Calendly API + MCP vs Truto Unified Calendar API

Calendly API + MCP 80

Closed service with customer terms and a separate developer policy (15). Privacy notice (3 July 2026) gives no retention periods, and the no-AI-training statement sits on the security page, not in the privacy notice (18). The v1 to v2 migration notice is dated 26 March 2025 and legacy token behaviour under scopes is written down (12). Sub-processor list linked from the privacy notice, which says data sits in the US or wherever providers operate. We didn't open the list (16).

Truto Unified Calendar API 61

Closed service under terms naming Yin Yang Inc. (15 of 30). Truto says it stores no customer data and calls vendors live, logs are kept 30 or 90 days by plan, data is kept 15 days after termination, and a DPA is public (25 of 30). Deprecated admin endpoints are marked with no policy or dates (6 of 20). Enterprise customers can choose a data region and tokens can be stored regionally; no subprocessor list was found (8 of 20). 15 + 25 + 6 + 8 = 54.

Calendly API + MCP 70

OAuth 2.1 with PKCE and dynamic client registration on the MCP, and per-resource scopes such as scheduled_events:read and availability:write for new OAuth apps and new personal access tokens since March 2026. Tokens issued before scopes keep full access (28). Read scopes, mcp:scheduling:read and mcp:scheduling:write for the MCP, and destructiveHint on cancel, delete and revoke tools, but no confirmation step of its own (15). Invitee names and booking answers written by outsiders reach the model, with no injection guidance found (0). activity_log:read and audit logs on Enterprise (10). SOC 2 Type 2, ISO 27001, CSA STAR, an annual penetration test and a valid security.txt. No public bug bounty found (17).

Truto Unified Calendar API 52

API tokens are per environment and sent as Bearer headers; no scopes or expiry for them were found (20 of 30). Per-account MCP servers can be limited to read methods or tags and set to expire, and the customer's connection form can restrict access to specific resources, but the REST token reaches every integrated account in its environment (14 of 20). Event titles, descriptions and attendee text from outside parties pass through, and no prompt-injection guidance was found (0). Plans keep request logs 30 or 90 days (10 of 15). SOC 2 is stated in a 2023 blog post, with no trust page, security.txt or disclosure policy found (8 of 20). 20 + 14 + 0 + 10 + 8 = 52.

Calendly API + MCP 86

OpenAPI 3.1 for the scheduling API and a separate one for OAuth, in JSON and YAML (25). llms.txt with about 130 links and Markdown copies of every docs page (10). Reference pages and MCP tool docs mark plan requirements such as paid plan for booking and Teams for routing forms (14). Typed parameters in the spec (12). 400, 401, 403, 404, 409, 424 and 500 responses in the spec. 429 appears on 9 of 65 operations, the contacts endpoints, on 1 November 2026 (12). Dated release notes, latest 30 October 2026. The API version only changes by migration, the last one being v1 to v2 (13).

Truto Unified Calendar API 75

An OpenAPI specification is linked from the RFC 9727 API catalogue, but the file timed out and was not read, so it is credited as published and unverified (20 of 25). llms.txt and a Markdown sibling for every page (10). Parameter descriptions say what each does and what it falls back to, such as end_time defaulting to the month of start_time (15 of 20). Types, required marks and allowed values such as focus_time and out_of_office (13 of 15). One documented error shape with provider and Truto fields; few request examples on the reference pages read (12 of 15). Deprecated admin endpoints are marked, but no API changelog was found (5 of 15). 20 + 10 + 15 + 13 + 12 + 5 = 75.

Calendly API + MCP 61

39 MCP tools on the supported tools page on 1 November 2026 (5), with 5 back for two skill tools that load task guidance on demand and 2 for count on REST lists (12). next_page pagination and time and status filters on scheduled events (17). Error codes in the spec, and Free users get a clear 403 on booking (15). MCP tools carry readOnlyHint, destructiveHint and idempotentHint, but the REST booking call has no idempotency key (12). No official SDK, and the user URI from /users/me is needed before most calls (5).

Truto Unified Calendar API 71

truto_exclude_fields, truto_ignore_remote_data, truto_key_by and response formats (unified, raw, normalized) size the reply (22 of 25). Query operators such as [gt] and [in], sort_by, limit and cursors, with a meta endpoint that says which filters each vendor supports (18 of 20). Errors name the HTTP status and say whether Truto or the provider failed, with the provider's message extracted (18 of 20). No idempotency key found for creates (5 of 20). Every call needs only the token and integrated_account_id; a CLI and the Link SDK exist, with no general API SDK found (8 of 15). 22 + 18 + 18 + 5 + 8 = 71.

Calendly API + MCP 30

No x402, MPP or L402 (0). Seat prices public ($10 and $16 a seat a month, Enterprise from $15,000 a year) but nothing per call (10). Free plan with API read access and no card, though booking through the API needs a paid seat (20). A person signs up and consents in a browser, even though MCP clients register themselves (0).

Truto Unified Calendar API 20

No x402, MPP or L402 (0). Plan prices per connector a year are public, with unlimited calls (10). A free 30-day sandbox is given after a work-email request reviewed within a business day (10 of 20). A person requests access or books a demo (0). 0 + 10 + 10 + 0 = 20.

Calendly API + MCP 60

Latest release note on 30 October 2026 (Teams API), two days before this check (30). Four dated entries since 3 August (25 August, 22, 23 and 30 October) (20). Public release notes and a developer support route, no public issue tracker (10). No official SDKs (0). No package to assess (0).

Truto Unified Calendar API 50

No API changelog, so the last API change can't be dated; the official @truto/truto-link-sdk was published as 1.3.5 on 26 October 2026, which we take as the latest dated release (20 of 30, since it is the connection widget, not the calendar API). Six Link SDK versions since 8 August (10 of 20, for the same reason). Support through Slack on paid plans, with no public tracker (5 of 15). A CLI and the Link SDK are official, with no API client (10 of 15). Package health not checked (5 of 10). 20 + 10 + 5 + 10 + 5 = 50.