{ "data": { "a": { "slug": "cal-com", "name": "Cal.com API v2 + MCP", "vendor": "Cal.com", "vendorUrl": "https://cal.com", "kind": "http-api", "category": "scheduling", "summary": "Scheduling API behind Cal.com's booking pages.", "url": "https://www.anchorterminal.com/tools/cal-com", "markdownUrl": "https://www.anchorterminal.com/tools/cal-com.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cal-com.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cal-com.json", "dns": "cal-com.grade.anchorterminal.com", "repo": "https://github.com/calcom/cal-mcp", "license": "Proprietary (hosted product since April 2026). The @calcom/cal-mcp package and repository carry no licence", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://api.cal.com/v2", "packages": [ { "registry": "npm", "name": "@calcom/cal-mcp" } ], "auth": "mixed", "authNotes": "Bearer API key from Settings, prefixed `cal_` in test mode and `cal_live_` in live mode, or OAuth for integrations used by other Cal.com users. Most endpoints also want a `cal-api-version` header with a date (2024-09-04 for slots). The hosted MCP at mcp.cal.com signs in with OAuth 2.1. The local server reads `CAL_API_KEY`.", "pricing": "freemium", "pricingNotes": "Free plan for one user with unlimited event types and calendars. Teams $12 a user a month and Organizations $28 a user a month, both billed yearly (25 per cent off monthly), each with a 14-day trial. Enterprise is custom and annual. Teams adds round-robin, collective event types and routing forms. The Organizations plan adds sub-teams, SAML SSO, SCIM, domain-wide delegation and more APIs (https://cal.com/pricing). The separate Platform product has been closed to new sign-ups since 15 December 2025 (https://cal.com/docs/api-reference/v2/introduction).", "priceSummary": "$12 / seat-mo", "where": "both", "x402": { "level": "no", "endpoints": [] }, "toolCount": 63, "popularity": { "githubStars": 30, "npmWeekly": 786, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://cal.com/docs/api-reference/v2/introduction", "llmsTxt": "https://cal.com/docs/llms.txt", "openapi": "https://cal.com/docs/api-reference/v2/openapi.json", "capabilities": [ "calendar.read", "calendar.availability", "calendar.booking", "calendar.webhooks" ], "tags": [ "hosted", "freemium", "free-tier", "mcp", "llms-txt", "openapi", "webhooks", "typescript", "closed-source", "enterprise" ], "lastRelease": "2026-09-15", "graded": true, "anchor": { "graded": true, "score": 51.1, "grade": "D", "agentReady": false, "rank": 916, "ranked": true, "rankOf": 1349, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 50, "maintenance": 35, "payments": 30, "reliability": 65, "schema": 76, "security": 56, "transparency": 80 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -6, "negativeNotes": [ "Advisories in the last 12 months on Cal.com's own code from before the April 2026 split, which the hosted service ran, counted one by one, each fixed and over two months old at 1. GHSA-9r3w-4j8q-pw98 (CVE-2025-66489, 3 December 2025, Critical, password check bypassed with a TOTP code, fixed in 5.9.8), GHSA-7hg4-x4pr-3hrg (CVE-2026-23478, 13 January 2026, Critical, account takeover through the NextAuth JWT callback, fixed in 6.0.7), GHSA-qjx2-5xqp-cpf4 (CVE-2025-71389, published 23 July 2026, Critical, unauthenticated code execution through the bundled Next.js, fixed in 5.9.9), GHSA-vgj7-76cw-h6f8 (CVE-2024-58353 and CVE-2024-58355, 23 July 2026, Critical, stored XSS on the booking view including app.cal.com, fixed in 4.7.16) and GHSA-4fwh-xxpv-xfm6 (CVE-2026-16624, 22 July 2026, Critical, webhook creation on any team exposing booking data, fixed by v6.2.0), -5 for the five (https://osv.dev/list?q=calcom).", "2026-08-12. CVE-2026-57858 (VulnCheck, Critical 9.3), stored XSS through the analytics tracking ID in BookingPageTagManager in Cal.com versions 2.1.1 through 6.2.0. Those versions are the code the hosted service ran before the April 2026 split (6.2.0 is dated 1 March 2026), the same shared code as the five advisories above. Third-party Critical records are charged in this run, as on openhands and cline. No fix is listed and the hosted code can't be read, so it costs 1, the value of a fixed Critical over two months old, as a floor. Total -6 (https://osv.dev/vulnerability/CVE-2026-57858)." ], "verdict": "OAuth scopes split into READ and WRITE per resource, with 30-minute access tokens and PKCE, and the hosted MCP's 63 tools load by toolset. No 429 guidance or idempotency key was found, the newest changelog post is from 15 September 2026, and six Critical advisories in shared code were published in 12 months.", "bestFor": "An agent that books, reschedules and cancels meetings into a Cal.com user's event types, or routes leads with routing forms.", "strengths": [ "OAuth scopes split into READ and WRITE per resource, with 30-minute access tokens and PKCE", "Hosted MCP with 63 tools and a `toolsets` parameter to load only the groups needed", "OpenAPI 3.0 spec, llms.txt and Markdown reference pages", "Cursor pagination and filters on bookings by status, attendee, event type and time", "Terms version 2.0 (1 November 2026) promise prior notice of updates that materially reduce customers' rights" ], "weaknesses": [ "120 requests a minute by default and no documented 429 or retry behaviour", "Six Critical advisories on Cal.com's code published between December 2025 and August 2026, one with no fix listed", "Closed source since April 2026, and the npm MCP package hasn't changed since May 2025", "No idempotency key on booking creation, and delete and cancel tools run with no confirmation", "Enterprise mentions SLA guarantees with no published figure or document" ], "agentNotes": [ "Send `cal-api-version: 2026-05-01` on bookings and `2024-09-04` on slots, since each endpoint pins its own version", "Append `?toolsets=bookings,availability` to the hosted MCP URL to skip the other 50-odd tools", "Page bookings with `pagination.nextCursor`, not offsets", "Check for an existing booking before retrying a create, since there's no idempotency key", "Use `cal_` test keys while building so bookings don't reach real calendars" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 51.1 } ], "editorialScores": { "ergonomics": 50, "maintenance": 35, "payments": 30, "reliability": 65, "schema": 76, "security": 56, "transparency": 64 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl \"https://api.cal.com/v2/slots?eventTypeId=123\u0026start=2026-10-01\u0026end=2026-10-02\u0026timeZone=Europe/London\" \\\n -H \"Authorization: Bearer $CAL_API_KEY\" \\\n -H \"cal-api-version: 2024-09-04\"", "claudeCode": "claude mcp add --transport http calcom https://mcp.cal.com/mcp", "config": { "mcpServers": { "calcom": { "args": [ "@calcom/cal-mcp@latest" ], "command": "npx", "env": { "CAL_API_KEY": "${CAL_API_KEY}" } } } } }, "letme": { "capability": "https://letme.dev/calendar.read", "tool": "https://letme.dev/cal-com" }, "area": "everyday", "unitPrices": [ { "item": "Teams", "unit": "seat-month", "usd": 12, "note": "Billed yearly" }, { "item": "Organizations plan", "unit": "seat-month", "usd": 28, "note": "Billed yearly" } ], "provenance": { "legalEntity": "Cal.com, Inc.", "domain": "cal.com", "domainRegistered": "1997-05-16", "domainNote": "cal.com was registered in 1997, long before Cal.com launched, so the domain was bought later.", "endpointOnVendorDomain": true, "terms": "https://cal.com/terms", "privacy": "https://cal.com/privacy", "statusPage": "https://status.cal.com", "changelog": "https://cal.com/blog", "securityTxt": "valid", "checked": "2026-11-04", "notes": [ "The Terms of Service are version 2.0, effective 1 November 2026, between the customer and Cal.com, Inc., a Delaware corporation, under Delaware law. The privacy policy (effective 20 August 2026) gives a San Francisco address, per the 1 October reading.", "security.txt expires 2030-06-01 and lists GitHub security advisories on calcom/cal.com as the contact, a repository that now hosts the Cal.diy fork, per the 1 October reading.", "Release notes are blog posts titled Changelog, the latest found v6.9 on 2026-09-15. cal.com/changelog is a user's booking page, not a changelog.", "cal.com's robots.txt allows the site but /api/, /md/ and app paths and carries Content-Signal ai-train=no, search=yes, ai-input=yes (4 November 2026)." