{ "data": { "a": { "slug": "cal-com", "name": "Cal.com API v2 + MCP", "vendor": "Cal.com", "vendorUrl": "https://cal.com", "kind": "http-api", "category": "scheduling", "summary": "Scheduling API behind Cal.com's booking pages.", "url": "https://www.anchorterminal.com/tools/cal-com", "markdownUrl": "https://www.anchorterminal.com/tools/cal-com.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cal-com.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cal-com.json", "dns": "cal-com.grade.anchorterminal.com", "repo": "https://github.com/calcom/cal-mcp", "license": "Proprietary (hosted product since April 2026). The @calcom/cal-mcp package and repository carry no licence", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://api.cal.com/v2", "packages": [ { "registry": "npm", "name": "@calcom/cal-mcp" } ], "auth": "mixed", "authNotes": "Bearer API key from Settings, prefixed `cal_` in test mode and `cal_live_` in live mode, or OAuth for integrations used by other Cal.com users. Most endpoints also want a `cal-api-version` header with a date (2024-09-04 for slots). The hosted MCP at mcp.cal.com signs in with OAuth 2.1. The local server reads `CAL_API_KEY`.", "pricing": "freemium", "pricingNotes": "Free plan for one user with unlimited event types and calendars. Teams $12 a user a month and Organizations $28 a user a month, both billed yearly (25 per cent off monthly), each with a 14-day trial. Enterprise is custom and annual. Teams adds round-robin, collective event types and routing forms. The Organizations plan adds sub-teams, SAML SSO, SCIM, domain-wide delegation and more APIs (https://cal.com/pricing). The separate Platform product has been closed to new sign-ups since 15 December 2025 (https://cal.com/docs/api-reference/v2/introduction).", "priceSummary": "$12 / seat-mo", "where": "both", "x402": { "level": "no", "endpoints": [] }, "toolCount": 63, "popularity": { "githubStars": 30, "npmWeekly": 786, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://cal.com/docs/api-reference/v2/introduction", "llmsTxt": "https://cal.com/docs/llms.txt", "openapi": "https://cal.com/docs/api-reference/v2/openapi.json", "capabilities": [ "calendar.read", "calendar.availability", "calendar.booking", "calendar.webhooks" ], "tags": [ "hosted", "freemium", "free-tier", "mcp", "llms-txt", "openapi", "webhooks", "typescript", "closed-source", "enterprise" ], "lastRelease": "2026-09-15", "graded": true, "anchor": { "graded": true, "score": 51.1, "grade": "D", "agentReady": false, "rank": 916, "ranked": true, "rankOf": 1349, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 50, "maintenance": 35, "payments": 30, "reliability": 65, "schema": 76, "security": 56, "transparency": 80 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -6, "negativeNotes": [ "Advisories in the last 12 months on Cal.com's own code from before the April 2026 split, which the hosted service ran, counted one by one, each fixed and over two months old at 1. GHSA-9r3w-4j8q-pw98 (CVE-2025-66489, 3 December 2025, Critical, password check bypassed with a TOTP code, fixed in 5.9.8), GHSA-7hg4-x4pr-3hrg (CVE-2026-23478, 13 January 2026, Critical, account takeover through the NextAuth JWT callback, fixed in 6.0.7), GHSA-qjx2-5xqp-cpf4 (CVE-2025-71389, published 23 July 2026, Critical, unauthenticated code execution through the bundled Next.js, fixed in 5.9.9), GHSA-vgj7-76cw-h6f8 (CVE-2024-58353 and CVE-2024-58355, 23 July 2026, Critical, stored XSS on the booking view including app.cal.com, fixed in 4.7.16) and GHSA-4fwh-xxpv-xfm6 (CVE-2026-16624, 22 July 2026, Critical, webhook creation on any team exposing booking data, fixed by v6.2.0), -5 for the five (https://osv.dev/list?q=calcom).", "2026-08-12. CVE-2026-57858 (VulnCheck, Critical 9.3), stored XSS through the analytics tracking ID in BookingPageTagManager in Cal.com versions 2.1.1 through 6.2.0. Those versions are the code the hosted service ran before the April 2026 split (6.2.0 is dated 1 March 2026), the same shared code as the five advisories above. Third-party Critical records are charged in this run, as on openhands and cline. No fix is listed and the hosted code can't be read, so it costs 1, the value of a fixed Critical over two months old, as a floor. Total -6 (https://osv.dev/vulnerability/CVE-2026-57858)." ], "verdict": "OAuth scopes split into READ and WRITE per resource, with 30-minute access tokens and PKCE, and the hosted MCP's 63 tools load by toolset. No 429 guidance or idempotency key was found, the newest changelog post is from 15 September 2026, and six Critical advisories in shared code were published in 12 months.", "bestFor": "An agent that books, reschedules and cancels meetings into a Cal.com user's event types, or routes leads with routing forms.", "strengths": [ "OAuth scopes split into READ and WRITE per resource, with 30-minute access tokens and PKCE", "Hosted MCP with 63 tools and a `toolsets` parameter to load only the groups needed", "OpenAPI 3.0 spec, llms.txt and Markdown reference pages", "Cursor pagination and filters on bookings by status, attendee, event type and time", "Terms version 2.0 (1 November 2026) promise prior notice of updates that materially reduce customers' rights" ], "weaknesses": [ "120 requests a minute by default and no documented 429 or retry behaviour", "Six Critical advisories on Cal.com's code published between December 2025 and August 2026, one with no fix listed", "Closed source since April 2026, and the npm MCP package hasn't changed since May 2025", "No idempotency key on booking creation, and delete and cancel tools run with no confirmation", "Enterprise mentions SLA guarantees with no published figure or document" ], "agentNotes": [ "Send `cal-api-version: 2026-05-01` on bookings and `2024-09-04` on slots, since each endpoint pins its own version", "Append `?toolsets=bookings,availability` to the hosted MCP URL to skip the other 50-odd tools", "Page bookings with `pagination.nextCursor`, not offsets", "Check for an existing booking before retrying a create, since there's no idempotency key", "Use `cal_` test keys while building so bookings don't reach real calendars" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 51.1 } ], "editorialScores": { "ergonomics": 50, "maintenance": 35, "payments": 30, "reliability": 65, "schema": 76, "security": 56, "transparency": 64 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl \"https://api.cal.com/v2/slots?eventTypeId=123\u0026start=2026-10-01\u0026end=2026-10-02\u0026timeZone=Europe/London\" \\\n -H \"Authorization: Bearer $CAL_API_KEY\" \\\n -H \"cal-api-version: 2024-09-04\"", "claudeCode": "claude mcp add --transport http calcom https://mcp.cal.com/mcp", "config": { "mcpServers": { "calcom": { "args": [ "@calcom/cal-mcp@latest" ], "command": "npx", "env": { "CAL_API_KEY": "${CAL_API_KEY}" } } } } }, "letme": { "capability": "https://letme.dev/calendar.read", "tool": "https://letme.dev/cal-com" }, "area": "everyday", "unitPrices": [ { "item": "Teams", "unit": "seat-month", "usd": 12, "note": "Billed yearly" }, { "item": "Organizations plan", "unit": "seat-month", "usd": 28, "note": "Billed yearly" } ], "provenance": { "legalEntity": "Cal.com, Inc.", "domain": "cal.com", "domainRegistered": "1997-05-16", "domainNote": "cal.com was registered in 1997, long before Cal.com launched, so the domain was bought later.", "endpointOnVendorDomain": true, "terms": "https://cal.com/terms", "privacy": "https://cal.com/privacy", "statusPage": "https://status.cal.com", "changelog": "https://cal.com/blog", "securityTxt": "valid", "checked": "2026-11-04", "notes": [ "The Terms of Service are version 2.0, effective 1 November 2026, between the customer and Cal.com, Inc., a Delaware corporation, under Delaware law. The privacy policy (effective 20 August 2026) gives a San Francisco address, per the 1 October reading.", "security.txt expires 2030-06-01 and lists GitHub security advisories on calcom/cal.com as the contact, a repository that now hosts the Cal.diy fork, per the 1 October reading.", "Release notes are blog posts titled Changelog, the latest found v6.9 on 2026-09-15. cal.com/changelog is a user's booking page, not a changelog.", "cal.com's robots.txt allows the site but /api/, /md/ and app paths and carries Content-Signal ai-train=no, search=yes, ai-input=yes (4 November 2026)." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cal-com.json", "live": { "slug": "cal-com", "probe": { "target": "https://api.cal.com/v2", "method": "get", "lastAt": "2026-11-04T20:46:37.74007334Z", "lastOk": true, "lastStatus": 404, "lastMs": 198, "authRequired": false, "uptime24h": 100, "uptime30d": 99.85, "p50ms24h": 196, "p95ms24h": 491, "samples24h": 246, "samples30d": 8081, "days": [ { "date": "2026-10-04", "probes": 272, "ok": 271 }, { "date": "2026-10-05", "probes": 272, "ok": 271 }, { "date": "2026-10-06", "probes": 272, "ok": 272 }, { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 267 }, { "date": "2026-10-09", "probes": 250, "ok": 248 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 248 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 252 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 252 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 249, "ok": 248 }, { "date": "2026-10-30", "probes": 248, "ok": 248 }, { "date": "2026-10-31", "probes": 251, "ok": 250 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 249 }, { "date": "2026-11-03", "probes": 248, "ok": 247 }, { "date": "2026-11-04", "probes": 214, "ok": 214 } ] }, "vendorStatus": { "page": "https://status.cal.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T17:13:11.252867134Z" }, "versions": [ { "registry": "npm", "name": "@calcom/cal-mcp", "version": "0.0.6", "seenAt": "2026-11-04T20:04:44.249178769Z" } ], "githubStars": 31, "npmWeekly": 369, "securityTxt": { "url": "https://cal.com/.well-known/security.txt", "state": "valid", "expires": "2030-06-01T00:00:00.000Z", "checkedAt": "2026-11-04T15:54:30.312070626Z" }, "llmsTxt": { "url": "https://cal.com/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-04T15:22:15.326556671Z" }, "domain": { "domain": "cal.com", "registered": "1997-05-16", "source": "https://rdap.verisign.com/com/v1/domain/cal.com", "checkedAt": "2026-11-01T14:14:05.126615231Z" }, "pages": [ { "url": "https://cal.com/blog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-04T08:16:11.27132313Z", "changedAt": "2026-11-04T08:16:11.27132313Z", "fingerprint": "51451ff3d61f" }, { "url": "https://cal.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-04T08:16:13.783940382Z", "changedAt": "2026-11-04T08:16:13.783940382Z", "fingerprint": "ca6620205030" }, { "url": "https://cal.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-04T08:16:15.487673021Z", "changedAt": "2026-11-04T08:16:15.487673021Z", "fingerprint": "f56ed83a519e" }, { "url": "https://cal.com/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-04T08:16:17.754301291Z", "changedAt": "2026-11-04T08:16:17.754301291Z", "fingerprint": "67952ab51975" } ], "github": { "repo": "calcom/cal-mcp", "checkedAt": "2026-11-02T08:37:31.392026977Z", "stars": 31, "archived": false, "issuesEnabled": true, "pushedAt": "2025-05-22T20:07:52Z", "openIssues": 6, "openPRs": 3, "issuesOpened90d": 0, "issuesClosed90d": 1, "prsMerged90d": 0, "replies": { "sampled": 7, "unanswered": 6, "medianDays": 158.8 } }, "updatedAt": "2026-11-04T20:46:37.74007334Z" } }, "answer": "SavvyCal API + MCP scores 57 (C) on agent readiness against Cal.com API v2 + MCP's 51.1 (D), and leads in 3 of 7 scored categories. Cal.com API v2 + MCP leads on security \u0026 auth and transparency \u0026 trust.", "b": { "slug": "savvycal", "name": "SavvyCal API + MCP", "vendor": "SavvyCal, Inc.", "vendorUrl": "https://savvycal.com", "kind": "http-api", "category": "scheduling", "summary": "SavvyCal's scheduling API lists and books events on scheduling links, reads open time slots and manages links, webhooks and workflows, with a hosted MCP server that lets an assistant book, move and cancel meetings.", "url": "https://www.anchorterminal.com/tools/savvycal", "markdownUrl": "https://www.anchorterminal.com/tools/savvycal.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/savvycal.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/savvycal.json", "dns": "savvycal.grade.anchorterminal.com", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.savvycal.com/v1", "packages": [], "auth": "mixed", "authNotes": "Personal access tokens (`pt_secret_...`) made in Settings \u003e Developers, or OAuth 2 authorisation code apps registered there, both sent as `Authorization: Bearer`. OAuth access tokens last 2 hours with a refresh token, and the spec declares no scopes for either. The MCP server at https://savvycal.com/mcp signs in with OAuth 2.1 (PKCE S256, dynamic client registration, scopes `mcp:read` and `mcp:write`, a revocation endpoint) and needs no key.", "pricing": "freemium", "pricingNotes": "The API, webhooks and the MCP server are on every plan including Free, per the plans page. Free accounts connect calendars, make links and run polls, but people can only book a link on Basic ($12 a user a month, $120 a year) or Premium ($20 a user a month, $200 a year). No self-serve trial, a 30-day money-back guarantee instead, and no card is mentioned for Free. 25 per cent off for students, educators and nonprofits.", "priceSummary": "$12 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs, the OpenAPI spec at api.savvycal.com/v1/spec or the pricing page (checked 2026-11-03). The spec has no 402 response.", "endpoints": [] }, "toolCount": 63, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://docs.savvycal.com/developers", "llmsTxt": "https://docs.savvycal.com/llms.txt", "openapi": "https://api.savvycal.com/v1/spec", "capabilities": [ "calendar.booking", "calendar.availability", "calendar.read", "calendar.webhooks" ], "tags": [ "hosted", "freemium", "free-tier", "no-card", "mcp", "remote-mcp", "oauth", "llms-txt", "openapi", "webhooks", "status-page", "security-txt", "closed-source" ], "lastRelease": "2026-10-27", "graded": true, "anchor": { "graded": true, "score": 57, "grade": "C", "agentReady": false, "rank": 723, "ranked": true, "rankOf": 1349, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 53, "maintenance": 40, "payments": 30, "reliability": 70, "schema": 74, "security": 50, "transparency": 73 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "A small REST API with a public OpenAPI spec, cursor pagination and signed webhooks, plus a hosted MCP server with 63 tools, OAuth 2.1 and read and write scopes, on every plan. No general rate limit, idempotency key, SDK or certification was found, and booking through a link needs a paid seat.", "bestFor": "An agent booking on a person's SavvyCal links or driving their account through the MCP server.", "strengths": [ "OpenAPI 3.0.0 spec at api.savvycal.com/v1/spec, llms.txt and a Markdown twin of every docs page", "Hosted MCP server with OAuth 2.1, PKCE, dynamic client registration and `mcp:read` and `mcp:write` scopes, included on every plan", "Webhooks signed with HMAC-SHA256, retried up to 20 times with exponential backoff, over 16 event types", "Status page with calendar connection components and no notices from June to November 2026", "The MCP docs say the assistant asks for confirmation before cancelling meetings, deleting links or inviting teammates" ], "weaknesses": [ "No general rate limit documented. The spec names one 429, on creating events (10 a minute per link)", "No idempotency keys, Retry-After header or official SDK", "No SOC 2 or ISO 27001 certification and no bug bounty, per the security page", "OAuth apps and personal access tokens carry no scopes, so a REST token reaches everything the user can", "Only one dated product update in the 90 days to 3 November 2026, and no API changelog" ], "agentNotes": [ "Call GET /v1/links/{link_id}/slots with `from` and `until` (at most 31 days apart) and book only a returned slot; POST /v1/links/{link_id}/events refuses other times with 422", "Keep event creation under 10 requests a minute per link, failed attempts included, or expect 429 with no Retry-After", "Page with the `after` and `before` cursors from `metadata` and `limit` up to 100; an invalid filter value resets every filter to its default", "Connect the MCP server with a client that supports dynamic client registration, and request `mcp:read` when the task only reads", "Verify webhooks with HMAC-SHA256 over the raw body against `x-savvycal-signature` and answer 2xx quickly" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 57 } ], "editorialScores": { "ergonomics": 53, "maintenance": 40, "payments": 30, "reliability": 70, "schema": 74, "security": 50, "transparency": 57 }, "provenanceScore": 89, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl https://api.savvycal.com/v1/me -H \"Authorization: Bearer $SAVVYCAL_TOKEN\"", "claudeCode": "claude mcp add --transport http savvycal https://savvycal.com/mcp", "config": { "mcpServers": { "savvycal": { "url": "https://savvycal.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/calendar.booking", "tool": "https://letme.dev/savvycal" }, "area": "everyday", "unitPrices": [ { "item": "Basic", "unit": "seat-month", "usd": 12, "note": "$120 a user a year billed annually" }, { "item": "Premium", "unit": "seat-month", "usd": 20, "note": "$200 a user a year billed annually" } ], "provenance": { "legalEntity": "SavvyCal, Inc.", "domain": "savvycal.com", "domainRegistered": "2020-08-12", "endpointOnVendorDomain": true, "terms": "https://savvycal.com/terms", "privacy": "https://savvycal.com/privacy", "statusPage": "https://savvycal.instatus.com", "changelog": "https://feedback.savvycal.com/updates", "securityTxt": "valid", "checked": "2026-11-03", "notes": [ "The terms (last updated 21 January 2026) name SavvyCal, Inc. under Minnesota law with AAA arbitration. They forbid access through automated or non-human means and the use of bots, scrapers or data-extraction tools, and do not mention the API, which the separate developer docs cover. Recorded as a fact; the public pages were read.", "savvycal.com/robots.txt disallows /events/ for every crawler, names ClaudeBot and anthropic-ai among twelve AI crawlers with the same rule, and sets Content-Signal ai-train=no, search=yes, ai-input=yes. docs.savvycal.com allows all with ai-train=yes. Nothing under /events/ was fetched.", "The privacy policy (17 October 2026) names SavvyCal, Inc., US servers, Stripe, OpenAI for advertising measurement, and a DPA with Standard Contractual Clauses. The DPA page is dated 16 January 2023.", "RDAP gives savvycal.com a registration date of 12 August 2020.", "security.txt at savvycal.com/.well-known/security.txt names security@savvycal.com, expires 2 May 2027 and points to savvycal.com/security.", "The status page is savvycal.instatus.com (Instatus), linked from the site footer. The What's New board at feedback.savvycal.com/updates is the product changelog." ], "score": 89 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/savvycal.json", "live": { "slug": "savvycal", "probe": { "target": "https://api.savvycal.com/v1", "method": "get", "lastAt": "2026-11-04T20:47:12.690996861Z", "lastOk": true, "lastStatus": 404, "lastMs": 286, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 166, "p95ms24h": 244, "samples24h": 55, "samples30d": 55, "days": [ { "date": "2026-11-04", "probes": 55, "ok": 55 } ] }, "vendorStatus": { "page": "https://savvycal.instatus.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T15:32:34.395223761Z" }, "securityTxt": { "url": "https://savvycal.com/.well-known/security.txt", "state": "valid", "expires": "2027-05-03T00:00:00.000Z", "checkedAt": "2026-11-04T15:54:05.808454415Z" }, "updatedAt": "2026-11-04T20:47:12.690996861Z" } }, "edges": [ { "by": 7, "category": "transparency", "leads": "cal-com", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed source since 14 April 2026. The Terms of Service were rewritten as version 2.0, effective 1 November 2026, naming Cal.com, Inc., a Delaware corporation, under Delaware law, and they say Cal.diy and Cal.com's other open-source releases are governed by their own licences (MIT for Cal.diy). Closed with clear terms (15, from 12). Privacy policy (20 August 2026) says nothing is used to train models, account data is kept while active with a 30-day export window after closure, and logs exclude personal data. DPA in the compliance portal (22). Platform deprecation dated 15 December 2025 and date-pinned API versions. The new