, from a search snippet; the page answered 403 on 28 Oct 2026](https://pos.toasttab.com/merchant-agreement) The clause lists uses that could "damage, disable, overburden" Toast's systems, and automated extraction is its example. The Acceptable Use Policy lets Toast "suspend, block, or terminate your access" for a breach, and it covers AI products and integrations. Cotlet makes a few calls a day in one manager's login, but Toast could still count it as automation. We found no public case of a restaurant cut off for a script or an agent (checked 28 Oct 2026). How we keep your account looking like you: - Your own Toast Web login, signed in by you - One Cloud Browser with its own IP and cookies - Schedules, clock-out fixes and menu hours wait for your OK - No tool pays, refunds, voids or runs payroll - If Toast objects, we pause the Toast tools for everyone within 24 h > Your managers use the same Toast Web during service. Run big jobs, like 90 new shifts, before opening or after close. ## What happens when Toast changes? - **12 h** between tests of the Toast reads and stock changes - **24 h** between tests of shifts and hours your staff or guests would see - **$0** for a call to a Toast tool paused for repair A menu change in Toast reaches the POS only after a publish, and the two menu write tools publish for you. When a Toast Web screen moves, we repair the tool and your scheduled runs keep the same prompt. [status.cotlet.dev](https://status.cotlet.dev) checks the site, console and API every 3 minutes. ## Approvals, undo and mistakes 1. **Finds the 4 a.m. exits.** Yesterday's time entries Toast clocked out on its own. 2. **Matches the schedule.** Each one against the end of its scheduled shift. 3. **Waits for your OK.** Every fix shows up in your Cotlet console first. 4. **Reports back.** Who was fixed, the new clock-out, and any with no shift. | Action | Undo | |---|---| | 86 an item | Yes, set it In stock with the same tool | | Change menu hours | Set the old hours again; guests may have seen the new ones | | Fix a time entry | Edit it again; once payroll ran, fix the pay in Toast Payroll | | Create an unpublished shift | Delete it in Scheduling, nobody saw it | | Publish shifts | No, staff may have seen them in MyToast | 4 of 10 tools ask first: set_menu_availability, update_time_entry, create_shift and publish_shifts. set_item_stock runs at once, because an 86 reaches no guest by message and one call reverses it. Turn the wait off per tool for a scheduled run. > Edits to a shift after it is published may not reach staff who already checked their schedule. Fix the schedule before you publish it. MCP call: ``` { "name": "set_item_stock", "arguments": { "item": "Ribeye", "menu": "Dinner", "stock_status": "Out of stock", "location": "Main Street" } } ``` REST: ``` curl -X PUT https://cotlet.dev/api/v1/toast/item-stock \ -H "Authorization: Bearer $COTLET_API_KEY" \ -H "Content-Type: application/json" \ -d '{"item":"Ribeye","menu":"Dinner","stock_status":"Out of stock","location":"Main Street"}' ``` Response: ``` { "item": "Ribeye", "menu": "Dinner", "stock_status": "Out of stock", "places_updated": 2, "published": true } ``` Scripts reach the same tools over REST at `/api/v1/toast`, with the same key and price, so a cron job can reset the 86 list before the doors open. A call your Toast Web role cannot make fails and costs nothing. The tools table lists the REST path of each tool. ## How much does the Toast MCP server cost? **About $45 a month** for one full-service location with 24 staff, 7,820 credits. Your Toast subscription stays with Toast. | Job | Calls | Credits | |---|---|---| | Reset the 86 list each morning | 6 × 30 | 1,800 | | Look for missed clock-outs, daily | 2 × 30 | 600 | | Fix one missed clock-out | 1 × 12 | 120 | | Build and publish next week, 90 shifts | 92 × 4 | 3,680 | | Sales summary against last week | 2 × 4 | 80 | | Holiday menu hours | 2 × 2 | 40 | | Cloud Browser, 30 days | | 1,500 | | Total | | 7,820 | - Free 7-day trial, no card - 10 credits per successful call, MCP or REST - 50 credits a day for the Cloud Browser - No RMS plan or API credentials needed The month is our example: the average US full-service restaurant has one location and 24 staff. The schedule is most of the bill, one create_shift call per shift; a week you only tweak costs far less. Dollars at the $29 pack rate. ## Toast MCP server on GitHub, Zapier or hosted: which to use | Option | What it does | Where it stops | |---|---|---| | [prime-cost/toast-mcp](https://github.com/prime-cost/toast-mcp) | 55 read-only tools for orders, sales, labor, menus and cash, built by a restaurant owner, with a one-click Railway deploy. | Reads only. Needs Standard API credentials and a host you pay for; no license, 2 stars, last commit 8 Oct 2026. | | [BusyBee3333/toast-mcp-2026-complete](https://github.com/BusyBee3333/toast-mcp-2026-complete) | The most starred one (16): 8 read-only tools with a demo mode; its old write tools moved to a legacy folder. | The README says live Toast behavior is not verified by the maintainer. Last commit 28 Aug 2026. | | [NoBanks/toast-mcp](https://github.com/NoBanks/toast-mcp) and similar | Small servers, some with stock or order writes switched off by default. | The writes need partner scopes a restaurant cannot create for itself. | | [Velocity-BPA/n8n-nodes-toast](https://github.com/Velocity-BPA/n8n-nodes-toast) | n8n