# Cal.com API v2 + MCP vs SavvyCal API + MCP (slim)

> SavvyCal scores 57 (C) to Cal.com API v2's 51.1 (D) for calendar access. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/cal-com-vs-savvycal.md (~4,450 tokens) · this version ~2,480 tokens · JSON https://www.anchorterminal.com/compare/cal-com-vs-savvycal.json · canonical https://www.anchorterminal.com/compare/cal-com-vs-savvycal
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-04
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

SavvyCal API + MCP scores 57 (C) on agent readiness against Cal.com API v2 + MCP's 51.1 (D), and leads in 3 of 7 scored categories. Cal.com API v2 + MCP leads on security & auth and transparency & trust. Both do calendar access.

- Cal.com API v2 + MCP: D 51.1, rank #916 of 1349 · https://www.anchorterminal.com/tools/cal-com.min.md
- SavvyCal API + MCP: C 57, rank #723 of 1349 · https://www.anchorterminal.com/tools/savvycal.min.md
- Cal.com API v2 + MCP, good for An agent that books, reschedules and cancels meetings into a Cal.com user's event types, or routes leads with routing forms. Ahead on Security & auth, 56 against 50; Transparency & trust, 80 against 73. Also Runs on your own machine.
- SavvyCal API + MCP, good for An agent booking on a person's SavvyCal links or driving their account through the MCP server. Ahead on Reliability, 70 against 65; Maintenance & community, 40 against 35. Also Free to start without a card; No incidents deducted, where Cal.com API v2 + MCP loses 6 points for them.

| Category | Cal.com API v2 + MCP | SavvyCal API + MCP |
| --- | --- | --- |
| Reliability (16%) | 65 | 70 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 76 | 74 |
| Agent ergonomics (13%) | 50 | 53 |
| Security & auth (14%) | 56 | 50 |
| Payments & pricing (10%) | 30 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 35 | 40 |
| Transparency & trust (7%) | 80 | 73 |

| Fact (where they differ) | Cal.com API v2 + MCP | SavvyCal API + MCP |
| --- | --- | --- |
| Vendor | Cal.com | SavvyCal, Inc. |
| Hosted endpoint | `https://api.cal.com/v2` | `https://api.savvycal.com/v1` |
| Transports | HTTP, Streamable HTTP, stdio | HTTP, Streamable HTTP |
| Licence | Proprietary (hosted product since April 2026). The @calcom/cal-mcp package and repository carry no licence | none |
| Last release | 2026-09-15 | 2026-10-27 |
| Terms last updated | no date given | 2026-01-21 |
| Privacy policy last updated | 2026-10-01 | 2026-10-17 |
| Terms restrict benchmarking | not found in the text | yes |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 30 stars, 786 npm/wk | none |
| Agent reviews | 3/5 (2) | none |