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cal-com.json", "live": { "slug": "cal-com", "probe": { "target": "https://api.cal.com/v2", "method": "get", "lastAt": "2026-11-04T20:46:37.74007334Z", "lastOk": true, "lastStatus": 404, "lastMs": 198, "authRequired": false, "uptime24h": 100, "uptime30d": 99.85, "p50ms24h": 196, "p95ms24h": 491, "samples24h": 246, "samples30d": 8081, "days": [ { "date": "2026-10-04", "probes": 272, "ok": 271 }, { "date": "2026-10-05", "probes": 272, "ok": 271 }, { "date": "2026-10-06", "probes": 272, "ok": 272 }, { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 267 }, { "date": "2026-10-09", "probes": 250, "ok": 248 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 248 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 252 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 252 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 249, "ok": 248 }, { "date": "2026-10-30", "probes": 248, "ok": 248 }, { "date": "2026-10-31", "probes": 251, "ok": 250 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 249 }, { "date": "2026-11-03", "probes": 248, "ok": 247 }, { "date": "2026-11-04", "probes": 214, "ok": 214 } ] }, "vendorStatus": { "page": "https://status.cal.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T17:13:11.252867134Z" }, "versions": [ { "registry": "npm", "name": "@calcom/cal-mcp", "version": "0.0.6", "seenAt": "2026-11-04T20:04:44.249178769Z" } ], "githubStars": 31, "npmWeekly": 369, "securityTxt": { "url": "https://cal.com/.well-known/security.txt", "state": "valid", "expires": "2030-06-01T00:00:00.000Z", "checkedAt": "2026-11-04T15:54:30.312070626Z" }, "llmsTxt": { "url": "https://cal.com/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-04T15:22:15.326556671Z" }, "domain": { "domain": "cal.com", "registered": "1997-05-16", "source": "https://rdap.verisign.com/com/v1/domain/cal.com", "checkedAt": "2026-11-01T14:14:05.126615231Z" }, "pages": [ { "url": "https://cal.com/blog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-04T08:16:11.27132313Z", "changedAt": "2026-11-04T08:16:11.27132313Z", "fingerprint": "51451ff3d61f" }, { "url": "https://cal.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-04T08:16:13.783940382Z", "changedAt": "2026-11-04T08:16:13.783940382Z", "fingerprint": "ca6620205030" }, { "url": "https://cal.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-04T08:16:15.487673021Z", "changedAt": "2026-11-04T08:16:15.487673021Z", "fingerprint": "f56ed83a519e" }, { "url": "https://cal.com/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-04T08:16:17.754301291Z", "changedAt": "2026-11-04T08:16:17.754301291Z", "fingerprint": "67952ab51975" } ], "github": { "repo": "calcom/cal-mcp", "checkedAt": "2026-11-02T08:37:31.392026977Z", "stars": 31, "archived": false, "issuesEnabled": true, "pushedAt": "2025-05-22T20:07:52Z", "openIssues": 6, "openPRs": 3, "issuesOpened90d": 0, "issuesClosed90d": 1, "prsMerged90d": 0, "replies": { "sampled": 7, "unanswered": 6, "medianDays": 158.8 } }, "updatedAt": "2026-11-04T20:46:37.74007334Z" } }, "answer": "Cal.com API v2 + MCP scores 51.1 (D) on agent readiness against YouCanBookMe API's 22.5 (F), and leads in 6 of 7 scored categories.", "b": { "slug": "youcanbookme", "name": "YouCanBookMe API", "vendor": "AI Software (Capacity) UK Ltd, trading as YouCanBookMe", "vendorUrl": "https://youcanbook.me", "kind": "http-api", "category": "scheduling", "summary": "YouCanBookMe is a booking-page service from the UK company of the same name, owned by Capacity since 2025. Its REST API manages account details, booking pages (profiles) and bookings over HTTP Basic auth, with webhooks from booking notifications.", "url": "https://www.anchorterminal.com/tools/youcanbookme", "markdownUrl": "https://www.anchorterminal.com/tools/youcanbookme.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/youcanbookme.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/youcanbookme.json", "dns": "youcanbookme.grade.anchorterminal.com", "transports": [ "http" ], "remoteUrl": "https://api.youcanbook.me/v1", "packages": [], "auth": "api-key", "authNotes": "HTTP Basic authentication with the account email address or account ID as the username and an account API key as the password. Only the Account Owner can generate, view, copy or delete the key, under Account Password \u0026 Security \u003e Authentication and API, and the help centre says the API key is available on the Team plan. No scopes, expiry or per-user keys are described. Administrators and Contributors must ask the owner for the key.", "pricing": "freemium", "pricingNotes": "Free plan with 1 calendar, 1 booking page and 30 bookings a month, with YouCanBookMe branding. Individual $9, Professional $13 and Teams $18 a seat a month, with 10 per cent off yearly and 20 per cent off for two years ($7.20, $10.40 and $14.40), per the help centre's pricing article. 14-day trial of every feature with no card, per the pricing page. API access is listed under the Team plan; webhooks need Professional or Teams.", "priceSummary": "$9 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the pricing page, in the help centre API and webhook articles or in the API's error response (checked 2026-11-03). The API reference itself could not be read.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://ycbm.stoplight.io/", "capabilities": [ "calendar.booking", "calendar.availability", "calendar.webhooks" ], "tags": [ "hosted", "freemium", "free-tier", "free-trial", "no-card", "api-key", "webhooks", "soc2", "iso27001", "uk", "closed-source" ], "lastRelease": "2026-09-01", "graded": true, "anchor": { "graded": true, "score": 22.5, "grade": "F", "agentReady": false, "rank": 1287, "ranked": true, "rankOf": 1349, "categoryRank": 13, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 13, "maintenance": 28, "payments": 30, "reliability": 15, "schema": 10, "security": 24, "transparency": 61 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-03" }, "negative": 0, "verdict": "A booking-page service with a Team-plan REST API over HTTP Basic auth and one account-wide key, SOC 2 Type II and ISO 27001 on its security page, and a 14-day trial without a card. Its API reference renders only by JavaScript and its status page did not resolve for us, so endpoints, limits and incidents are unverified.", "bestFor": "A booking-page product for small businesses, closest to calendly and savvycal in scheduling.", "strengths": [ "SOC 2 Type II and ISO/IEC 27001:2022 (certificate issued 20 February 2024) listed on the security page, with AES-256 at rest on AWS", "Free plan and a 14-day trial of every feature with no card", "Privacy notice (16 March 2026) states retention periods, 24 months