terms promise prior notice by email or in product for updates that materially reduce a customer's rights, and name a periodic changelog for deprecations (14). Subprocessors are listed in the trust centre per the privacy policy, which we didn't open, and data sits in the US with EU residency on request (13). Privacy, DPA and trust readings are per the 1 October check, not re-read on 4 November. Total 64.", "b": "Closed service with terms that name SavvyCal, Inc. under Minnesota law and forbid automated access to the site, with the API left to the developer docs (15 of 30). The privacy policy (17 October 2026), DPA (16 January 2023) and processor list (24 October 2026) agree on US hosting, Stripe and return or destruction on termination, but no retention period is stated beyond account lifetime (22 of 30). The developer overview promises additive changes; there is no deprecation policy or dated notice, and the terms allow any feature to change without notice (5 of 20). A processor list with purposes, hosting on Fly.io in Virginia and Crunchy Bridge on AWS us-east, but no locations per processor (15 of 20). 15 + 22 + 5 + 15 = 57." }, "scores": { "a": 80, "b": 73 } }, { "by": 6, "category": "security", "leads": "cal-com", "name": "Security \u0026 auth", "reasons": { "a": "OAuth with per-resource READ and WRITE scopes at user, team and organisation level, 30-minute access tokens, PKCE, and client secret rotation with two active secrets. OAuth clients are reviewed before use. API keys have test and live prefixes but no scopes (28). Read-only OAuth scopes and MCP toolsets narrow access, but nothing asks for confirmation before `delete_event_type`, `cancel_booking` or `delete_org_membership` (10). Bookings carry attendee-written names and notes into the model, with no injection guidance found (0). No operator request log found (0). ISO 27001, SOC 2 Type II and HIPAA claimed, an annual third-party penetration test, a Bugcrowd disclosure programme and a valid security.txt pointing to GitHub security advisories on the repository that now hosts the Cal.diy fork, where advisories are published (18). Per the 1 October check, not re-read on 4 November. Total 56.", "b": "OAuth 2 authorisation code apps with 2-hour access tokens and refresh tokens, and personal access tokens, both in the Authorization header only. The spec declares no scopes for either, and PAT expiry and revocation are not described. The MCP server uses OAuth 2.1 with PKCE S256, dynamic client registration, `mcp:read` and `mcp:write` scopes and a revocation endpoint (22 of 30). `mcp:read` gives a read-only MCP grant, and the vendor says the assistant asks before booking, cancelling, deleting or inviting. REST tokens have no read-only form (14 of 20). Invitee names, answers and metadata written by outsiders come back through events and webhooks with no injection guidance; the AI page says the assistant sees calendar conflicts but not event names (2 of 15). Webhook request logs and a Connected Apps list with revoke, but no per-call audit log for the operator (4 of 15). Valid security.txt to 2 May 2027, a security page and an SSDLC page, but no SOC 2 or ISO 27001 (the page says not yet) and no bug bounty (8 of 20). 22 + 14 + 2 + 4 + 8 = 50." }, "scores": { "a": 56, "b": 50 } }, { "by": 5, "category": "reliability", "leads": "savvycal", "name": "Reliability", "reasons": { "a": "OpenStatus page at status.cal.com with App, Website and API components and an events log back to February 2024, per the 1 October reading (20). cal.com hosts are paused for this run under the terms of 1 November 2026, so the page wasn't re-read. In the readable part of the window, the 31 August outage (1 hour 14 minutes of HTTP 500s on /v2/slots and /v2/bookings, US East only) hit one region and two endpoints, and the 15 September event was a 1 hour 19 minute degradation of App and API. This run reads one region or a group of calls as partial, so both count as minor. 1 October to 4 November is unread and not credited (20, from 10). 120 requests a minute per key or OAuth token, raisable to 200 and then to 800 on request (15). No 429 behaviour, rate-limit headers or retry guidance in the docs or the OpenAPI spec (0). Enterprise lists \"SLA guarantees\" with no published figure or document, and a listed SLA nobody could read gives 0 in this run (0, from 5). API v2 is GA (10). Total 65.", "b": "Read with the hosted lines. Instatus page at savvycal.instatus.com with App, Microsoft 365, Google Calendar and Integrations components and a month-by-month history (20). No notices from June to November 2026 and 100 per cent App uptime each month, a clean record (30). The only limit with a number is in the OpenAPI spec, 10 event creations a minute per link, failed ones included; nothing covers the rest of the API (7 of 15). That 429 is declared with no Retry-After, backoff guidance or idempotency key, and webhooks are the only place retries are described (3 of 15). No SLA; the terms give the service as is (0). The v1 API is generally available and the MCP server, announced 27 October 2026, is not marked beta (10). 20 + 30 + 7 + 3 + 0 + 10 = 70." }, "scores": { "a": 65, "b": 70 } }, { "by": 5, "category": "maintenance", "leads": "savvycal", "name": "Maintenance \u0026 community", "reasons": { "a": "The newest dated change found for the hosted API is the v6.9 changelog post of 15 September 2026, 50 days before this check, and cal.com hosts are paused so the blog wasn't re-read (20, from 30, cause time). One dated changelog post in the 90 days partly meets the three-entry line, so the earlier partial value is kept, pending the founder's rule on in-between values (5). The @calcom/cal-mcp repository's last commit is 0.0.6 on 22 May 2025, and calcom/cal.com now holds the Cal.diy fork, whose last version tag (v6.2.0) is dated 1 March 2026, so neither adds a release. A 4 November Cal.diy commit says @calcom/atoms is now published from a separate repository at 2.6.12; npm wasn't readable, so its dates are unchecked. Public blog changelog and support, no public issue tracker for the closed product (10). No current official REST SDKs, and the npm MCP package has sat at 0.0.6 since 22 May 2025 (5). The cal-mcp repository's test workflow has its test step commented out (0). Total 40.", "b": "Read as a closed service. The newest dated change is the MCP integration of 27 October 2026 on the updates board (30). It is the only dated entry since 7 July, so fewer than three in 90 days (0 of 20). A public updates board, a feature request board and a support address with a stated 24-hour reply within US Central business hours (10 of 15). No official SDKs (0). No package to assess (0). 