Restaurants: what an AI agent can and can't do with your software

• Last verified October 28, 2026
• Updated Oct 28, 2026Published Oct 28, 2026

For owners, general managers and office staff at independent restaurants, cafés, bars and small groups who are wondering how far Meta's Muse or a similar assistant could get into the systems that run the front of house, the kitchen and the books, and which calls ought to stay with a manager.

How to read the status labels

None of this comes from hands-on testing: we didn't plug any restaurant system into an agent. Treat each row as a lead to check against your own plan, account settings and contract. Our methodology page explains how we research.

The short version

• Meta's launch post for Muse names fifteen connectors. QuickBooks, Stripe and Klaviyo are there; no point of sale, reservation book, delivery service, scheduling app or inventory tool is. The post also points readers to the app's settings for every available connector. (Confirmed by vendor 1) That in-app list isn't visible to us, so a restaurant tool could appear there without our knowing. (Unverified)
• Three tools on this page publish their own MCP servers (the common plug that lets AI assistants call outside software): Square, still in Beta, plus 7shifts and MarginEdge, whose servers can only read. (Confirmed by vendor 8 22 25)
• Toast's self-serve route, Standard API access, is read-only and needs the RMS Essentials subscription or higher at every location. (Confirmed by vendor 6)
• Most reservation, waitlist and delivery APIs are built for approved software partners rather than for a single restaurant: OpenTable, Yelp, Uber Eats and Olo all route access through a partner program or written approval. (Confirmed by vendor 14 17 19 20)
• Tip pools, schedules for workers under 16, calorie and allergen statements, review requests, card data and marketing texts are where an agent's slip becomes a wage claim, a guest's health problem or a fine. Keep a manager on those; see the risk section.

Stack map

Point of sale and restaurant management

Swipe the table sideways to see every column →

Reservations and waitlists

Swipe the table sideways to see every column →

Online ordering and delivery

Swipe the table sideways to see every column →

Scheduling and payroll

Swipe the table sideways to see every column →

Inventory, invoices and accounting

Swipe the table sideways to see every column →

Everything above except QuickBooks, Stripe and Klaviyo is absent from the connectors Meta named, so linking any of them to Muse means a custom connector, unless the in-app list proves otherwise. Meta lets you build those, says it doesn't review them, and warns that what Muse pulled through a connector can remain in its memories and chat history after you disconnect. (Confirmed by vendor 2) Meta's guidelines for published connectors require approval on every use of a sensitive write, ask for a read-only option where OAuth allows, bar adding tips or fees without authorization, and say Meta isn't approving new money-movement tools for now. (Confirmed by vendor 3) A custom connector you write yourself skips Meta's review, so keeping its scope narrow is on you.

Jobs you could hand off today (per vendor docs)

Swipe the table sideways to see every column →

Keep these out

• Keys that can change the POS. Square's hosted MCP server touches only live data, and the read-only switch Square documents belongs to the copy you run yourself. (Confirmed by vendor 8) Toast's self-serve credentials can't write at all. (Confirmed by vendor 6) Start read-only, and let a manager make menu, price and discount changes in the POS.
• Wage and staff records. A 7shifts token for its MCP server is admin-level, has no sandbox, and reads live pay rates, staff records and punches. (Confirmed by vendor 22) Anything an agent reads can end up in its memory (see Meta's note above), so decide who in the company should see pay data before you connect.
• Card numbers. Stripe says card type, last four digits and expiry date fall outside PCI requirements, while a business that takes raw card numbers itself may face more than 300 security controls. (Confirmed by vendor 28) Never paste a guest's full card number into a chat, a note or a reservation comment.
• Guest phone lists without consent. Klaviyo says texts can't go to numbers that came in from its ChowNow sync unless consent is gathered separately. (Confirmed by vendor 21) An agent shouldn't turn an order history into a text campaign.
• Surprise add-ons. Meta's guidelines tell connectors not to add products, tips, subscriptions or fees that weren't authorized. (Confirmed by vendor 3) Hold your own connector to the same standard, and keep service charges and tip prompts set by a person.