for booking data by default, and says booking data is not used to train AI models", "Webhook notifications on six booking triggers with a JSON payload the user shapes, on Professional and Teams", "The API answers with a JSON error envelope carrying a code, message and status, and declares its version in an `x-api-version` header" ], "weaknesses": [ "The API reference at ycbm.stoplight.io could not be read without JavaScript, and the help centre's API article sat behind a Cloudflare challenge", "One account-wide API key over HTTP Basic auth, created only by the Account Owner, with no scopes or expiry documented", "API access is listed only on the Team plan ($18 a seat a month)", "No rate limits, 429 handling, idempotency keys, OpenAPI file, llms.txt or official SDK were found", "No security.txt, bug bounty or disclosure policy, and the status page at youcanbookmestatus.com did not resolve for us" ], "agentNotes": [ "Ask the Account Owner for the account ID and API key, since Administrators and Contributors cannot generate one, and send them as HTTP Basic credentials", "Read the API reference at ycbm.stoplight.io in a browser before planning calls; its endpoints and parameters were not readable to us", "Treat the key as full account access and keep it out of logs, since no scoped or read-only key is documented", "Expect a JSON error body with `code`, `message` and `status` on failures, and check for an existing booking before repeating a create, since no idempotency key is documented", "Use booking-page webhooks for booking, reschedule, cancel, reminder, follow-up and no-show events instead of polling" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "F", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 22.5 } ], "editorialScores": { "ergonomics": 13, "maintenance": 28, "payments": 30, "reliability": 15, "schema": 10, "security": 24, "transparency": 52 }, "provenanceScore": 70, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl -u \"$YCBM_ACCOUNT_ID:$YCBM_API_KEY\" https://api.youcanbook.me/v1/profiles" }, "letme": { "capability": "https://letme.dev/calendar.booking", "tool": "https://letme.dev/youcanbookme" }, "area": "everyday", "unitPrices": [ { "item": "Individual", "unit": "seat-month", "usd": 9, "note": "$8.10 a month yearly, $7.20 over two years, per the help centre" }, { "item": "Professional", "unit": "seat-month", "usd": 13, "note": "$11.70 a month yearly, $10.40 over two years" }, { "item": "Teams", "unit": "seat-month", "usd": 18, "note": "Per seat. $16.20 yearly, $14.40 over two years. The plan that lists API access" } ], "provenance": { "legalEntity": "AI Software (Capacity) UK Ltd", "domain": "youcanbook.me", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://youcanbook.me/terms", "privacy": "https://youcanbook.me/privacy", "statusPage": "https://www.youcanbookmestatus.com", "changelog": "https://youcanbook.me/product-updates", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "The terms (last updated 18 March 2026) name AI Software (Capacity) UK Ltd, trading as YouCanBookMe, under English law. Clause 15.3 bars data mining, robots and similar extraction tools without written consent, and clause 7.2 bars downloading the Site's software. Recorded as a fact; the public pages were read.", "The privacy notice (16 March 2026) gives company number 7221202, AWS hosting in the United States, a DPA on request through HelloSign, and retention of 24 months for booking data and up to 7 years for support messages.", "youcanbook.me/robots.txt disallows only HubSpot preview and preference paths. support.youcanbook.me/robots.txt disallows account, search and request paths; the API article there answered a Cloudflare challenge (403), which is the host's block, not a robots rule. ycbm.capacity.com and ycbm.stoplight.io allow all.", "The status page linked from youcanbook.me/help, www.youcanbookmestatus.com, did not resolve from our reader on 3 November 2026 (DNS), with or without www, so no incident history was read.", "youcanbook.me/.well-known/security.txt returns 404. The security page gives compliance@youcanbook.me as its contact.", "RDAP for youcanbook.me (rdap.nic.me) could not be reached from our shell, so the registration date is blank.", "The product updates page at youcanbook.me/product-updates is dated by month; its newest entry is September 2026 (registered SMS numbers), which lastRelease records as the first of that month." ], "score": 70 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/youcanbookme.json", "live": { "slug": "youcanbookme", "probe": { "target": "https://api.youcanbook.me/v1", "method": "get", "lastAt": "2026-11-04T20:47:24.77235475Z", "lastOk": true, "lastStatus": 400, "lastMs": 407, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 200, "p95ms24h": 447, "samples24h": 55, "samples30d": 55, "days": [ { "date": "2026-11-04", "probes": 55, "ok": 55 } ] }, "vendorStatus": { "page": "https://www.youcanbookmestatus.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T15:32:45.026115371Z" }, "securityTxt": { "url": "https://youcanbook.me/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:54:28.156243558Z" }, "updatedAt": "2026-11-04T20:47:24.77235475Z" } }, "edges": [ { "by": 66, "category": "schema", "leads": "cal-com", "name": "Schema \u0026 documentation", "reasons": { "a": "OpenAPI 3.0 document for API v2 (25). llms.txt and Markdown copies of reference pages (10). Reference pages explain each endpoint and parameter, but the hosted MCP's tool descriptions aren't public since the code went closed (12). Typed parameters with ranges, such as `limit` 1 to 100 with a default of 50 and enumerated booking statuses (12). Examples on reference pages. The response envelope has `status` success or error, but we found no error catalogue (8). Date-based `cal-api-version` per endpoint (2026-05-01 for bookings, 2024-09-04 for slots), and release notes come as blog posts rather than an API changelog (9). Docs readings are per the 1 October check, not re-read on 4 November (cal.com hosts paused). Total 76.", "b": "The reference lives on Stoplight at ycbm.stoplight.io, which usually renders an OpenAPI file, but our reader got only the workspace shell, and no spec file was found at the usual paths; the help centre article on support.youcanbook.me sat behind a Cloudflare challenge. Scored absent (0 of 25). No llms.txt on youcanbook.me, the help centre or the Stoplight host (0). Descriptions, typed inputs and required fields unread (0 of 20, 0 of 15). The one response we saw is a JSON envelope with `code`, `errors`, `httpCode`, `message` and `status`, and the help centre gives a worked webhook payload (4 of 15). A /v1 path and `x-api-version: 1.18` and `x-api-revision` headers, with a product updates page dated by month and no API changelog (6 of 15). 0 + 0 + 0 + 0 + 4 + 6 = 10." }, "scores": { "a": 76, "b": 10 } }, { "by": 50, "category": "reliability", "leads": "cal-com", "name": "Reliability", "reasons": { "a": "OpenStatus page at status.cal.com with App, Website and API components and an events log back to February 2024, per the 1 October reading (20). cal.com hosts are paused for this run under the terms of 1 November 2026, so the page wasn't re-read. In the readable part of the window, the 31 August outage (1 hour 14 minutes of HTTP 500s on /v2/slots and /v2/bookings, US East only) hit one region and two endpoints, and the 15 September event was a 1 hour 19 minute degradation of App and API. This run reads one region or a group of calls as partial, so both count as minor. 