Calendar Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Calendar Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This project implements a Python-based MCP (Model Context Protocol) server that acts as an interface between Large Language Models (LLMs) and the Google Calendar API. It enables LLMs to perform calendar operations via natural language requests.
mcp_google_calendar_list_calendars).mcp_google_calendar_create_calendar).mcp_google_calendar_find_events).mcp_google_calendar_create_event).mcp_google_calendar_quick_add_event).mcp_google_calendar_update_event).mcp_google_calendar_delete_event).mcp_google_calendar_add_attendee).mcp_google_calendar_check_attendee_status).mcp_google_calendar_query_free_busy).mcp_google_calendar_schedule_mutual).mcp_google_calendar_analyze_busyness).mcp_sdk library. git clone <repository-url> # Replace with your repo URL
cd <repository-directory>.env file. You do not need to download the JSON file offered for other app types.calendar, add the .../auth/calendar scope (read/write access). Click "Update".http://localhost:8080/oauth2callback. Click "Save". (Adjust the port if you change OAUTH_CALLBACK_PORT in .env).env.example file and rename the copy to .env..env file and paste your Client ID and Client Secret obtained from Google Cloud: # Google OAuth 2.0 Client Credentials (from Google Cloud Console - Desktop app type)
GOOGLE_CLIENT_ID='YOUR_GOOGLE_CLIENT_ID_HERE'
GOOGLE_CLIENT_SECRET='YOUR_GOOGLE_CLIENT_SECRET_HERE'
# Path to the file where the user's OAuth tokens will be stored after first auth
# This file is created automatically. Default is .gcp-saved-tokens.json
TOKEN_FILE_PATH='.gcp-saved-tokens.json'
# Port for the local webserver during the OAuth callback (must match Google Cloud redirect URI)
OAUTH_CALLBACK_PORT=8080
# Google Calendar API Scopes (read/write is default)
# Use 'https://www.googleapis.com/auth/calendar.readonly' for read-only access
CALENDAR_SCOPES='https://www.googleapis.com/auth/calendar'TOKEN_FILE_PATH points to a location where the app can write the token file (the default .gcp-saved-tokens.json in the root is usually fine). This file is automatically added to .gitignore. pip install -r requirements.txtYou only need to run the server manually once to complete the initial Google OAuth authentication flow. After that, your MCP client will launch the server automatically using the command specified in its configuration.
python run_server.py.gcp-saved-tokens.json). Since they don't exist yet, it will:http://localhost:8080/oauth2callback)..env (.gcp-saved-tokens.json).http://localhost:8000). You can usually stop it (Ctrl+C) after you see confirmation that tokens were saved or the server has started.curl or Postman), you can run python run_server.py again. It will load the saved tokens and start the server without requiring browser authentication.Note: For regular use with an MCP client, you do not need to run python run_server.py manually after the initial authentication. The client handles launching it.
To use this server as a tool within an MCP client, you need to configure the client to run the run_server.py script. This is typically done in a JSON settings file.
Example `mcp.json` Entry:
{
"tools": {
"google_calendar": {
"command": "python",
"args": [
"C:/path/to/your/calendar-mcp/run_server.py"
]
}
}
}Configuration Details:
python if it's in your system's PATH. If not, provide the full absolute path to the python.exe or python executable (e.g., /path/to/your/venv/bin/python or C:/path/to/your/venv/Scripts/python.exe).run_server.py script in your project directory. Replace the placeholder `/path/to/your/calendar-mcp/run_server.py` with the actual path on your system.api field to point to the underlying FastAPI server (e.g., "api": "http://localhost:8000") for schema discovery, even though communication happens via stdio."timeout": 30000 for 30 seconds).How it Works: When the MCP client invokes this tool, it executes the specified command with the args. The run_server.py script detects it's being run this way (via piped stdin/stdout) and automatically starts the MCP communication bridge instead of just the HTTP server.
Important:
.env file, not in the MCP client configuration.run_server.py: Main entry point, handles server startup and MCP detection.src/server.py: FastAPI application definition, HTTP endpoints.src/calendar_actions.py: Core logic interacting with the Google Calendar API.src/analysis.py: Advanced analysis functions.src/auth.py: Handles OAuth 2.0 authentication flow and token management.src/models.py: Pydantic models for request/response data structures.src/mcp_bridge.py: Implements the MCP tool definitions using mcp_sdk, delegating to the FastAPI server.calendar_mcp.log in the project root.This project is dual-licensed to support both open-source collaboration and sustainable development:
By using, modifying, or distributing this software, you agree to be bound by the terms of either the AGPLv3 or a separately negotiated commercial license.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.