Cal Scheduler Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Cal Scheduler Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- mcp-name: io.github.limey/cal-scheduler-mcp -->
If you are an agent installing this MCP, read [AGENTS.md](https://github.com/limey/cal-scheduler-mcp/blob/main/AGENTS.md) first.
A thin, timezone-correct MCP server for scheduling against any CalDAV calendar. It gives an LLM agent a small, strict set of calendar tools and does the deterministic, fiddly parts of iCalendar correctly so the model doesn't have to.
It is not an NLP layer: the agent phrases the request, the server validates it, rejects bad input loudly, and persists clean zoned .ics.
Most calendar tooling an LLM reaches for gets three things subtly wrong. cal-scheduler fixes them by construction:
TZID/VTIMEZONE, so aweekly 9am stays 9am across a daylight-saving boundary instead of drifting an hour. Storing bare UTC is the classic cause of that drift.
RRULE whose anchor contradicts it (e.g.a series starting on the 30th but set to repeat on the 1st), and normalises UNTIL to UTC under a zoned DTSTART as RFC 5545 requires.
EXDATE) or move oneinstance (RECURRENCE-ID) without disturbing the rest of the series — the operations naive wrappers tend to lack.
A small uv Python package that composes mature libraries rather than implementing a calendar engine:
| Module | Role |
|---|---|
config.py | environment config (CALDAV_*, CAL_DEFAULT_TZ) |
timezones.py | parse datetimes; naive → assume default-zone wall time, offset → normalise into the zone; report what was assumed |
ical.py | build/parse VEVENTs (icalendar), expand ranges (recurring-ical-events), recurrence validation, EXDATE/RECURRENCE-ID ops |
store.py | CalDAV transport (caldav) — list/create/delete calendars, get/put/delete events, read-modify-write with etag |
server.py | the FastMCP stdio server and the tool surface |
It runs as a stdio MCP server that an MCP host (Claude, an agent harness, etc.) spawns as a subprocess.
Requires Python ≥ 3.11. The package is on PyPI as cal-scheduler-mcp:
uv tool install cal-scheduler-mcp(or pip install cal-scheduler-mcp, uvx --from cal-scheduler-mcp cal-scheduler, etc.)
For editable dev work, install from a clone:
# run straight from the repo with uv (no global install)
uv run --directory /path/to/cal-scheduler-mcp cal-scheduler
# or install the console script into a tool environment
gh repo clone limey/cal-scheduler-mcp
uv tool install --editable /path/to/cal-scheduler-mcp
# or, with SSH GitHub access, in one step:
uv tool install git+ssh://[email protected]/limey/cal-scheduler-mcpDon'tuv add cal-scheduler-mcpfor the MCP —uv addwrites into whatever project you're sitting in, not into the tool environment. For an MCP server (spawned as a subprocess),uv tool installis the right shape.
All configuration is via environment variables:
| Variable | Required | Default | Meaning |
|---|---|---|---|
CALDAV_BASE_URL | ✅ | — | CalDAV server URL, e.g. http://127.0.0.1:5232 |
CALDAV_USERNAME | — | CalDAV account user | |
CALDAV_PASSWORD | — | CalDAV account password | |
CAL_DEFAULT_TZ | Pacific/Auckland | IANA zone every event is stored in |
Many MCP hosts strip inherited environment from stdio servers, so set these in the host's per-server env block rather than relying on the ambient shell.
The MCP runs as a stdio subprocess that the host spawns. Many hosts strip inherited PATH from that subprocess, so wire the uv run --directory form rather than relying on the cal-scheduler shim being on the spawn host's PATH:
{
"mcpServers": {
"cal-scheduler": {
"command": "uv",
"args": ["run", "--directory", "/abs/path/to/cal-scheduler-mcp", "cal-scheduler"],
"env": {
"CALDAV_BASE_URL": "http://127.0.0.1:5232",
"CALDAV_USERNAME": "me",
"CALDAV_PASSWORD": "secret",
"CAL_DEFAULT_TZ": "Pacific/Auckland"
}
}
}
}/abs/path/to/cal-scheduler-mcp is the absolute path to a local clone of this repo (see Install above).
If you installed from PyPI with uv tool install cal-scheduler-mcp, use the installed shim directly:
{
"mcpServers": {
"cal-scheduler": {
"command": "/path/to/cal-scheduler",
"env": {
"CALDAV_BASE_URL": "http://127.0.0.1:5232",
"CALDAV_USERNAME": "me",
"CALDAV_PASSWORD": "secret",
"CAL_DEFAULT_TZ": "Pacific/Auckland"
}
}
}
}Find the shim path with which cal-scheduler or uv tool list --show-paths.
Pair it with any CalDAV server. A simple self-hosted option is Radicale (plain http://, no TLS needed for local use).
Events — list_events(start, end, [calendar]), create_event(summary, start, [end, calendar, description, location, rrule]), update_event(uid, …), delete_event(uid, [calendar]), exclude_occurrence(uid, occurrence, [calendar]), move_occurrence(uid, occurrence, new_start, [new_end, calendar]), mark_done(uid, [calendar]) — tag an event done and record the timestamp.
Calendars — list_calendars, create_calendar(name), delete_calendar(name).
Helper — resolve_datetime(value) — preview how a datetime will be interpreted, without writing anything.
Every event is stored zoned to CAL_DEFAULT_TZ.
2026-06-30T21:00) is assumed to be wall time in that zone,and the tool response says so ("assumed Pacific/Auckland wall time").
…+12:00) is honoured as an instant andre-expressed in the zone — same wall clock when the offset matches, a correct conversion otherwise.
2026-06-30) is an all-day event.uv sync # install deps + dev tools
uv run ruff check # lint
uv run pytest # unit tests (no server required)The unit tests cover the pure layers (timezone resolution, recurrence validation, EXDATE/RECURRENCE-ID construction) and need no running CalDAV server. To exercise the full stack end to end, point CALDAV_BASE_URL at a throwaway CalDAV account.
MIT © 2026 Robert Clark
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.