1 October to 4 November is unread and not credited (20, from 10). 120 requests a minute per key or OAuth token, raisable to 200 and then to 800 on request (15). No 429 behaviour, rate-limit headers or retry guidance in the docs or the OpenAPI spec (0). Enterprise lists \"SLA guarantees\" with no published figure or document, and a listed SLA nobody could read gives 0 in this run (0, from 5). API v2 is GA (10). Total 65.", "b": "Read with the hosted lines. The help page links a status page at www.youcanbookmestatus.com, but the host did not resolve from our reader with or without www on 3 November 2026, so it is scored as not established rather than as a finding about the vendor (0). No readable history (5). No rate limit with a number in the help centre articles, the pricing page or the API's own error response; the API reference could not be read (0). No 429 or retry guidance and no idempotency key found (0). No SLA, and the terms say the service is not guaranteed to be available 100 per cent of the time (0). The API reports version 1.18 in its headers and is sold on the Team plan, so generally available (10). 0 + 5 + 0 + 0 + 0 + 10 = 15." }, "scores": { "a": 65, "b": 15 } }, { "by": 37, "category": "ergonomics", "leads": "cal-com", "name": "Agent ergonomics", "reasons": { "a": "63 tools on the hosted MCP (5), with a `toolsets` query parameter to load only the groups you need and catalogue meta-tools (find, describe and call an API operation) (+10). Cursor pagination with `limit`, and filters on status, attendee, event type, team and start, end, created and updated times (20). Error envelope without documented codes (8). No idempotency key on bookings found, and we couldn't read the hosted tools for readOnlyHint or destructiveHint (0). No official REST SDK in two languages (Atoms is React components), and every endpoint needs the right version header (7). Per the 1 October check, not re-read on 4 November. Total 50.", "b": "Response sizing, field selection and pagination are in the unread reference (3 of 25, 0 of 20). The error envelope names a machine code and a message an agent can branch on (8 of 20). No idempotency key or safe-retry guidance found (0 of 20). No official SDK, and the required parameters are unread (2 of 15). 3 + 0 + 8 + 0 + 2 = 13." }, "scores": { "a": 50, "b": 13 } }, { "by": 32, "category": "security", "leads": "cal-com", "name": "Security \u0026 auth", "reasons": { "a": "OAuth with per-resource READ and WRITE scopes at user, team and organisation level, 30-minute access tokens, PKCE, and client secret rotation with two active secrets. OAuth clients are reviewed before use. API keys have test and live prefixes but no scopes (28). Read-only OAuth scopes and MCP toolsets narrow access, but nothing asks for confirmation before `delete_event_type`, `cancel_booking` or `delete_org_membership` (10). Bookings carry attendee-written names and notes into the model, with no injection guidance found (0). No operator request log found (0). ISO 27001, SOC 2 Type II and HIPAA claimed, an annual third-party penetration test, a Bugcrowd disclosure programme and a valid security.txt pointing to GitHub security advisories on the repository that now hosts the Cal.diy fork, where advisories are published (18). Per the 1 October check, not re-read on 4 November. Total 56.", "b": "One account-wide API key sent as the HTTP Basic password with the account ID or email, generated and deleted by the Account Owner only; no scopes, expiry or per-user keys are documented (10 of 30). No read-only mode or confirmation step found (0 of 20). The API and webhooks carry names, answers and notes written by people who book, with no injection guidance (2 of 15). No audit log or per-call visibility found (0 of 15). SOC 2 Type II and ISO/IEC 27001:2022 (certificate 20/3433, 20 February 2024) and third-party penetration tests on the security page, but no security.txt (404), bug bounty or disclosure policy (12 of 20). 10 + 0 + 2 + 0 + 12 = 24." }, "scores": { "a": 56, "b": 24 } }, { "by": 19, "category": "transparency", "leads": "cal-com", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed source since 14 April 2026. The Terms of Service were rewritten as version 2.0, effective 1 November 2026, naming Cal.com, Inc., a Delaware corporation, under Delaware law, and they say Cal.diy and Cal.com's other open-source releases are governed by their own licences (MIT for Cal.diy). Closed with clear terms (15, from 12). Privacy policy (20 August 2026) says nothing is used to train models, account data is kept while active with a 30-day export window after closure, and logs exclude personal data. DPA in the compliance portal (22). Platform deprecation dated 15 December 2025 and date-pinned API versions. The new terms promise prior notice by email or in product for updates that materially reduce a customer's rights, and name a periodic changelog for deprecations (14). Subprocessors are listed in the trust centre per the privacy policy, which we didn't open, and data sits in the US with EU residency on request (13). Privacy, DPA and trust readings are per the 1 October check, not re-read on 4 November. Total 64.", "b": "Closed service with terms (18 March 2026) naming AI Software (Capacity) UK Ltd under English law, which bar data-mining and robot tools without consent and let the company end membership without notice for a breach (15 of 30). The privacy notice (16 March 2026) states retention periods (24 months for booking data by default, 7 years for support messages), AWS hosting in the United States, a DPA on request and no training of external AI models on booking data; the security page says no subprocessor list is published, and the two agree on AWS (22 of 30). No deprecation policy or dated notice, and clause 18.4 allows changes to the service without notice (3 of 20). Providers are named in the privacy notice (AWS, Stripe, Google Analytics, Mixpanel, Hotjar, HubSpot) with US hosting, but there is no list with locations per processor (12 of 20). 15 + 22 + 3 + 12 = 52." }, "scores": { "a": 80, "b": 61 } }, { "by": 7, "category": "maintenance", "leads": "cal-com", "name": "Maintenance \u0026 community", "reasons": { "a": "The newest dated change found for the hosted API is the v6.9 changelog post of 15 September 2026, 50 days before this check, and cal.com hosts are paused so the blog wasn't re-read (20, from 30, cause time). One dated changelog post in the 90 days partly meets the three-entry line, so the earlier partial value is kept, pending the founder's rule on in-between values (5). The @calcom/cal-mcp repository's last commit is 0.0.6 on 22 May 2025, and calcom/cal.com now holds the Cal.diy fork, whose last version tag (v6.2.0) is dated 1 March 2026, so neither adds a release. A 4 November Cal.diy commit says @calcom/atoms is now published from a separate repository at 2.6.12; npm wasn't readable, so its dates are unchecked. Public blog changelog and support, no public issue tracker for the closed product (10). No current official REST SDKs, and the npm MCP package has sat at 0.0.6 since 22 May 2025 (5). The cal-mcp repository's test workflow has its test step commented out (0). Total 40.", "b": "Read as a closed service. The newest product update is dated September 2026 (registered SMS numbers), within 90 days but not 30, taking the month's first day (20 of 30). The previous entry is November 2025, so fewer than three in 90 days (0 of 20). A help centre, a community forum at forum.youcanbook.me and one-to-one support for paid users, with a product updates page that carries no API items (8 of 15). No official SDKs found (0). No package to assess (0). 