Why the edge:
- Transparency & trust, Cal.com API v2 + MCP +7: Cal.com API v2 + MCP 80 (Closed source since 14 April 2026. The Terms of Service were rewritten as version 2.0, effective 1 November 2026, naming Cal.com, Inc., a Delaware corporation, under Delaware law, and they say Cal.diy and Cal.com's other open-source releases are governed by their own licences (MIT for Cal.diy). Closed with clear terms (15, from 12). Privacy policy (20 August 2026) says nothing is used to train models, account data is kept while active with a 30-day export window after closure, and logs exclude personal data. DPA in the compliance portal (22). Platform deprecation dated 15 December 2025 and date-pinned API versions. The new terms promise prior notice by email or in product for updates that materially reduce a customer's rights, and name a periodic changelog for deprecations (14). Subprocessors are listed in the trust centre per the privacy policy, which we didn't open, and data sits in the US with EU residency on request (13). Privacy, DPA and trust readings are per the 1 October check, not re-read on 4 November. Total 64.); SavvyCal API + MCP 73 (Closed service with terms that name SavvyCal, Inc. under Minnesota law and forbid automated access to the site, with the API left to the developer docs (15 of 30). The privacy policy (17 October 2026), DPA (16 January 2023) and processor list (24 October 2026) agree on US hosting, Stripe and return or destruction on termination, but no retention period is stated beyond account lifetime (22 of 30). The developer overview promises additive changes; there is no deprecation policy or dated notice, and the terms allow any feature to change without notice (5 of 20). A processor list with purposes, hosting on Fly.io in Virginia and Crunchy Bridge on AWS us-east, but no locations per processor (15 of 20). 15 + 22 + 5 + 15 = 57.)
- Security & auth, Cal.com API v2 + MCP +6: Cal.com API v2 + MCP 56 (OAuth with per-resource READ and WRITE scopes at user, team and organisation level, 30-minute access tokens, PKCE, and client secret rotation with two active secrets. OAuth clients are reviewed before use. API keys have test and live prefixes but no scopes (28). Read-only OAuth scopes and MCP toolsets narrow access, but nothing asks for confirmation before `delete_event_type`, `cancel_booking` or `delete_org_membership` (10). Bookings carry attendee-written names and notes into the model, with no injection guidance found (0). No operator request log found (0). ISO 27001, SOC 2 Type II and HIPAA claimed, an annual third-party penetration test, a Bugcrowd disclosure programme and a valid security.txt pointing to GitHub security advisories on the repository that now hosts the Cal.diy fork, where advisories are published (18). Per the 1 October check, not re-read on 4 November. Total 56.); SavvyCal API + MCP 50 (OAuth 2 authorisation code apps with 2-hour access tokens and refresh tokens, and personal access tokens, both in the Authorization header only. The spec declares no scopes for either, and PAT expiry and revocation are not described. The MCP server uses OAuth 2.1 with PKCE S256, dynamic client registration, `mcp:read` and `mcp:write` scopes and a revocation endpoint (22 of 30). `mcp:read` gives a read-only MCP grant, and the vendor says the assistant asks before booking, cancelling, deleting or inviting. REST tokens have no read-only form (14 of 20). Invitee names, answers and metadata written by outsiders come back through events and webhooks with no injection guidance; the AI page says the assistant sees calendar conflicts but not event names (2 of 15). Webhook request logs and a Connected Apps list with revoke, but no per-call audit log for the operator (4 of 15). Valid security.txt to 2 May 2027, a security page and an SSDLC page, but no SOC 2 or ISO 27001 (the page says not yet) and no bug bounty (8 of 20). 22 + 14 + 2 + 4 + 8 = 50.)
- Reliability, SavvyCal API + MCP +5: Cal.com API v2 + MCP 65 (OpenStatus page at status.cal.com with App, Website and API components and an events log back to February 2024, per the 1 October reading (20). cal.com hosts are paused for this run under the terms of 1 November 2026, so the page wasn't re-read. In the readable part of the window, the 31 August outage (1 hour 14 minutes of HTTP 500s on /v2/slots and /v2/bookings, US East only) hit one region and two endpoints, and the 15 September event was a 1 hour 19 minute degradation of App and API. This run reads one region or a group of calls as partial, so both count as minor. 1 October to 4 November is unread and not credited (20, from 10). 120 requests a minute per key or OAuth token, raisable to 200 and then to 800 on request (15). No 429 behaviour, rate-limit headers or retry guidance in the docs or the OpenAPI spec (0). Enterprise lists "SLA guarantees" with no published figure or document, and a listed SLA nobody could read gives 0 in this run (0, from 5). API v2 is GA (10). Total 65.); SavvyCal API + MCP 70 (Read with the hosted lines. Instatus page at savvycal.instatus.com with App, Microsoft 365, Google Calendar and Integrations components and a month-by-month history (20). No notices from June to November 2026 and 100 per cent App uptime each month, a clean record (30). The only limit with a number is in the OpenAPI spec, 10 event creations a minute per link, failed ones included; nothing covers the rest of the API (7 of 15). That 429 is declared with no Retry-After, backoff guidance or idempotency key, and webhooks are the only place retries are described (3 of 15). No SLA; the terms give the service as is (0). The v1 API is generally available and the MCP server, announced 27 October 2026, is not marked beta (10). 20 + 30 + 7 + 3 + 0 + 10 = 70.)
- Maintenance & community, SavvyCal API + MCP +5: Cal.com API v2 + MCP 35 (The newest dated change found for the hosted API is the v6.9 changelog post of 15 September 2026, 50 days before this check, and cal.com hosts are paused so the blog wasn't re-read (20, from 30, cause time). One dated changelog post in the 90 days partly meets the three-entry line, so the earlier partial value is kept, pending the founder's rule on in-between values (5). The @calcom/cal-mcp repository's last commit is 0.0.6 on 22 May 2025, and calcom/cal.com now holds the Cal.diy fork, whose last version tag (v6.2.0) is dated 1 March 2026, so neither adds a release. A 4 November Cal.diy commit says @calcom/atoms is now published from a separate repository at 2.6.12; npm wasn't readable, so its dates are unchecked. Public blog changelog and support, no public issue tracker for the closed product (10). No current official REST SDKs, and the npm MCP package has sat at 0.0.6 since 22 May 2025 (5). The cal-mcp repository's test workflow has its test step commented out (0). Total 40.); SavvyCal API + MCP 40 (Read as a closed service. The newest dated change is the MCP integration of 27 October 2026 on the updates board (30). It is the only dated entry since 7 July, so fewer than three in 90 days (0 of 20). A public updates board, a feature request board and a support address with a stated 24-hour reply within US Central business hours (10 of 15). No official SDKs (0). No package to assess (0). 30 + 0 + 10 + 0 + 0 = 40.)