Risks to keep a person on

• Tip credit, tip pools and service charges. The DOL's tipped-worker fact sheet sets the federal cash wage floor at $2.13 an hour and the largest tip credit at $5.12 against the $7.25 federal minimum. An employer must tell tipped staff five things before taking the credit, may cut a card tip only by the card company's processing percentage, and must treat a compulsory service charge as wages rather than a tip. Where state law is more protective, it governs. (Confirmed by the DOL 29) Under 29 CFR 531.52 and 531.54, an employer can't keep employees' tips whether or not it takes a credit, managers and supervisors can't share in other employees' tips, and pooled tips must be paid out no later than the regular payday for the workweek. When a credit is taken, the pool is limited to staff who customarily and regularly get tips; a pool that adds cooks or dishwashers is allowed only where everyone gets the full minimum wage. (Confirmed by the DOL 31) Fact Sheet #15B says a manager who meets the executive duties test, including an owner with at least a 20 percent stake who manages, can't take from a pool even on a shift spent tending bar. (Confirmed by the DOL 30) A spreadsheet an agent builds to split tips is a payroll decision; have a manager check who is in the pool and sign off on the payout.
• Schedules for 14- and 15-year-olds. Under 29 CFR 570.35, they may work outside school hours only: up to 3 hours on a school day (Fridays included), 18 hours in a school week, 8 hours on a non-school day and 40 hours in a non-school week, and only between 7 a.m. and 7 p.m., or 9 p.m. from June 1 through Labor Day. (Confirmed by the DOL 32) Many states set tighter limits or add rules for 16- and 17-year-olds; we haven't sourced any state here. (Unverified) If an agent drafts the schedule, a manager should check every minor's shifts against both.
• Calories on menus at chains. 21 CFR 101.11 covers restaurants in a chain of 20 or more locations under one name selling substantially the same items, plus places that register to be covered. Menus include electronic menus and menus on the Internet. Calories must appear beside each standard item's name or price, the menu must carry the statement "2,000 calories a day is used for general nutrition advice, but calorie needs vary," and the business needs a reasonable basis, such as a nutrient database, cookbook or lab analysis, for its numbers. (Confirmed by the FDA 33) If an agent rewrites your online menu, it mustn't invent or round calorie figures; take them from your nutrition analysis.
• Allergens. The FDA says FALCPA named eight major food allergens (milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat and soybeans), and the FASTER Act added sesame as the ninth, effective January 1, 2023. The FDA enforces FALCPA's labeling on most packaged foods; its list of exclusions includes most food sold at retail or food service establishments that isn't pre-packaged with a label. (Confirmed by the FDA 34) That exclusion doesn't make a wrong answer safe. An agent replying to a guest about what's in a dish can't see cross-contact in your kitchen; route those questions to the kitchen manager. State and local rules on allergen notices in restaurants vary, and we haven't sourced them. (Unverified)
• Food safety rules. The FDA Food Code is a model that local, state, tribal and federal regulators use to write their own retail and food service rules; the FDA calls the 2026 edition its newest full edition. (Confirmed by the FDA 35) Which edition your state or county has adopted, and with what changes, we haven't checked. (Unverified) Temperature logs and date marks are records an inspector may rely on; they should come from the person who took them.
• Reminder and marketing texts. The FCC's rule in section 64.1200 requires the called party's prior express consent before an autodialed or prerecorded call reaches a cell phone, paragraph (a)(1)(iii), and prior express written consent once those calls advertise, paragraph (a)(2). Before November 25, 2026, the rule says an opt-out must be honored however it's reasonably made, and the one confirming text it permits has to be a one-time message, free of marketing and the only one sent after the request. (Confirmed by the FCC 37) From November 25, 2026, the FCC's revised rule lets a sender name one exclusive opt-out channel, provided it's disclosed clearly: a voice or keypad prompt, one of the standard reply words such as "stop" or "unsubscribe," or a website or phone number. Senders must still honor opt-outs within ten business days. An opt-out from a purely informational text may be applied to that category only, while one from a promotional message ends all promotional messages. The confirming text must still carry no marketing and keeps the five-minute presumption, but it no longer has to be one-time or the sole follow-up message. (Confirmed by the FCC 38) Keep "your table is ready" texts free of promotions, and don't let an agent text guests a deal unless you hold written consent.
• Card data and the POS. Toast says every customer taking cards must be PCI compliant, and that for card-present payments on Toast-approved devices the only requirement left to the restaurant in its card-present matrix is restricting physical access to cardholder data. (Confirmed by vendor 7) Square says it meets PCI DSS on sellers' behalf, so they don't have to validate compliance individually. (Confirmed by vendor 9) Stripe calls PCI compliance a responsibility shared between it and the business, which must attest every year. (Confirmed by vendor 28) These are vendor statements about their own systems; they don't cover a spreadsheet, inbox or chat where an agent copies card details.
• Delivery app fees. Some cities limit what delivery apps may charge restaurants. We haven't sourced any such cap or checked whether one applies where you are, so ask your city or a lawyer before an agent compares fees or changes delivery settings. (Unverified)
• Reviews. The FTC's rule at 16 CFR part 465 bars a business from writing or buying reviews that misrepresent who wrote them or their experience (465.2), from offering anything in return for reviews of a particular sentiment, positive or negative (465.4), and from using threats or false accusations to stop or remove a review (465.7). (Confirmed by the FTC 36) Meta's guidelines also say connectors must not fabricate reviews. (Confirmed by vendor 3) Don't let an agent post reviews, offer a free dessert for five stars, or answer a bad review with threats. Asking every guest for honest feedback is a different thing.

This guide isn't legal, tax or food safety advice. Your health department, state labor agency, card processor and software contracts can impose stricter terms than anything listed here.

FAQ

Can Muse get into my Toast or Square data today? Meta's launch post names neither of them as a connector. (Confirmed by vendor 1) Toast offers read-only API credentials and Square an MCP server, so a custom connector is the route for either. (Confirmed by vendor 6 8) We haven't confirmed that Muse can attach Square's server. (Unverified)

Which restaurant tools already plug into AI assistants? Square (Beta), 7shifts and MarginEdge each document an MCP server, and the 7shifts and MarginEdge servers only read. (Confirmed by vendor 8 22 25) None of the three names Muse as a supported client. (Unverified)

Could an agent book or cancel reservations for me? Not through Tock's API, which can't create or cancel reservations. (Confirmed by vendor 16) OpenTable and Yelp open their APIs to approved partners, although OpenTable says restaurants can also arrange access through account management. (Confirmed by vendor 14 17)

Could an agent build next week's schedule? The 7shifts MCP server can read schedules but not change them. (Confirmed by vendor 22) If an agent drafts one elsewhere, check minors' hours and break rules before you publish it.

What's a low-risk first step? Connect QuickBooks in Muse and ask about cash flow and overdue invoices. Nothing in your POS changes.

Where are the other trades? See all trade guides.

Changes to this page

Swipe the table sideways to see every column →

Seen a mistake or a stale line? Report it on our Corrections page. This page restates published vendor and agency material; none of these tools was tested by us.