20 + 0 + 8 + 0 + 0 = 28." }, "scores": { "a": 35, "b": 28 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Cal.com", "b": "AI Software (Capacity) UK Ltd, trading as YouCanBookMe", "name": "Vendor" }, { "a": "https://api.cal.com/v2", "b": "https://api.youcanbook.me/v1", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP, stdio", "b": "HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "API key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary (hosted product since April 2026). The @calcom/cal-mcp package and repository carry no licence", "b": "none", "name": "Licence" }, { "a": "63", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "yes", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "2026-09-15", "b": "2026-09-01", "name": "Last release" }, { "a": "no date given", "b": "2026-03-18", "name": "Terms last updated" }, { "a": "2026-10-01", "b": "2026-03-16", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "30 stars, 786 npm/wk", "b": "none", "name": "Popularity" }, { "a": "3/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Cal.com API v2 + MCP scores 51.1 (D) on agent readiness against YouCanBookMe API's 22.5 (F), and leads in 6 of 7 scored categories.", "question": "Which is better for AI agents, Cal.com API v2 + MCP or YouCanBookMe API?" }, { "answer": "Cal.com API v2 + MCP takes an API key or an OAuth sign-in. YouCanBookMe API needs an API key.", "question": "Do Cal.com API v2 + MCP and YouCanBookMe API need an API key?" }, { "answer": "Yes. Cal.com API v2 + MCP has a hosted endpoint at https://api.cal.com/v2 and YouCanBookMe API at https://api.youcanbook.me/v1.", "question": "Can an agent call Cal.com API v2 + MCP and YouCanBookMe API without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 65 against 15", "Schema \u0026 documentation, 76 against 10", "Agent ergonomics, 50 against 13", "Security \u0026 auth, 56 against 24", "Maintenance \u0026 community, 35 against 28", "Transparency \u0026 trust, 80 against 61" ], "also": [ "Runs on your own machine" ], "goodFor": "An agent that books, reschedules and cancels meetings into a Cal.com user's event types, or routes leads with routing forms.", "slug": "cal-com", "watchFor": "120 requests a minute by default and no documented 429 or retry behaviour" }, { "aheadOn": null, "also": [ "Free to start without a card", "No incidents deducted, where Cal.com API v2 + MCP loses 6 points for them" ], "goodFor": "A booking-page product for small businesses, closest to calendly and savvycal in scheduling.", "slug": "youcanbookme", "watchFor": "The API reference at ycbm.stoplight.io could not be read without JavaScript, and the help centre's API article sat behind a Cloudflare challenge" } ], "history": { "cal-com": [ { "causes": [ "terms", "correction", "time" ], "date": "2026-11-04", "delta": -6.1, "from": 57.2, "fromGrade": "C", "to": 51.1, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.3, "from": 57.5, "fromGrade": "C", "to": 57.2, "toGrade": "C" } ], "youcanbookme": null }, "job": { "capability": "calendar.booking", "name": "Calendar booking" }, "others": [ { "json": "https://www.anchorterminal.com/compare/acuity-scheduling-vs-cal-com.json", "title": "Acuity Scheduling API vs Cal.com API v2 + MCP", "url": "https://www.anchorterminal.com/compare/acuity-scheduling-vs-cal-com" }, { "json": "https://www.anchorterminal.com/compare/agenda-hero-vs-cal-com.json", "title": "Agenda Hero vs Cal.com API v2 + MCP", "url": "https://www.anchorterminal.com/compare/agenda-hero-vs-cal-com" }, { "json": "https://www.anchorterminal.com/compare/apiroc-vs-cal-com.json", "title": "Apiroc Unified Calendar API vs Cal.com API v2 + MCP", "url": "https://www.anchorterminal.com/compare/apiroc-vs-cal-com" }, { "json": "https://www.anchorterminal.com/compare/aurinko-calendar-vs-cal-com.json", "title": "Aurinko Calendar API vs Cal.com API v2 + MCP", "url": "https://www.anchorterminal.com/compare/aurinko-calendar-vs-cal-com" }, { "json": "https://www.anchorterminal.com/compare/cal-com-vs-calendly.json", "title": "Cal.com API v2 + MCP vs Calendly API + MCP", "url": "https://www.anchorterminal.com/compare/cal-com-vs-calendly" }, { "json": "https://www.anchorterminal.com/compare/cal-com-vs-cozi.json", "title": "Cal.com API v2 + MCP vs Cozi Family Organizer", "url": "https://www.anchorterminal.com/compare/cal-com-vs-cozi" }, { "json": "https://www.anchorterminal.com/compare/cal-com-vs-cronofy.json", "title": "Cal.com API v2 + MCP vs Cronofy API", "url": "https://www.anchorterminal.com/compare/cal-com-vs-cronofy" }, { "json": "https://www.anchorterminal.com/compare/cal-com-vs-google-calendar-api.json", "title": "Cal.com API v2 + MCP vs Google Calendar API", "url": "https://www.anchorterminal.com/compare/cal-com-vs-google-calendar-api" }, { "json": "https://www.anchorterminal.com/compare/cal-com-vs-microsoft-graph-calendar.json", "title": "Cal.com API v2 + MCP vs Microsoft Graph Calendar API", "url": "https://www.anchorterminal.com/compare/cal-com-vs-microsoft-graph-calendar" }, { "json": "https://www.anchorterminal.com/compare/cal-com-vs-nylas-calendar.json", "title": "Cal.com API v2 + MCP vs Nylas Calendar and Scheduler API", "url": "https://www.anchorterminal.com/compare/cal-com-vs-nylas-calendar" }, { "json": "https://www.anchorterminal.com/compare/cal-com-vs-savvycal.json", "title": "Cal.com API v2 + MCP vs SavvyCal API + MCP", "url": "https://www.anchorterminal.com/compare/cal-com-vs-savvycal" }, { "json": "https://www.anchorterminal.com/compare/cal-com-vs-zoom-scheduler.json", "title": "Cal.com API v2 + MCP vs Zoom Scheduler API", "url": "https://www.anchorterminal.com/compare/cal-com-vs-zoom-scheduler" }, { "json": "https://www.anchorterminal.com/compare/acuity-scheduling-vs-youcanbookme.json", "title": "Acuity Scheduling API vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/acuity-scheduling-vs-youcanbookme" }, { "json": "https://www.anchorterminal.com/compare/aurinko-calendar-vs-youcanbookme.json", "title": "Aurinko Calendar API vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/aurinko-calendar-vs-youcanbookme" }, { "json": "https://www.anchorterminal.com/compare/calendly-vs-youcanbookme.json", "title": "Calendly API + MCP vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/calendly-vs-youcanbookme" }, { "json": "https://www.anchorterminal.com/compare/cronofy-vs-youcanbookme.json", "title": "Cronofy API vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/cronofy-vs-youcanbookme" }, { "json": "https://www.anchorterminal.com/compare/nylas-calendar-vs-youcanbookme.json", "title": "Nylas Calendar and Scheduler API vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/nylas-calendar-vs-youcanbookme" }, { "json": "https://www.anchorterminal.com/compare/savvycal-vs-youcanbookme.json", "title": "SavvyCal API + MCP vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/savvycal-vs-youcanbookme" }, { "json": "https://www.anchorterminal.com/compare/youcanbookme-vs-zoom-scheduler.json", "title": "YouCanBookMe API vs Zoom Scheduler API", "url": "https://www.anchorterminal.com/compare/youcanbookme-vs-zoom-scheduler" }, { "json": "https://www.anchorterminal.com/compare/apiroc-vs-youcanbookme.json", "title": "Apiroc Unified Calendar API vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/apiroc-vs-youcanbookme" }, { "json": "https://www.anchorterminal.com/compare/google-calendar-api-vs-youcanbookme.json", "title": "Google