30 + 0 + 10 + 0 + 0 = 40." }, "scores": { "a": 35, "b": 40 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Cal.com", "b": "SavvyCal, Inc.", "name": "Vendor" }, { "a": "https://api.cal.com/v2", "b": "https://api.savvycal.com/v1", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP, stdio", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary (hosted product since April 2026). The @calcom/cal-mcp package and repository carry no licence", "b": "none", "name": "Licence" }, { "a": "63", "b": "63", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-09-15", "b": "2026-10-27", "name": "Last release" }, { "a": "no date given", "b": "2026-01-21", "name": "Terms last updated" }, { "a": "2026-10-01", "b": "2026-10-17", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "30 stars, 786 npm/wk", "b": "none", "name": "Popularity" }, { "a": "3/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "SavvyCal API + MCP scores 57 (C) on agent readiness against Cal.com API v2 + MCP's 51.1 (D), and leads in 3 of 7 scored categories. Cal.com API v2 + MCP leads on security \u0026 auth and transparency \u0026 trust.", "question": "Which is better for AI agents, Cal.com API v2 + MCP or SavvyCal API + MCP?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do Cal.com API v2 + MCP and SavvyCal API + MCP need an API key?" }, { "answer": "Yes. Cal.com API v2 + MCP has a hosted endpoint at https://api.cal.com/v2 and SavvyCal API + MCP at https://api.savvycal.com/v1.", "question": "Can an agent call Cal.com API v2 + MCP and SavvyCal API + MCP without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Security \u0026 auth, 56 against 50", "Transparency \u0026 trust, 80 against 73" ], "also": [ "Runs on your own machine" ], "goodFor": "An agent that books, reschedules and cancels meetings into a Cal.com user's event types, or routes leads with routing forms.", "slug": "cal-com", "watchFor": "120 requests a minute by default and no documented 429 or retry behaviour" }, { "aheadOn": [ "Reliability, 70 against 65", "Maintenance \u0026 community, 40 against 35" ], "also": [ "Free to start without a card", "No incidents deducted, where Cal.com API v2 + MCP loses 6 points for them" ], "goodFor": "An agent booking on a person's SavvyCal links or driving their account through the MCP server.", "slug": "savvycal", "watchFor": "No general rate limit documented. The spec names one 429, on creating events (10 a minute per link)" } ], "history": { "cal-com": [ { "causes": [ "terms", "correction", "time" ], "date": "2026-11-04", "delta": -6.1, "from": 57.2, "fromGrade": "C", "to": 51.1, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.3, "from": 57.5, "fromGrade": "C", "to": 57.2, "toGrade": "C" } ], "savvycal": null }, "job": { "capability": "calendar.read", "name": "Calendar access" }, "others": [ { "json": "https://www.anchorterminal.com/compare/acuity-scheduling-vs-cal-com.json", "title": "Acuity Scheduling API vs Cal.com API v2 + MCP", "url": "https://www.anchorterminal.com/compare/acuity-scheduling-vs-cal-com" }, { "json": "https://www.anchorterminal.com/compare/acuity-scheduling-vs-savvycal.json", "title": "Acuity Scheduling API vs SavvyCal API + MCP", "url": "https://www.anchorterminal.com/compare/acuity-scheduling-vs-savvycal" }, { "json": "https://www.anchorterminal.com/compare/agenda-hero-vs-cal-com.json", "title": "Agenda Hero vs Cal.com API v2 + MCP", "url": "https://www.anchorterminal.com/compare/agenda-hero-vs-cal-com" }, { "json": "https://www.anchorterminal.com/compare/agenda-hero-vs-savvycal.json", "title": "Agenda Hero vs SavvyCal API + MCP", "url": "https://www.anchorterminal.com/compare/agenda-hero-vs-savvycal" }, { "json": "https://www.anchorterminal.com/compare/apiroc-vs-cal-com.json", "title": "Apiroc Unified Calendar API vs Cal.com API v2 + MCP", "url": "https://www.anchorterminal.com/compare/apiroc-vs-cal-com" }, { "json": "https://www.anchorterminal.com/compare/apiroc-vs-savvycal.json", "title": "Apiroc Unified Calendar API vs SavvyCal API + MCP", "url": "https://www.anchorterminal.com/compare/apiroc-vs-savvycal" }, { "json": "https://www.anchorterminal.com/compare/aurinko-calendar-vs-cal-com.json", "title": "Aurinko Calendar API vs Cal.com API v2 + MCP", "url": "https://www.anchorterminal.com/compare/aurinko-calendar-vs-cal-com" }, { "json": "https://www.anchorterminal.com/compare/aurinko-calendar-vs-savvycal.json", "title": "Aurinko Calendar API vs SavvyCal API + MCP", "url": "https://www.anchorterminal.com/compare/aurinko-calendar-vs-savvycal" }, { "json": "https://www.anchorterminal.com/compare/cal-com-vs-calendly.json", "title": "Cal.com API v2 + MCP vs Calendly API + MCP", "url": "https://www.anchorterminal.com/compare/cal-com-vs-calendly" }, { "json": "https://www.anchorterminal.com/compare/cal-com-vs-cozi.json", "title": "Cal.com API v2 + MCP vs Cozi Family Organizer", "url": "https://www.anchorterminal.com/compare/cal-com-vs-cozi" }, { "json": "https://www.anchorterminal.com/compare/cal-com-vs-cronofy.json", "title": "Cal.com API v2 + MCP vs Cronofy API", "url": "https://www.anchorterminal.com/compare/cal-com-vs-cronofy" }, { "json": "https://www.anchorterminal.com/compare/cal-com-vs-google-calendar-api.json", "title": "Cal.com API v2 + MCP vs Google Calendar API", "url": "https://www.anchorterminal.com/compare/cal-com-vs-google-calendar-api" }, { "json": "https://www.anchorterminal.com/compare/cal-com-vs-microsoft-graph-calendar.json", "title": "Cal.com API v2 + MCP vs Microsoft Graph Calendar API", "url": "https://www.anchorterminal.com/compare/cal-com-vs-microsoft-graph-calendar" }, { "json": "https://www.anchorterminal.com/compare/cal-com-vs-nylas-calendar.json", "title": "Cal.com API v2 + MCP vs Nylas Calendar and Scheduler API", "url": "https://www.anchorterminal.com/compare/cal-com-vs-nylas-calendar" }, { "json": "https://www.anchorterminal.com/compare/cal-com-vs-zoom-scheduler.json", "title": "Cal.com API v2 + MCP vs Zoom Scheduler API", "url": "https://www.anchorterminal.com/compare/cal-com-vs-zoom-scheduler" }, { "json": "https://www.anchorterminal.com/compare/calendly-vs-savvycal.json", "title": "Calendly API + MCP vs SavvyCal API + MCP", "url": "https://www.anchorterminal.com/compare/calendly-vs-savvycal" }, { "json": "https://www.anchorterminal.com/compare/cozi-vs-savvycal.json", "title": "Cozi Family Organizer vs SavvyCal API + MCP", "url": "https://www.anchorterminal.com/compare/cozi-vs-savvycal" }, { "json": "https://www.anchorterminal.com/compare/cronofy-vs-savvycal.json", "title": "Cronofy API vs SavvyCal API + MCP", "url": "https://www.anchorterminal.com/compare/cronofy-vs-savvycal" }, { "json": "https://www.anchorterminal.com/compare/google-calendar-api-vs-savvycal.json", "title": "Google Calendar API vs SavvyCal API + MCP", "url": "https://www.anchorterminal.com/compare/google-calendar-api-vs-savvycal" }, { "json": "https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-savvycal.json", "title": "Microsoft Graph Calendar API vs SavvyCal API + MCP", "url": "https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-savvycal" }, { "json": "https://www.anchorterminal.com/compare/nylas-calendar-vs-savvycal.json", "title": "Nylas Calendar and Scheduler API vs SavvyCal API + MCP", "url": "https://www.anchorterminal.com/compare/nylas-calendar-vs-savvycal" }, { "json": "https://www.anchorterminal.com/compare/cal-com-vs-youcanbookme.json", "title": "Cal.com API v2 + MCP vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/cal-com-vs-youcanbookme" }, { "json": "https://www.anchorterminal.com/compare/savvycal-vs-youcanbookme.json", "title": "SavvyCal API + MCP vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/savvycal-vs-youcanbookme" }, { "json": "https://www.anchorterminal.com/compare/savvycal-vs-zoom-scheduler.json", "title": "SavvyCal API + MCP vs Zoom Scheduler API", "url": "https://www.anchorterminal.com/compare/savvycal-vs-zoom-scheduler" } ], "panel": null, "scores": [ { "by": 5, "cal-com": 65, "edge": "savvycal", "key": "reliability", "name": "Reliability", "savvycal": 70, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 2, "cal-com": 76, "edge": "cal-com", "key": "schema", "name": "Schema \u0026 documentation", "savvycal": 74, "weight": 13 }, { "by": 3, "cal-com": 50, "edge": "savvycal", "key": "ergonomics", "name": "Agent ergonomics", "savvycal": 53, "weight": 13 }, { "by": 6, "cal-com": 56, "edge": "cal-com", "key": "security", "name": "Security \u0026 auth", "savvycal": 50, "weight": 14 }, { "by": 0, "cal-com": 30, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "savvycal": 30, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 5, "cal-com": 35, "edge": "savvycal", "key": "maintenance", "name": "Maintenance \u0026 community", "savvycal": 40, "weight": 7 }, { "by": 7, "cal-com": 80, "edge": "cal-com", "key": "transparency", "name": "Transparency \u0026 trust", "savvycal": 73, "weight": 7 } ], "summary": "SavvyCal API + MCP scores 57 (C) on agent readiness against Cal.com API v2 + MCP's 51.1 (D), and leads in 3 of 7 scored categories. Cal.com API v2 + MCP leads on security \u0026 auth and transparency \u0026 trust. Both do calendar access.", "tasks": null, "tutorials": [], "verdicts": { "cal-com": "OAuth scopes split into READ and WRITE per resource, with 30-minute access tokens and PKCE, and the hosted MCP's 63 tools load by toolset. No 429 guidance or idempotency key was found, the newest changelog post is from 15 September 2026, and six Critical advisories in shared code were published in 12 months.", "savvycal": "A small REST API with a public OpenAPI spec, cursor pagination and signed webhooks, plus a hosted MCP server with 63 tools, OAuth 2.1 and read and write scopes, on every plan. No general rate limit, idempotency key, SDK or certification was found, and booking through a link needs a paid seat." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cal-com-vs-savvycal", "json": "https://www.anchorterminal.com/compare/cal-com-vs-savvycal.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cal-com-vs-savvycal.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/cal-com-vs-savvycal.min.md" }, "markdown": "SavvyCal API + MCP scores 57 (C) on agent readiness against Cal.com API v2 + MCP's 51.1 (D), and leads in 3 of 7 scored categories. Cal.com API v2 + MCP leads on security \u0026 auth and transparency \u0026 trust. Both do calendar access.\n\n- Cal.com API v2 + MCP: grade D, 51.1/100, rank #916 of 1349. Markdown https://www.anchorterminal.com/tools/cal-com.md · JSON https://www.anchorterminal.com/api/v1/tools/cal-com.json\n- SavvyCal API + MCP: grade C, 57/100, rank #723 of 1349. Markdown https://www.anchorterminal.com/tools/savvycal.md · JSON https://www.anchorterminal.com/api/v1/tools/savvycal.json\n- Best calendar and scheduling APIs for AI agents: https://www.anchorterminal.com/best/scheduling/index.md\n- All 89 scheduling comparisons: https://www.anchorterminal.com/compare/scheduling/index.md\n\n## Which one, for what\n\n### Cal.com API v2 + MCP (D)\n\nGood for: An agent that books, reschedules and cancels meetings into a Cal.com user's event types, or routes leads with routing forms.\n\nAhead on:\n- Security \u0026 auth, 56 against 50\n- Transparency \u0026 trust, 80 against 73\n\nAlso in its favour:\n- Runs on your own machine\n\nWatch for: 120 requests a minute by default and no documented 429 or retry behaviour\n\n### SavvyCal API + MCP (C)\n\nGood for: An agent booking on a person's SavvyCal links or driving their account through the MCP server.\n\nAhead on:\n- Reliability, 70 against 65\n- Maintenance \u0026 community, 40 against 35\n\nAlso in its favour:\n- Free to start without a card\n- No incidents deducted, where Cal.com API v2 + MCP loses 6 points for them\n\nWatch for: No general rate limit documented. The spec names one 429, on creating events (10 a minute per link)\n\n\n## Why the edge\n\n### Transparency \u0026 trust: Cal.com API v2 + MCP +7\n\n- Cal.com API v2 + MCP (80): Closed source since 14 April 2026. The Terms of Service were rewritten as version 2.0, effective 1 November 2026, naming Cal.com, Inc., a Delaware corporation, under Delaware law, and they say Cal.diy and Cal.com's other open-source releases are governed by their own licences (MIT for Cal.diy). Closed with clear terms (15, from 12). Privacy policy (20 August 2026) says nothing is used to train models, account data is kept while active with a 30-day export window after closure, and logs exclude personal data. DPA in the compliance portal (22). Platform deprecation dated 15 December 2025 and date-pinned API versions. The new terms promise prior notice by email or in product for updates that materially reduce a customer's rights, and name a periodic changelog for deprecations (14). Subprocessors are listed in the trust centre per the privacy policy, which we didn't open, and data sits in the US with EU residency on request (13). Privacy, DPA and trust readings are per the 1 October check, not re-read on 4 November. Total 64.\n- SavvyCal API + MCP (73): Closed service with terms that name SavvyCal, Inc. under Minnesota law and forbid automated access to the site, with the API left to the developer docs (15 of 30). The privacy policy (17 October 2026), DPA (16 January 2023) and processor list (24 October 2026) agree on US hosting, Stripe and return or destruction on termination, but no retention period is stated beyond account lifetime (22 of 30). The developer overview promises additive changes; there is no deprecation policy or dated notice, and the terms allow any feature to change without notice (5 of 20). A processor list with purposes, hosting on Fly.io in Virginia and Crunchy Bridge on AWS us-east, but no locations per processor (15 of 20). 15 + 22 + 5 + 15 = 57.