Cal.com API v2 + MCP vs SavvyCal API + MCP

Cal.com API v2 + MCP 60

OpenStatus page at status.cal.com with App, Website and API components and an events log back to February 2024 (20). In the last 90 days, a major API outage on 31 August (1 hour 14 minutes of HTTP 500s on /v2/slots and /v2/bookings in US East), a 1 hour 19 minute degradation of App and API on 15 September, and a partial outage of the Atoms endpoint on 21 July (10). 120 requests a minute per key or OAuth token, raisable to 200 and then to 800 on request (15). No 429 behaviour, rate-limit headers or retry guidance in the docs or the OpenAPI spec (0). Enterprise lists "SLA guarantees" with no published figure (5). API v2 is GA (10).

SavvyCal API + MCP 70

Read with the hosted lines. Instatus page at savvycal.instatus.com with App, Microsoft 365, Google Calendar and Integrations components and a month-by-month history (20). No notices from June to November 2026 and 100 per cent App uptime each month, a clean record (30). The only limit with a number is in the OpenAPI spec, 10 event creations a minute per link, failed ones included; nothing covers the rest of the API (7 of 15). That 429 is declared with no Retry-After, backoff guidance or idempotency key, and webhooks are the only place retries are described (3 of 15). No SLA; the terms give the service as is (0). The v1 API is generally available and the MCP server, announced 27 October 2026, is not marked beta (10). 20 + 30 + 7 + 3 + 0 + 10 = 70.

Cal.com API v2 + MCP 50

v6.9 changelog post on 15 September 2026 (30). Only one dated changelog post found between June and September, so partial credit (5). Public blog changelog and support, no public issue tracker for the closed product (10). No current official REST SDKs, and the npm MCP package has sat at 0.0.6 since 22 May 2025 (5). The cal-mcp repository's test workflow has its test step commented out (0).

SavvyCal API + MCP 40

Read as a closed service. The newest dated change is the MCP integration of 27 October 2026 on the updates board (30). It is the only dated entry since 7 July, so fewer than three in 90 days (0 of 20). A public updates board, a feature request board and a support address with a stated 24-hour reply within US Central business hours (10 of 15). No official SDKs (0). No package to assess (0). 30 + 0 + 10 + 0 + 0 = 40.

Cal.com API v2 + MCP 56

OAuth with per-resource READ and WRITE scopes at user, team and organisation level, 30-minute access tokens, PKCE, and client secret rotation with two active secrets. OAuth clients are reviewed before use. API keys have test and live prefixes but no scopes (28). Read-only OAuth scopes and MCP toolsets narrow access, but nothing asks for confirmation before delete_event_type, cancel_booking or delete_org_membership (10). Bookings carry attendee-written names and notes into the model, with no injection guidance found (0). No operator request log found (0). ISO 27001, SOC 2 Type II and HIPAA claimed, an annual third-party penetration test, a Bugcrowd disclosure programme and a valid security.txt, though it points to the repository that now hosts the Cal.diy fork (18).

SavvyCal API + MCP 50

OAuth 2 authorisation code apps with 2-hour access tokens and refresh tokens, and personal access tokens, both in the Authorization header only. The spec declares no scopes for either, and PAT expiry and revocation are not described. The MCP server uses OAuth 2.1 with PKCE S256, dynamic client registration, mcp:read and mcp:write scopes and a revocation endpoint (22 of 30). mcp:read gives a read-only MCP grant, and the vendor says the assistant asks before booking, cancelling, deleting or inviting. REST tokens have no read-only form (14 of 20). Invitee names, answers and metadata written by outsiders come back through events and webhooks with no injection guidance; the AI page says the assistant sees calendar conflicts but not event names (2 of 15). Webhook request logs and a Connected Apps list with revoke, but no per-call audit log for the operator (4 of 15). Valid security.txt to 2 May 2027, a security page and an SSDLC page, but no SOC 2 or ISO 27001 (the page says not yet) and no bug bounty (8 of 20). 22 + 14 + 2 + 4 + 8 = 50.

Cal.com API v2 + MCP 78

Closed source since 14 April 2026, with terms that carry a 2021 effective date and name UK law for a San Francisco company. The security page still describes a self-hosted open-source option, which now means the Cal.diy community fork (12). Privacy policy (20 August 2026) says nothing is used to train models, account data is kept while active with a 30-day export window after closure, and logs exclude personal data. DPA in the compliance portal (22). Platform deprecation dated 15 December 2025 and date-pinned API versions (14). Subprocessors are listed in the trust centre per the privacy policy, which we didn't open, and data sits in the US with EU residency on request (13).

SavvyCal API + MCP 73

Closed service with terms that name SavvyCal, Inc. under Minnesota law and forbid automated access to the site, with the API left to the developer docs (15 of 30). The privacy policy (17 October 2026), DPA (16 January 2023) and processor list (24 October 2026) agree on US hosting, Stripe and return or destruction on termination, but no retention period is stated beyond account lifetime (22 of 30). The developer overview promises additive changes; there is no deprecation policy or dated notice, and the terms allow any feature to change without notice (5 of 20). A processor list with purposes, hosting on Fly.io in Virginia and Crunchy Bridge on AWS us-east, but no locations per processor (15 of 20). 15 + 22 + 5 + 15 = 57.