Calendar API vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/google-calendar-api-vs-youcanbookme" }, { "json": "https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-youcanbookme.json", "title": "Microsoft Graph Calendar API vs YouCanBookMe API", "url": "https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-youcanbookme" } ], "panel": null, "scores": [ { "by": 50, "cal-com": 65, "edge": "cal-com", "key": "reliability", "name": "Reliability", "weight": 16, "youcanbookme": 15 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 66, "cal-com": 76, "edge": "cal-com", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "youcanbookme": 10 }, { "by": 37, "cal-com": 50, "edge": "cal-com", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "youcanbookme": 13 }, { "by": 32, "cal-com": 56, "edge": "cal-com", "key": "security", "name": "Security \u0026 auth", "weight": 14, "youcanbookme": 24 }, { "by": 0, "cal-com": 30, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "youcanbookme": 30 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 7, "cal-com": 35, "edge": "cal-com", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "youcanbookme": 28 }, { "by": 19, "cal-com": 80, "edge": "cal-com", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "youcanbookme": 61 } ], "summary": "Cal.com API v2 + MCP scores 51.1 (D) on agent readiness against YouCanBookMe API's 22.5 (F), and leads in 6 of 7 scored categories. Both do calendar booking.", "tasks": null, "tutorials": [], "verdicts": { "cal-com": "OAuth scopes split into READ and WRITE per resource, with 30-minute access tokens and PKCE, and the hosted MCP's 63 tools load by toolset. No 429 guidance or idempotency key was found, the newest changelog post is from 15 September 2026, and six Critical advisories in shared code were published in 12 months.", "youcanbookme": "A booking-page service with a Team-plan REST API over HTTP Basic auth and one account-wide key, SOC 2 Type II and ISO 27001 on its security page, and a 14-day trial without a card. Its API reference renders only by JavaScript and its status page did not resolve for us, so endpoints, limits and incidents are unverified." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cal-com-vs-youcanbookme", "json": "https://www.anchorterminal.com/compare/cal-com-vs-youcanbookme.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cal-com-vs-youcanbookme.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/cal-com-vs-youcanbookme.min.md" }, "markdown": "Cal.com API v2 + MCP scores 51.1 (D) on agent readiness against YouCanBookMe API's 22.5 (F), and leads in 6 of 7 scored categories. Both do calendar booking.\n\n- Cal.com API v2 + MCP: grade D, 51.1/100, rank #916 of 1349. Markdown https://www.anchorterminal.com/tools/cal-com.md · JSON https://www.anchorterminal.com/api/v1/tools/cal-com.json\n- YouCanBookMe API: grade F, 22.5/100, rank #1287 of 1349. Markdown https://www.anchorterminal.com/tools/youcanbookme.md · JSON https://www.anchorterminal.com/api/v1/tools/youcanbookme.json\n- Best calendar and scheduling APIs for AI agents: https://www.anchorterminal.com/best/scheduling/index.md\n- All 89 scheduling comparisons: https://www.anchorterminal.com/compare/scheduling/index.md\n\n## Which one, for what\n\n### Cal.com API v2 + MCP (D)\n\nGood for: An agent that books, reschedules and cancels meetings into a Cal.com user's event types, or routes leads with routing forms.\n\nAhead on:\n- Reliability, 65 against 15\n- Schema \u0026 documentation, 76 against 10\n- Agent ergonomics, 50 against 13\n- Security \u0026 auth, 56 against 24\n- Maintenance \u0026 community, 35 against 28\n- Transparency \u0026 trust, 80 against 61\n\nAlso in its favour:\n- Runs on your own machine\n\nWatch for: 120 requests a minute by default and no documented 429 or retry behaviour\n\n### YouCanBookMe API (F)\n\nGood for: A booking-page product for small businesses, closest to calendly and savvycal in scheduling.\n\nAlso in its favour:\n- Free to start without a card\n- No incidents deducted, where Cal.com API v2 + MCP loses 6 points for them\n\nWatch for: The API reference at ycbm.stoplight.io could not be read without JavaScript, and the help centre's API article sat behind a Cloudflare challenge\n\n\n## Why the edge\n\n### Schema \u0026 documentation: Cal.com API v2 + MCP +66\n\n- Cal.com API v2 + MCP (76): OpenAPI 3.0 document for API v2 (25). llms.txt and Markdown copies of reference pages (10). Reference pages explain each endpoint and parameter, but the hosted MCP's tool descriptions aren't public since the code went closed (12). Typed parameters with ranges, such as `limit` 1 to 100 with a default of 50 and enumerated booking statuses (12). Examples on reference pages. The response envelope has `status` success or error, but we found no error catalogue (8). Date-based `cal-api-version` per endpoint (2026-05-01 for bookings, 2024-09-04 for slots), and release notes come as blog posts rather than an API changelog (9). Docs readings are per the 1 October check, not re-read on 4 November (cal.com hosts paused). Total 76.\n- YouCanBookMe API (10): The reference lives on Stoplight at ycbm.stoplight.io, which usually renders an OpenAPI file, but our reader got only the workspace shell, and no spec file was found at the usual paths; the help centre article on support.youcanbook.me sat behind a Cloudflare challenge. Scored absent (0 of 25). No llms.txt on youcanbook.me, the help centre or the Stoplight host (0). Descriptions, typed inputs and required fields unread (0 of 20, 0 of 15). The one response we saw is a JSON envelope with `code`, `errors`, `httpCode`, `message` and `status`, and the help centre gives a worked webhook payload (4 of 15). A /v1 path and `x-api-version: 1.18` and `x-api-revision` headers, with a product updates page dated by month and no API changelog (6 of 15). 0 + 0 + 0 + 0 + 4 + 6 = 10.\n\n### Reliability: Cal.com API v2 + MCP +50\n\n- Cal.com API v2 + MCP (65): OpenStatus page at status.cal.com with App, Website and API components and an events log back to February 2024, per the 1 October reading (20). cal.com hosts are paused for this run under the terms of 1 November 2026, so the page wasn't re-read. In the readable part of the window, the 31 August outage (1 hour 14 minutes of HTTP 500s on /v2/slots and /v2/bookings, US East only) hit one region and two endpoints, and the 15 September event was a 1 hour 19 minute degradation of App and API. This run reads one region or a group of calls as partial, so both count as minor. 1 October to 4 November is unread and not credited (20, from 10). 120 requests a minute per key or OAuth token, raisable to 200 and then to 800 on request (15). No 429 behaviour, rate-limit headers or retry guidance in the docs or the OpenAPI spec (0). Enterprise lists \"SLA guarantees\" with no published figure or document, and a listed SLA nobody could read gives 0 in this run (0, from 5). API v2 is GA (10). Total 65.\n- YouCanBookMe API (15): Read with the hosted lines. The help page links a status page at www.youcanbookmestatus.com, but the host did not resolve from our reader with or without www on 3 November 2026, so it is scored as not established rather than as a finding about the vendor (0). No readable history (5). No rate limit with a number in the help centre articles, the pricing page or the API's own error response; the API reference could not be read (0). No 429 or retry guidance and no idempotency key found (0). No SLA, and the terms say the service is not guaranteed to be available 100 per cent of the time (0). The API reports version 1.18 in its headers and is sold on the Team plan, so generally available (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.