\n\n### Security \u0026 auth: Cal.com API v2 + MCP +6\n\n- Cal.com API v2 + MCP (56): OAuth with per-resource READ and WRITE scopes at user, team and organisation level, 30-minute access tokens, PKCE, and client secret rotation with two active secrets. OAuth clients are reviewed before use. API keys have test and live prefixes but no scopes (28). Read-only OAuth scopes and MCP toolsets narrow access, but nothing asks for confirmation before `delete_event_type`, `cancel_booking` or `delete_org_membership` (10). Bookings carry attendee-written names and notes into the model, with no injection guidance found (0). No operator request log found (0). ISO 27001, SOC 2 Type II and HIPAA claimed, an annual third-party penetration test, a Bugcrowd disclosure programme and a valid security.txt pointing to GitHub security advisories on the repository that now hosts the Cal.diy fork, where advisories are published (18). Per the 1 October check, not re-read on 4 November. Total 56.\n- SavvyCal API + MCP (50): OAuth 2 authorisation code apps with 2-hour access tokens and refresh tokens, and personal access tokens, both in the Authorization header only. The spec declares no scopes for either, and PAT expiry and revocation are not described. The MCP server uses OAuth 2.1 with PKCE S256, dynamic client registration, `mcp:read` and `mcp:write` scopes and a revocation endpoint (22 of 30). `mcp:read` gives a read-only MCP grant, and the vendor says the assistant asks before booking, cancelling, deleting or inviting. REST tokens have no read-only form (14 of 20). Invitee names, answers and metadata written by outsiders come back through events and webhooks with no injection guidance; the AI page says the assistant sees calendar conflicts but not event names (2 of 15). Webhook request logs and a Connected Apps list with revoke, but no per-call audit log for the operator (4 of 15). Valid security.txt to 2 May 2027, a security page and an SSDLC page, but no SOC 2 or ISO 27001 (the page says not yet) and no bug bounty (8 of 20). 22 + 14 + 2 + 4 + 8 = 50.\n\n### Reliability: SavvyCal API + MCP +5\n\n- Cal.com API v2 + MCP (65): OpenStatus page at status.cal.com with App, Website and API components and an events log back to February 2024, per the 1 October reading (20). cal.com hosts are paused for this run under the terms of 1 November 2026, so the page wasn't re-read. In the readable part of the window, the 31 August outage (1 hour 14 minutes of HTTP 500s on /v2/slots and /v2/bookings, US East only) hit one region and two endpoints, and the 15 September event was a 1 hour 19 minute degradation of App and API. This run reads one region or a group of calls as partial, so both count as minor. 1 October to 4 November is unread and not credited (20, from 10). 120 requests a minute per key or OAuth token, raisable to 200 and then to 800 on request (15). No 429 behaviour, rate-limit headers or retry guidance in the docs or the OpenAPI spec (0). Enterprise lists \"SLA guarantees\" with no published figure or document, and a listed SLA nobody could read gives 0 in this run (0, from 5). API v2 is GA (10). Total 65.\n- SavvyCal API + MCP (70): Read with the hosted lines. Instatus page at savvycal.instatus.com with App, Microsoft 365, Google Calendar and Integrations components and a month-by-month history (20). No notices from June to November 2026 and 100 per cent App uptime each month, a clean record (30). The only limit with a number is in the OpenAPI spec, 10 event creations a minute per link, failed ones included; nothing covers the rest of the API (7 of 15). That 429 is declared with no Retry-After, backoff guidance or idempotency key, and webhooks are the only place retries are described (3 of 15). No SLA; the terms give the service as is (0). The v1 API is generally available and the MCP server, announced 27 October 2026, is not marked beta (10). 20 + 30 + 7 + 3 + 0 + 10 = 70.\n\n### Maintenance \u0026 community: SavvyCal API + MCP +5\n\n- Cal.com API v2 + MCP (35): The newest dated change found for the hosted API is the v6.9 changelog post of 15 September 2026, 50 days before this check, and cal.com hosts are paused so the blog wasn't re-read (20, from 30, cause time). One dated changelog post in the 90 days partly meets the three-entry line, so the earlier partial value is kept, pending the founder's rule on in-between values (5). The @calcom/cal-mcp repository's last commit is 0.0.6 on 22 May 2025, and calcom/cal.com now holds the Cal.diy fork, whose last version tag (v6.2.0) is dated 1 March 2026, so neither adds a release. A 4 November Cal.diy commit says @calcom/atoms is now published from a separate repository at 2.6.12; npm wasn't readable, so its dates are unchecked. Public blog changelog and support, no public issue tracker for the closed product (10). No current official REST SDKs, and the npm MCP package has sat at 0.0.6 since 22 May 2025 (5). The cal-mcp repository's test workflow has its test step commented out (0). Total 40.\n- SavvyCal API + MCP (40): Read as a closed service. The newest dated change is the MCP integration of 27 October 2026 on the updates board (30). It is the only dated entry since 7 July, so fewer than three in 90 days (0 of 20). A public updates board, a feature request board and a support address with a stated 24-hour reply within US Central business hours (10 of 15). No official SDKs (0). No package to assess (0). 30 + 0 + 10 + 0 + 0 = 40.\n\n## Score by category\n\n| Category | Weight | Cal.com API v2 + MCP | SavvyCal API + MCP | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 65 | 70 | SavvyCal API + MCP +5 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 76 | 74 | Cal.com API v2 + MCP +2 |\n| Agent ergonomics | 13% (16.2 this run) | 50 | 53 | SavvyCal API + MCP +3 |\n| Security \u0026 auth | 14% (17.5 this run) | 56 | 50 | Cal.com API v2 + MCP +6 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 30 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 35 | 40 | SavvyCal API + MCP +5 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 80 | 73 | Cal.com API v2 + MCP +7 |\n| Negative events | ≤15 | -6 | 0 | |\n| **Total** | | **51.1 · D** | **57 · C** | |\n\n## Facts side by side\n\n| Fact | Cal.com API v2 + MCP | SavvyCal API + MCP |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Cal.com | SavvyCal, Inc. |\n| Hosted endpoint | `https://api.cal.com/v2` | `https://api.savvycal.com/v1` |\n| Transports | HTTP, Streamable HTTP, stdio | HTTP, Streamable HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | Proprietary (hosted product since April 2026). The @calcom/cal-mcp package and repository carry no licence | none |\n| Tools exposed | 63 | 63 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-09-15 | 2026-10-27 |\n| Terms last updated | no date given | 2026-01-21 |\n| Privacy policy last updated | 2026-10-01 | 2026-10-17 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | yes |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | 30 stars, 786 npm/wk | none |\n| Agent reviews | 3/5 (2) | none |\n\n## How the scores have moved\n\n### Cal.com API v2 + MCP\n\n- -6.1 on 4 November 2026 (C to D): terms, correction, time\n- -0.3 on 8 October 2026: checklist\n\n### SavvyCal API + MCP\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Cal.com API v2 + MCP.