Google Calendar Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Google Calendar Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for Google Calendar - list, create, update, and manage calendar events.
Schedule meetings: "Set up a 30-min sync with Sarah next week" → finds a free slot, creates the event with a Meet link, and sends the invite.
RSVP to invites: "Accept the team offsite but decline the vendor demo" → responds to pending invitations automatically.
Find availability: "When am I free this Thursday afternoon?" → queries your calendar and returns open slots.
Reschedule events: "Move my 1:1 with Alex to Friday at 2pm" → updates the event and notifies attendees.
Daily briefing: "What's on my calendar today?" → lists all events with times, locations, and attendees.
Block focus time: "Block 2 hours tomorrow morning for deep work" → creates a calendar event to protect your time.
(These are just examples - any workflow that needs calendar access can use this.)
http://localhost:3000/callback to Authorized redirect URIsGOOGLE_CLIENT_ID='your-client-id' \
GOOGLE_CLIENT_SECRET='your-client-secret' \
MCP_TRANSPORT=http \
npm startThe server runs on http://localhost:3000 by default. Change with PORT=3001.
With the server running, follow the instructions on install-mcp, which generates the right config for your MCP client (Claude Code, Claude Desktop, Cursor, Cline, VS Code, and more).
This server acts as an OAuth proxy to Google:
graph LR
A[MCP client] <--> B[google-cal-mcp] <--> C[Google OAuth/API]/.well-known/oauth-authorization-server/register returns the Google OAuth client credentials/authorize redirects to Google, encoding the client's callback URL in state/callback receives the code from Google and forwards to the client's callback/token proxies token requests to Google, injecting client credentials/mcp handles MCP requests, using the bearer token to call Calendar APIThe server holds no tokens or state - it just proxies OAuth to Google.
| Tool | Description |
|---|---|
| Calendars | |
calendars_list | List all calendars the user has access to |
calendarlist_insert | Subscribe to a shared calendar |
calendarlist_update | Update calendar settings (color, visibility, reminders) |
calendarlist_delete | Unsubscribe from a calendar |
| Events | |
events_list | List events in a time range with search/filter |
event_get | Get details of a specific event |
event_create | Create a new event with attendees and Meet link |
event_update | Update an existing event |
event_delete | Delete an event |
event_respond | RSVP to an invitation (accept/decline/tentative) |
event_move | Move event to a different calendar |
event_instances | Get instances of a recurring event |
| Availability | |
freebusy_query | Find free/busy times for scheduling |
| Sharing | |
acl_list | List who has access to a calendar |
| Colors | |
colors_get | Get available color palette for calendars/events |
calendar - Full access to calendarscalendar.events - Read/write eventsPull requests are welcomed on GitHub! To get started:
npm installnpm run test to run testsnpm run buildVersions follow the semantic versioning spec.
To release:
npm version <major | minor | patch> to bump the versiongit push --follow-tags to push with tags~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.