\n\n### Agent ergonomics: Cal.com API v2 + MCP +37\n\n- Cal.com API v2 + MCP (50): 63 tools on the hosted MCP (5), with a `toolsets` query parameter to load only the groups you need and catalogue meta-tools (find, describe and call an API operation) (+10). Cursor pagination with `limit`, and filters on status, attendee, event type, team and start, end, created and updated times (20). Error envelope without documented codes (8). No idempotency key on bookings found, and we couldn't read the hosted tools for readOnlyHint or destructiveHint (0). No official REST SDK in two languages (Atoms is React components), and every endpoint needs the right version header (7). Per the 1 October check, not re-read on 4 November. Total 50.\n- YouCanBookMe API (13): Response sizing, field selection and pagination are in the unread reference (3 of 25, 0 of 20). The error envelope names a machine code and a message an agent can branch on (8 of 20). No idempotency key or safe-retry guidance found (0 of 20). No official SDK, and the required parameters are unread (2 of 15). 3 + 0 + 8 + 0 + 2 = 13.\n\n### Security \u0026 auth: Cal.com API v2 + MCP +32\n\n- Cal.com API v2 + MCP (56): OAuth with per-resource READ and WRITE scopes at user, team and organisation level, 30-minute access tokens, PKCE, and client secret rotation with two active secrets. OAuth clients are reviewed before use. API keys have test and live prefixes but no scopes (28). Read-only OAuth scopes and MCP toolsets narrow access, but nothing asks for confirmation before `delete_event_type`, `cancel_booking` or `delete_org_membership` (10). Bookings carry attendee-written names and notes into the model, with no injection guidance found (0). No operator request log found (0). ISO 27001, SOC 2 Type II and HIPAA claimed, an annual third-party penetration test, a Bugcrowd disclosure programme and a valid security.txt pointing to GitHub security advisories on the repository that now hosts the Cal.diy fork, where advisories are published (18). Per the 1 October check, not re-read on 4 November. Total 56.\n- YouCanBookMe API (24): One account-wide API key sent as the HTTP Basic password with the account ID or email, generated and deleted by the Account Owner only; no scopes, expiry or per-user keys are documented (10 of 30). No read-only mode or confirmation step found (0 of 20). The API and webhooks carry names, answers and notes written by people who book, with no injection guidance (2 of 15). No audit log or per-call visibility found (0 of 15). SOC 2 Type II and ISO/IEC 27001:2022 (certificate 20/3433, 20 February 2024) and third-party penetration tests on the security page, but no security.txt (404), bug bounty or disclosure policy (12 of 20). 10 + 0 + 2 + 0 + 12 = 24.\n\n### Transparency \u0026 trust: Cal.com API v2 + MCP +19\n\n- Cal.com API v2 + MCP (80): Closed source since 14 April 2026. The Terms of Service were rewritten as version 2.0, effective 1 November 2026, naming Cal.com, Inc., a Delaware corporation, under Delaware law, and they say Cal.diy and Cal.com's other open-source releases are governed by their own licences (MIT for Cal.diy). Closed with clear terms (15, from 12). Privacy policy (20 August 2026) says nothing is used to train models, account data is kept while active with a 30-day export window after closure, and logs exclude personal data. DPA in the compliance portal (22). Platform deprecation dated 15 December 2025 and date-pinned API versions. The new terms promise prior notice by email or in product for updates that materially reduce a customer's rights, and name a periodic changelog for deprecations (14). Subprocessors are listed in the trust centre per the privacy policy, which we didn't open, and data sits in the US with EU residency on request (13). Privacy, DPA and trust readings are per the 1 October check, not re-read on 4 November. Total 64.\n- YouCanBookMe API (61): Closed service with terms (18 March 2026) naming AI Software (Capacity) UK Ltd under English law, which bar data-mining and robot tools without consent and let the company end membership without notice for a breach (15 of 30). The privacy notice (16 March 2026) states retention periods (24 months for booking data by default, 7 years for support messages), AWS hosting in the United States, a DPA on request and no training of external AI models on booking data; the security page says no subprocessor list is published, and the two agree on AWS (22 of 30). No deprecation policy or dated notice, and clause 18.4 allows changes to the service without notice (3 of 20). Providers are named in the privacy notice (AWS, Stripe, Google Analytics, Mixpanel, Hotjar, HubSpot) with US hosting, but there is no list with locations per processor (12 of 20). 15 + 22 + 3 + 12 = 52.\n\n### Maintenance \u0026 community: Cal.com API v2 + MCP +7\n\n- Cal.com API v2 + MCP (35): The newest dated change found for the hosted API is the v6.9 changelog post of 15 September 2026, 50 days before this check, and cal.com hosts are paused so the blog wasn't re-read (20, from 30, cause time). One dated changelog post in the 90 days partly meets the three-entry line, so the earlier partial value is kept, pending the founder's rule on in-between values (5). The @calcom/cal-mcp repository's last commit is 0.0.6 on 22 May 2025, and calcom/cal.com now holds the Cal.diy fork, whose last version tag (v6.2.0) is dated 1 March 2026, so neither adds a release. A 4 November Cal.diy commit says @calcom/atoms is now published from a separate repository at 2.6.12; npm wasn't readable, so its dates are unchecked. Public blog changelog and support, no public issue tracker for the closed product (10). No current official REST SDKs, and the npm MCP package has sat at 0.0.6 since 22 May 2025 (5). The cal-mcp repository's test workflow has its test step commented out (0). Total 40.\n- YouCanBookMe API (28): Read as a closed service. The newest product update is dated September 2026 (registered SMS numbers), within 90 days but not 30, taking the month's first day (20 of 30). The previous entry is November 2025, so fewer than three in 90 days (0 of 20). A help centre, a community forum at forum.youcanbook.me and one-to-one support for paid users, with a product updates page that carries no API items (8 of 15). No official SDKs found (0). No package to assess (0). 20 + 0 + 8 + 0 + 0 = 28.