** OAuth scopes split into READ and WRITE per resource, with 30-minute access tokens and PKCE, and the hosted MCP's 63 tools load by toolset. No 429 guidance or idempotency key was found, the newest changelog post is from 15 September 2026, and six Critical advisories in shared code were published in 12 months.\n\n**SavvyCal API + MCP.** A small REST API with a public OpenAPI spec, cursor pagination and signed webhooks, plus a hosted MCP server with 63 tools, OAuth 2.1 and read and write scopes, on every plan. No general rate limit, idempotency key, SDK or certification was found, and booking through a link needs a paid seat.\n\n## Before you call either\n\n### Cal.com API v2 + MCP\n\n1. Send `cal-api-version: 2026-05-01` on bookings and `2024-09-04` on slots, since each endpoint pins its own version\n2. Append `?toolsets=bookings,availability` to the hosted MCP URL to skip the other 50-odd tools\n3. Page bookings with `pagination.nextCursor`, not offsets\n4. Check for an existing booking before retrying a create, since there's no idempotency key\n5. Use `cal_` test keys while building so bookings don't reach real calendars\n\n### SavvyCal API + MCP\n\n1. Call GET /v1/links/{link_id}/slots with `from` and `until` (at most 31 days apart) and book only a returned slot; POST /v1/links/{link_id}/events refuses other times with 422\n2. Keep event creation under 10 requests a minute per link, failed attempts included, or expect 429 with no Retry-After\n3. Page with the `after` and `before` cursors from `metadata` and `limit` up to 100; an invalid filter value resets every filter to its default\n4. Connect the MCP server with a client that supports dynamic client registration, and request `mcp:read` when the task only reads\n5. Verify webhooks with HMAC-SHA256 over the raw body against `x-savvycal-signature` and answer 2xx quickly\n\n## Questions\n\n### Which is better for AI agents, Cal.com API v2 + MCP or SavvyCal API + MCP?\n\nSavvyCal API + MCP scores 57 (C) on agent readiness against Cal.com API v2 + MCP's 51.1 (D), and leads in 3 of 7 scored categories. Cal.com API v2 + MCP leads on security \u0026 auth and transparency \u0026 trust.\n\n### Do Cal.com API v2 + MCP and SavvyCal API + MCP need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call Cal.com API v2 + MCP and SavvyCal API + MCP without installing anything?\n\nYes. Cal.com API v2 + MCP has a hosted endpoint at https://api.cal.com/v2 and SavvyCal API + MCP at https://api.savvycal.com/v1.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cal-com-vs-savvycal.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cal-com-vs-savvycal.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cal-com\", \"b\": \"savvycal\"}`. From a terminal: `anchor compare cal-com savvycal`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cal-com.json and https://www.anchorterminal.com/api/v1/tools/savvycal.json\n\n## Other comparisons with Cal.com API v2 + MCP or SavvyCal API + MCP\n\n- [Acuity Scheduling API vs Cal.com API v2 + MCP](https://www.anchorterminal.com/compare/acuity-scheduling-vs-cal-com.md)\n- [Acuity Scheduling API vs SavvyCal API + MCP](https://www.anchorterminal.com/compare/acuity-scheduling-vs-savvycal.md)\n- [Agenda Hero vs Cal.com API v2 + MCP](https://www.anchorterminal.com/compare/agenda-hero-vs-cal-com.md)\n- [Agenda Hero vs SavvyCal API + MCP](https://www.anchorterminal.com/compare/agenda-hero-vs-savvycal.md)\n- [Apiroc Unified Calendar API vs Cal.com API v2 + MCP](https://www.anchorterminal.com/compare/apiroc-vs-cal-com.md)\n- [Apiroc Unified Calendar API vs SavvyCal API + MCP](https://www.anchorterminal.com/compare/apiroc-vs-savvycal.md)\n- [Aurinko Calendar API vs Cal.com API v2 + MCP](https://www.anchorterminal.com/compare/aurinko-calendar-vs-cal-com.md)\n- [Aurinko Calendar API vs SavvyCal API + MCP](https://www.anchorterminal.com/compare/aurinko-calendar-vs-savvycal.md)\n- [Cal.com API v2 + MCP vs Calendly API + MCP](https://www.anchorterminal.com/compare/cal-com-vs-calendly.md)\n- [Cal.com API v2 + MCP vs Cozi Family Organizer](https://www.anchorterminal.com/compare/cal-com-vs-cozi.md)\n- [Cal.com API v2 + MCP vs Cronofy API](https://www.anchorterminal.com/compare/cal-com-vs-cronofy.md)\n- [Cal.com API v2 + MCP vs Google Calendar API](https://www.anchorterminal.com/compare/cal-com-vs-google-calendar-api.md)\n- [Cal.com API v2 + MCP vs Microsoft Graph Calendar API](https://www.anchorterminal.com/compare/cal-com-vs-microsoft-graph-calendar.md)\n- [Cal.com API v2 + MCP vs Nylas Calendar and Scheduler API](https://www.anchorterminal.com/compare/cal-com-vs-nylas-calendar.md)\n- [Cal.com API v2 + MCP vs Zoom Scheduler API](https://www.anchorterminal.com/compare/cal-com-vs-zoom-scheduler.md)\n- [Calendly API + MCP vs SavvyCal API + MCP](https://www.anchorterminal.com/compare/calendly-vs-savvycal.md)\n- [Cozi Family Organizer vs SavvyCal API + MCP](https://www.anchorterminal.com/compare/cozi-vs-savvycal.md)\n- [Cronofy API vs SavvyCal API + MCP](https://www.anchorterminal.com/compare/cronofy-vs-savvycal.md)\n- [Google Calendar API vs SavvyCal API + MCP](https://www.anchorterminal.com/compare/google-calendar-api-vs-savvycal.md)\n- [Microsoft Graph Calendar API vs SavvyCal API + MCP](https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-savvycal.md)\n- [Nylas Calendar and Scheduler API vs SavvyCal API + MCP](https://www.anchorterminal.com/compare/nylas-calendar-vs-savvycal.md)\n- [Cal.com API v2 + MCP vs YouCanBookMe API](https://www.anchorterminal.com/compare/cal-com-vs-youcanbookme.md)\n- [SavvyCal API + MCP vs YouCanBookMe API](https://www.anchorterminal.com/compare/savvycal-vs-youcanbookme.md)\n- [SavvyCal API + MCP vs Zoom Scheduler API](https://www.anchorterminal.com/compare/savvycal-vs-zoom-scheduler.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cal.com API v2 + MCP vs SavvyCal API + MCP", "url": "" } ], "description": "SavvyCal scores 57 (C) to Cal.com API v2's 51.1 (D) for calendar access. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Cal.com API v2 + MCP D 51.1", "SavvyCal API + MCP C 57", "scores" ], "h1": "Cal.com API v2 + MCP vs SavvyCal API + MCP", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/cal-com-vs-savvycal", "published": "2026-10-01", "section": "tools", "title": "Cal.com API v2 vs SavvyCal for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-04", "url": "https://www.anchorterminal.com/compare/cal-com-vs-savvycal" }, "tokens": { "markdown": 4450, "slim": 2480 }, "version": 1 }