Aurinko Calendar API vs SavvyCal API + MCP

Aurinko Calendar API 40

Graded as a hosted API. No status page is linked from the site, the docs or the spec, and status.aurinko.io did not resolve (0). With no readable incident history the record scores 5. The spec gives a limit of 250 requests a second (15). It advises exponential backoff on 429 and 5xx and a retry on 408, with no Retry-After header documented and no idempotency keys for event or booking writes (10). No SLA found, and the terms supply the service as is (0). The API is at /v1 with no beta label (10).

SavvyCal API + MCP 70

Read with the hosted lines. Instatus page at savvycal.instatus.com with App, Microsoft 365, Google Calendar and Integrations components and a month-by-month history (20). No notices from June to November 2026 and 100 per cent App uptime each month, a clean record (30). The only limit with a number is in the OpenAPI spec, 10 event creations a minute per link, failed ones included; nothing covers the rest of the API (7 of 15). That 429 is declared with no Retry-After, backoff guidance or idempotency key, and webhooks are the only place retries are described (3 of 15). No SLA; the terms give the service as is (0). The v1 API is generally available and the MCP server, announced 27 October 2026, is not marked beta (10). 20 + 30 + 7 + 3 + 0 + 10 = 70.

Aurinko Calendar API 45

Closed service under a Terms of Services Agreement naming Yoxel, Inc. of California, last updated 11 August 2022 (15). The docs say content is passed through and never stored, with only IDs cached, and the privacy policy commits to Google's Limited Use requirements. The policy gives no retention period, and no DPA was found (12). No deprecation policy or dated notices found (0). No sub-processor list or data location. The security statement names no cloud provider (0).

SavvyCal API + MCP 73

Closed service with terms that name SavvyCal, Inc. under Minnesota law and forbid automated access to the site, with the API left to the developer docs (15 of 30). The privacy policy (17 October 2026), DPA (16 January 2023) and processor list (24 October 2026) agree on US hosting, Stripe and return or destruction on termination, but no retention period is stated beyond account lifetime (22 of 30). The developer overview promises additive changes; there is no deprecation policy or dated notice, and the terms allow any feature to change without notice (5 of 20). A processor list with purposes, hosting on Fly.io in Virginia and Crunchy Bridge on AWS us-east, but no locations per processor (15 of 20). 15 + 22 + 5 + 15 = 57.

Aurinko Calendar API 20

No changelog or release notes found, so no API change can be dated. Docs pages were edited on 22 and 23 September 2026 per the docs sitemap, counted as partial evidence of activity (15). No dated changelog entries (0). Support is by email at support@aurinko.io, with no public forum or issue tracker found (3). No official SDK. aurinko-sdk on npm is unofficial (0). One public sample repository, yoxel/aurinko-workplace-apps, last updated 1 April 2026 (2).

SavvyCal API + MCP 40

Read as a closed service. The newest dated change is the MCP integration of 27 October 2026 on the updates board (30). It is the only dated entry since 7 July, so fewer than three in 90 days (0 of 20). A public updates board, a feature request board and a support address with a stated 24-hour reply within US Central business hours (10 of 15). No official SDKs (0). No package to assess (0). 30 + 0 + 10 + 0 + 0 = 40.

Aurinko Calendar API 40

No x402, MPP or L402 (0). Prices per active account a month published without login, $1, $1.50 and $2 (20). A 14-day trial with no card (20). Signup is in a browser at app.aurinko.io, and each calendar needs its owner's OAuth consent (0).

SavvyCal API + MCP 30

No x402, MPP or L402 (0). Per-seat plan prices public, nothing per call (10). A Free plan with the API, webhooks and MCP server included and no card mentioned, though booking through a link needs Basic or Premium and there is no self-serve trial (20). A person signs up in a browser and approves the OAuth consent (0). 0 + 10 + 20 + 0 = 30.

Aurinko Calendar API 41

Per-user OAuth with 11 scopes, Calendar.Read separate from Calendar.ReadWrite, and DELETE /v1/account/token to revoke. The application's client ID and secret, sent as Basic auth with X-Aurinko-Account-Id, reach every connected account, and the implicit grant is still supported though not recommended (22). A read-only scope exists, with no confirmation step for deletes (12). Event content from third parties is returned with no injection guidance (0). No operator audit log found in the docs (0). A security statement with a reporting address, security@yoxel.com, and penetration tests claimed. SOC 2 is not yet held, with no bug bounty and no security.txt (7). rescheduleToken travels in the query string on booking calls. No deduction, because it is not the API credential.

SavvyCal API + MCP 50

OAuth 2 authorisation code apps with 2-hour access tokens and refresh tokens, and personal access tokens, both in the Authorization header only. The spec declares no scopes for either, and PAT expiry and revocation are not described. The MCP server uses OAuth 2.1 with PKCE S256, dynamic client registration, mcp:read and mcp:write scopes and a revocation endpoint (22 of 30). mcp:read gives a read-only MCP grant, and the vendor says the assistant asks before booking, cancelling, deleting or inviting. REST tokens have no read-only form (14 of 20). Invitee names, answers and metadata written by outsiders come back through events and webhooks with no injection guidance; the AI page says the assistant sees calendar conflicts but not event names (2 of 15). Webhook request logs and a Connected Apps list with revoke, but no per-call audit log for the operator (4 of 15). Valid security.txt to 2 May 2027, a security page and an SSDLC page, but no SOC 2 or ISO 27001 (the page says not yet) and no bug bounty (8 of 20). 22 + 14 + 2 + 4 + 8 = 50.

Aurinko Calendar API 66

Public OpenAPI 3.0.0 spec with 112 paths and 154 operations (25). llms.txt and a Markdown copy of every docs page (10). Every operation has a summary but only 17 have a description, and 193 of 893 schema properties are described (8). Enums appear in 44 of 190 schemas, but only two schemas mark required fields (8). 110 operations carry a cURL sample and the Errors section shows the JSON body, though operations declare only 401 and a default response (10). /v1 in the path and spec version 1.0.0, with no changelog found (5).

SavvyCal API + MCP 74

OpenAPI 3.0.0 at api.savvycal.com/v1/spec covers all 22 operations with 56 schemas; the MCP tools' schemas could not be read without signing in (23 of 25). llms.txt and a Markdown twin of every docs page (10). Only 8 of the 22 operations carry a description, and those state constraints (events must match an open slot, an invalid filter resets every filter) rather than when to choose another endpoint (10 of 20). Required flags on 14 of 43 parameters, 34 enum properties across the schemas, limit bounded 1 to 100, until at most 31 days after from (12 of 15). Example values on parameters and a documented error shape keyed by field, with 400, 401, 404, 422 and 429 declared per operation, but no full response examples (10 of 15). A /v1 path and a promise that changes are additive, with dated product updates on the feedback board but no API changelog (9 of 15). 23 + 10 + 10 + 12 + 10 + 9 = 74.