\n\n## Score by category\n\n| Category | Weight | Cal.com API v2 + MCP | YouCanBookMe API | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 65 | 15 | Cal.com API v2 + MCP +50 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 76 | 10 | Cal.com API v2 + MCP +66 |\n| Agent ergonomics | 13% (16.2 this run) | 50 | 13 | Cal.com API v2 + MCP +37 |\n| Security \u0026 auth | 14% (17.5 this run) | 56 | 24 | Cal.com API v2 + MCP +32 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 30 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 35 | 28 | Cal.com API v2 + MCP +7 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 80 | 61 | Cal.com API v2 + MCP +19 |\n| Negative events | ≤15 | -6 | 0 | |\n| **Total** | | **51.1 · D** | **22.5 · F** | |\n\n## Facts side by side\n\n| Fact | Cal.com API v2 + MCP | YouCanBookMe API |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Cal.com | AI Software (Capacity) UK Ltd, trading as YouCanBookMe |\n| Hosted endpoint | `https://api.cal.com/v2` | `https://api.youcanbook.me/v1` |\n| Transports | HTTP, Streamable HTTP, stdio | HTTP |\n| Auth | OAuth or key | API key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | Proprietary (hosted product since April 2026). The @calcom/cal-mcp package and repository carry no licence | none |\n| Tools exposed | 63 | none |\n| Read-only variant documented | no | yes |\n| llms.txt | yes | no |\n| Last release | 2026-09-15 | 2026-09-01 |\n| Terms last updated | no date given | 2026-03-18 |\n| Privacy policy last updated | 2026-10-01 | 2026-03-16 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | yes |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | not found in the text | not found in the text |\n| Popularity | 30 stars, 786 npm/wk | none |\n| Agent reviews | 3/5 (2) | none |\n\n## How the scores have moved\n\n### Cal.com API v2 + MCP\n\n- -6.1 on 4 November 2026 (C to D): terms, correction, time\n- -0.3 on 8 October 2026: checklist\n\n### YouCanBookMe API\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Cal.com API v2 + MCP.** OAuth scopes split into READ and WRITE per resource, with 30-minute access tokens and PKCE, and the hosted MCP's 63 tools load by toolset. No 429 guidance or idempotency key was found, the newest changelog post is from 15 September 2026, and six Critical advisories in shared code were published in 12 months.\n\n**YouCanBookMe API.** A booking-page service with a Team-plan REST API over HTTP Basic auth and one account-wide key, SOC 2 Type II and ISO 27001 on its security page, and a 14-day trial without a card. Its API reference renders only by JavaScript and its status page did not resolve for us, so endpoints, limits and incidents are unverified.\n\n## Before you call either\n\n### Cal.com API v2 + MCP\n\n1. Send `cal-api-version: 2026-05-01` on bookings and `2024-09-04` on slots, since each endpoint pins its own version\n2. Append `?toolsets=bookings,availability` to the hosted MCP URL to skip the other 50-odd tools\n3. Page bookings with `pagination.nextCursor`, not offsets\n4. Check for an existing booking before retrying a create, since there's no idempotency key\n5. Use `cal_` test keys while building so bookings don't reach real calendars\n\n### YouCanBookMe API\n\n1. Ask the Account Owner for the account ID and API key, since Administrators and Contributors cannot generate one, and send them as HTTP Basic credentials\n2. Read the API reference at ycbm.stoplight.io in a browser before planning calls; its endpoints and parameters were not readable to us\n3. Treat the key as full account access and keep it out of logs, since no scoped or read-only key is documented\n4. Expect a JSON error body with `code`, `message` and `status` on failures, and check for an existing booking before repeating a create, since no idempotency key is documented\n5. Use booking-page webhooks for booking, reschedule, cancel, reminder, follow-up and no-show events instead of polling\n\n## Questions\n\n### Which is better for AI agents, Cal.com API v2 + MCP or YouCanBookMe API?\n\nCal.com API v2 + MCP scores 51.1 (D) on agent readiness against YouCanBookMe API's 22.5 (F), and leads in 6 of 7 scored categories.\n\n### Do Cal.com API v2 + MCP and YouCanBookMe API need an API key?\n\nCal.com API v2 + MCP takes an API key or an OAuth sign-in. YouCanBookMe API needs an API key.\n\n### Can an agent call Cal.com API v2 + MCP and YouCanBookMe API without installing anything?\n\nYes. Cal.com API v2 + MCP has a hosted endpoint at https://api.cal.com/v2 and YouCanBookMe API at https://api.youcanbook.me/v1.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cal-com-vs-youcanbookme.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cal-com-vs-youcanbookme.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cal-com\", \"b\": \"youcanbookme\"}`. From a terminal: `anchor compare cal-com youcanbookme`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cal-com.json and https://www.anchorterminal.com/api/v1/tools/youcanbookme.json\n\n## Other comparisons with Cal.com API v2 + MCP or YouCanBookMe API\n\n- [Acuity Scheduling API vs Cal.com API v2 + MCP](https://www.anchorterminal.com/compare/acuity-scheduling-vs-cal-com.md)\n- [Agenda Hero vs Cal.com API v2 + MCP](https://www.anchorterminal.com/compare/agenda-hero-vs-cal-com.md)\n- [Apiroc Unified Calendar API vs Cal.com API v2 + MCP](https://www.anchorterminal.com/compare/apiroc-vs-cal-com.md)\n- [Aurinko Calendar API vs Cal.com API v2 + MCP](https://www.anchorterminal.com/compare/aurinko-calendar-vs-cal-com.md)\n- [Cal.com API v2 + MCP vs Calendly API + MCP](https://www.anchorterminal.com/compare/cal-com-vs-calendly.md)\n- [Cal.com API v2 + MCP vs Cozi Family Organizer](https://www.anchorterminal.com/compare/cal-com-vs-cozi.md)\n- [Cal.com API v2 + MCP vs Cronofy API](https://www.anchorterminal.com/compare/cal-com-vs-cronofy.md)\n- [Cal.com API v2 + MCP vs Google Calendar API](https://www.anchorterminal.com/compare/cal-com-vs-google-calendar-api.md)\n- [Cal.com API v2 + MCP vs Microsoft Graph Calendar API](https://www.anchorterminal.com/compare/cal-com-vs-microsoft-graph-calendar.md)\n- [Cal.com API v2 + MCP vs Nylas Calendar and Scheduler API](https://www.anchorterminal.com/compare/cal-com-vs-nylas-calendar.md)\n- [Cal.com API v2 + MCP vs SavvyCal API + MCP](https://www.anchorterminal.com/compare/cal-com-vs-savvycal.md)\n- [Cal.com API v2 + MCP vs Zoom Scheduler API](https://www.anchorterminal.com/compare/cal-com-vs-zoom-scheduler.md)\n- [Acuity Scheduling API vs YouCanBookMe API](https://www.anchorterminal.com/compare/acuity-scheduling-vs-youcanbookme.md)\n- [Aurinko Calendar API vs YouCanBookMe API](https://www.anchorterminal.com/compare/aurinko-calendar-vs-youcanbookme.md)\n- [Calendly API + MCP vs YouCanBookMe API](https://www.anchorterminal.com/compare/calendly-vs-youcanbookme.md)\n- [Cronofy API vs YouCanBookMe API](https://www.anchorterminal.com/compare/cronofy-vs-youcanbookme.md)\n- [Nylas Calendar and Scheduler API vs YouCanBookMe API](https://www.anchorterminal.com/compare/nylas-calendar-vs-youcanbookme.md)\n- [SavvyCal API + MCP vs YouCanBookMe API](https://www.anchorterminal.com/compare/savvycal-vs-youcanbookme.md)\n- [YouCanBookMe API vs Zoom Scheduler API](https://www.anchorterminal.com/compare/youcanbookme-vs-zoom-scheduler.md)\n- [Apiroc Unified Calendar API vs YouCanBookMe API](https://www.anchorterminal.com/compare/apiroc-vs-youcanbookme.md)\n- [Google Calendar API vs YouCanBookMe API](https://www.anchorterminal.com/compare/google-calendar-api-vs-youcanbookme.md)\n- [Microsoft Graph Calendar API vs YouCanBookMe API](https://www.anchorterminal.com/compare/microsoft-graph-calendar-vs-youcanbookme.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cal.com API v2 + MCP vs YouCanBookMe API", "url": "" } ], "description": "Cal.com API v2 scores 51.1 (D) to YouCanBookMe's 22.5 (F) for calendar booking. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Cal.com API v2 + MCP D 51.1", "YouCanBookMe API F 22.5", "scores" ], "h1": "Cal.com API v2 + MCP vs YouCanBookMe API", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/cal-com-vs-youcanbookme", "published": "2026-10-01", "section": "tools", "title": "Cal.com API v2 vs YouCanBookMe for AI agents (2026) | Anchor Terminal", "toc": null, "updated": "2026-11-04", "url": "https://www.anchorterminal.com/compare/cal-com-vs-youcanbookme" }, "tokens": { "markdown": 5050, "slim": 3080 }, "version": 1 }