Zomato
by Zomato
Find restaurants, browse menus and place a real, paid food order from your AI agent. Anthropic lists 11 tools; Zomato publishes no tool list. One consent screen grants ordering and reading together. India only.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect Zomato via MCP
https://mcp-server.zomato.com/mcpWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
Zomato Tools & Capabilities (11)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- This connector transacts.
checkout_cartsubmits a real, paid food order. Keep per-call approval on, and do not run this server in an unattended agent loop. - Zomato calls it testing software and disclaims liability. Its README states the integration is "only for testing purposes" and that Zomato disclaims any and all liabilities arising from erroneous or non-functional MCP behaviour. The identical sentence appears on the consent screen you agree to. That disclaimer sits on a system that spends money, which is an unusual combination and the single most important thing to read before connecting.
- There is no cancel, refund or modify tool. Nothing among the 11 names reverses an order, and Zomato publishes no MCP path to cancel one. Recovery from a mistaken order happens in the Zomato app or through support, not through the agent that placed it.
- The cart is single-shot. There is no update_cart, so a cart cannot be built across calls; each
create_cartstarts fresh. A tracker report adds there is no way to clear a cart via MCP, and another notes a cart created through MCP was not visible in the app. - Prices shown may be lower than what you pay. An open bug report states
create_cart'scharge_breakdownomits restaurant packaging charges, giving one concrete case of an agent estimating about ₹241 against an actual ₹315.82. Zomato has not marked it fixed. Verify the total before approving checkout. - Customisations are unreliable. An open report states
create_cartaccepts only one modifier group per call, rejects optional groups outright — which is where paid add-ons live — and silently auto-fills remaining required groups with defaults. A build-your-own item may therefore arrive differently from what was asked for. - Third-party apps are not permitted. Zomato's README says so directly, citing security and legal considerations, and dynamic client registration is effectively closed: the metadata advertises a registration endpoint, but a maintainer confirms redirect URIs are allowlisted by hand and localhost is disabled.
- India only. The sign-in page offers
+91and nothing else. - Sign-in is widely reported as fragile. The tracker carries multiple open reports of OTP delivery failing, OTP rejection, intermittent 503s during login, and re-authentication being required after disabling the connector. Two were marked fixed by maintainers in April 2026; others remain open.
- No published rate limits, and no MCP-specific privacy policy. Zomato's README documents neither. The 1,000-calls-per-day ceiling in Zomato's 2020 API Policy governs its legacy REST developer programme and must not be read as this server's limit.
- We could not read tool schemas or safety annotations. The endpoint returned 401 to an anonymous request, so no parameter-level detail or
readOnlyHintvalue is published here. Parameter names cited above come from user bug reports, not from Zomato. - We did not exercise any tool. Our checks were an anonymous
initializethat we expected to fail, plus unauthenticated GETs of metadata and public pages. Every behavioural claim traces to Zomato's README, its consent screen, its maintainers' posts, or a named user report.
Frequently asked questions
Yes. Zomato's own consent screen asks permission to place orders and manage your cart on your behalf, and checkout_cart is the tool that submits one. A maintainer confirms a linked phone number is mandatory for order placement, and a user report on Zomato's tracker describes orders reaching the app after MCP calls. Treat checkout_cart as the approval boundary.
No. Nothing in the 11 listed tools books a table, and Zomato's tracker carries an open feature request for reservations and table bookings that a maintainer answered by saying new features are in the pipeline. The connector covers delivery ordering only, so dining-out booking has to happen in the Zomato app.
Three protocol scopes and one all-or-nothing consent. Zomato's metadata document advertises mcp:tools, mcp:resources and mcp:prompts, which name MCP surfaces rather than Zomato actions. The consent screen then bundles four grants into a single button, so agreeing to read your order history also grants placing orders on your behalf.
By UPI QR code, pay later, or cash on delivery. A Zomato maintainer names pay later and cash on delivery alongside UPI on the project tracker, and the create_cart tool takes a payment_type parameter whose documented values are upi_qr and pay_later. UPI checkout returns a QR code image for you to scan.
No. The OAuth sign-in page accepts only a ten-digit mobile number behind a fixed +91 India country code, with no country selector and no email field. Zomato's food delivery business operates in India, so menus, addresses, UPI payment and delivery are all India-specific and the connector has no function elsewhere.
Because Zomato allowlists redirect URIs manually and rejects everything else. Its README names six permitted URIs covering Claude, ChatGPT, VS Code and Postman. A maintainer states localhost is disabled over security concerns and that third-party apps are not currently allowed, so an unlisted client cannot complete the flow without Zomato enabling it.
Not right now. Zomato's README states plainly that third-party apps are not being allowed on top of Zomato MCP because of security and legal considerations. A maintainer adds that enabling a client would require a security review. Zomato points individual developers at a personal-use access form instead of a self-service registration flow.
No. There is no update_cart tool and no clear-cart tool among the 11 Anthropic lists, and a user on Zomato's tracker reports there is no option to clear or flush a cart through MCP. Each create_cart call builds a fresh cart instead, so correcting a mistake means creating another one.
Sources
- Zomato MCP server README (retrieved 2026-08-22, HTTP 200; features, install steps, redirect-URI allowlist, example prompts, disclaimer) · retrieved 2026-08-22
- Zomato MCP issue tracker (retrieved 2026-08-22; maintainer statements on order placement, payment methods, allowlisting and third-party access, plus the user bug reports cited above) · retrieved 2026-08-22
- Live auth check: anonymous
initializePOST tohttps://mcp-server.zomato.com/mcpreturned HTTP 401 withWWW-Authenticate: Bearer error="invalid_token"(2026-08-22) · retrieved 2026-08-22 - OAuth metadata at
https://mcp-server.zomato.com/.well-known/oauth-protected-resourceand/.well-known/oauth-authorization-server— identical documents declaring three scopes (2026-08-22) · retrieved 2026-08-22 - Zomato OAuth consent screen (retrieved 2026-08-22, HTTP 200; the four permission lines and the testing-purposes note) · retrieved 2026-08-22
- Eternal Limited privacy policy (retrieved 2026-08-22, HTTP 200; last updated 25 July 2025, no MCP content) · retrieved 2026-08-22
- Zomato API Policy, the legacy REST programme (retrieved 2026-08-22, HTTP 200; last updated 22 April 2020, cited only to rule it out) · retrieved 2026-08-22
- Operator: Eternal Limited (retrieved 2026-08-22, HTTP 200) · retrieved 2026-08-22
- Anthropic Connectors Directory entry — , read from our directory snapshot dated 2026-08-16 · retrieved 2026-08-16
- Zomato support — <mailto:help@zomato.com> · Privacy
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- E-commerce
- Developer
- Zomato
- Tools
- 11
- Domain
- mcp-server.zomato.com
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.