community node on the official API. | Business Source License: a for-profit restaurant needs a paid license. Writes need the same scopes. | | [Make community app](https://www.make.com/integrations/toast-community) | Toast modules maintained by MAXMEL Tech, not by Make. | Built on the same API and its read-only tier. | For reports on your own hardware, a GitHub server on Standard API access is a fair pick and costs only the host. For changes from inside Toast, Toast IQ is already in your back office. Cotlet is for an agent you choose that changes the menu and the schedule on a timer, without API credentials. ## Who runs Cotlet Take Group sp. z o.o. runs Cotlet: a software company registered in Poland, EU (VAT PL6342984273), working since 2019 and founded by Bart Krawczyk (Co-founder, CTO) and Jake Slugocki (Co-founder, SEO, sales and marketing). Questions about the Toast tools go to contact@cotlet.dev. ## Toast API and MCP: questions ### How do I get access? Create a free account at https://cotlet.dev, open Toast under Integrations in the console and log in to Toast Web in its Cloud Browser. The trial starts with your first app and asks for no card. ### How do I connect Toast to ChatGPT or Claude? Sign up at cotlet.dev, log in to Toast once in its Cloud Browser and add Cotlet to ChatGPT or Claude, following the steps in your console. No API key is needed. ChatGPT and Claude then work in your Toast account through Cotlet, in their phone apps too. ### What can ChatGPT do in Toast? With Cotlet, ChatGPT, Claude and other AI agents handle jobs like these in Toast: reset the 86 list every morning; weekly sales summary report; build and publish next week\. You ask in plain words, and anything that reaches other people waits for your OK first. ### What does my Toast account need? The same permissions the job needs in Toast Web. 86ing needs menu editing access. The Sales summary needs the Sales reports permission. Time entry changes need Edit time entries and Labor reporting. Scheduling needs the Admin or Manager role. A call without the permission fails. You do not need the read-only API credentials or an RMS plan for Cotlet. ### Does it change all my locations at once? No. Tools work on one location per call, named in location. In Toast, 86ing with advanced properties on a multi-location account changes only the location you are viewing, and Cotlet follows that rule. ### Does Toast have webhooks? Toast's API sends webhooks to clients with Standard API access, but Cotlet does not receive them. To react to a missed clock-out or an 86, run your agent on a schedule, for example a daily list_time_entries with auto_clock_outs_only. ### Can the agent take payments, refund a check or run payroll? No. None of the tools touches payments, refunds, voids, deposits or payroll runs. A fixed time entry does reach Toast Payroll as hours, which is why update_time_entry waits for your OK. ### Is the MCP server different from the REST API? Only the way in. Both carry the same 10 tools, inputs and answers, with one API key and one price. Agents use MCP; scripts, cron jobs and HTTP steps use REST. ### Is Cotlet affiliated with Toast? No. Cotlet is independent and not affiliated with Toast, Inc. ### Can I use the Toast API without an AI agent? Yes. Call Cotlet's REST API from a script or an HTTP step in n8n, Make or Zapier with your Cotlet key. MCP is the alternative for AI agents; you do not need to connect an agent to use REST. --- Give your AI agents your signed-in browser. **Product:** [Integrations](https://cotlet.dev/integrations.md) · [How it works](https://cotlet.dev/how-it-works.md) · [Pricing](https://cotlet.dev/pricing.md) · [Security](https://cotlet.dev/security.md) **Resources:** [Blog](https://cotlet.dev/blog.md) · [API docs](https://cotlet.dev/docs.md) · [Help center](https://cotlet.dev/help.md) · [Changelog](https://cotlet.dev/changelog.md) · [GitHub](https://github.com/cotletdev/cotlet) **Solutions:** [For developers](https://cotlet.dev/for-developers.md) · [For automation agencies](https://cotlet.dev/for-agencies.md) **Company:** [About](https://cotlet.dev/about.md) · [AI info: company facts](https://cotlet.dev/ai-info.md) · [Contact](https://cotlet.dev/contact.md) **Legal:** [Terms of service](https://cotlet.dev/terms) · [Privacy policy](https://cotlet.dev/privacy) · [Refund policy](https://cotlet.dev/refunds) · [Acceptable use](https://cotlet.dev/acceptable-use) · [Cookie policy](https://cotlet.dev/cookies) · [DPA](https://cotlet.dev/dpa) · [Subprocessors](https://cotlet.dev/subprocessors) **Elsewhere:** [Status page](https://status.cotlet.dev) · [Cotlet on GitHub](https://github.com/cotletdev) · [Cotlet on X](https://x.com/cotletdev) · [Cotlet on LinkedIn](https://www.linkedin.com/company/cotletdev) · [Cotlet on Product Hunt](https://www.producthunt.com/products/cotlet) · [Cotlet on Crunchbase](https://www.crunchbase.com/organization/cotlet) · [Cotlet on SaaSHub](https://www.saashub.com/cotlet) Cotlet.dev is built by Bart Krawczyk and Jake Slugocki, the founders of Take Group sp. z o.o., ul. Wincentego Janasa 4, 40-855 Katowice, Poland. KRS 0000871398, NIP 6342984273, VAT EU: PL6342984273. [About us](https://cotlet.dev/about.md) Cotlet is an independent service. It is not affiliated with, endorsed by or sponsored by any of the products listed on this site. Product names are trademarks of their respective owners.