Google Calendar API vs SavvyCal API + MCP

Google Calendar API 87

@googleapis/calendar 20.1.0 on 3 October 2026 is still the newest on npm on 1 November, 29 days earlier, and the discovery document has moved to revision 20261028 (30). Release notes on 12 October, plus client releases on 10, 14 and 24 September and 3 October, all within the 90 days to 1 November (the July notes have aged out) (20). Dated release notes and public client repositories with active maintainers (12). Current official client libraries (15). Generated clients rebuilt by CI in google-api-nodejs-client, with commits up to 30 October in a clone on 1 November (10).

SavvyCal API + MCP 40

Read as a closed service. The newest dated change is the MCP integration of 27 October 2026 on the updates board (30). It is the only dated entry since 7 July, so fewer than three in 90 days (0 of 20). A public updates board, a feature request board and a support address with a stated 24-hour reply within US Central business hours (10 of 15). No official SDKs (0). No package to assess (0). 30 + 0 + 10 + 0 + 0 = 40.

Google Calendar API 91

Responses size with maxResults and Google's standard fields partial responses (20). pageToken, syncToken, timeMin and timeMax, q and singleEvents for expanding recurrences (20). Error reasons an agent can act on, with the action written next to each one (20). Client-supplied event IDs make creates safe to retry and ETags guard updates. We found no readOnlyHint or destructiveHint on the MCP's write tools (16). Official client libraries in many languages, and most parameters are optional (15).

SavvyCal API + MCP 53

List responses are sized by limit (default 20, at most 100) with no field selection. The MCP server lists 63 tools with no documented toolset or read-only list, though a client can ask for the mcp:read scope alone (10 of 25). Cursor pagination with after, before and limit, and date and status filters on events (17 of 20). Errors name the field, the failed validation and a limit count, which an agent can act on, but a 429 carries no wait time (14 of 20). No idempotency key on booking or link creation, and the MCP annotations could not be read; the docs say the assistant confirms before cancelling, deleting or inviting (6 of 20). Creating an event needs five fields, and there is no official SDK in any language (6 of 15). 10 + 17 + 14 + 6 + 6 = 53.

Google Calendar API 77

OAuth 2.0 with 20 Calendar scopes on the auth page, from calendar.freebusy and calendar.events.owned.readonly up to full calendar, and the discovery document (revision 20261028) carries a 21st, calendar.settings, which the auth page still doesn't list on 1 November (30), less 10 because the discovery document lists oauth_token and key as query parameters, the API also reads access_token from the query string, and Google's OAuth web-server guide shows the query string as an alternative to the header, read as for Gmail, Sheets and Forms (20). The auth page's table gives each scope's meaning only, and the non-sensitive, sensitive and restricted classes are per the 1 October check, not re-read on 4 or 17 October. Read-only and free/busy-only scopes, and the MCP guide (updated 29 October) still configures three read-only scopes. Nothing in the API confirms a delete (17). The MCP guide, updated 29 October, warns about indirect prompt injection and says prompts and responses must be screened, with Model Armor or a documented alternative, and tells operators to review AI-initiated actions (12). The Cloud console API dashboard shows traffic, errors by method and response code, and latency percentiles per project, but not a per-call log (8). Valid security.txt to 2030 with contacts and the Google VRP bug bounty policy, read on 1 November. Google's SOC 2 page sends customers to Compliance Reports Manager for the Google Workspace reports, and that Calendar is in their scope is per the 4 October check (20).

SavvyCal API + MCP 50

OAuth 2 authorisation code apps with 2-hour access tokens and refresh tokens, and personal access tokens, both in the Authorization header only. The spec declares no scopes for either, and PAT expiry and revocation are not described. The MCP server uses OAuth 2.1 with PKCE S256, dynamic client registration, mcp:read and mcp:write scopes and a revocation endpoint (22 of 30). mcp:read gives a read-only MCP grant, and the vendor says the assistant asks before booking, cancelling, deleting or inviting. REST tokens have no read-only form (14 of 20). Invitee names, answers and metadata written by outsiders come back through events and webhooks with no injection guidance; the AI page says the assistant sees calendar conflicts but not event names (2 of 15). Webhook request logs and a Connected Apps list with revoke, but no per-call audit log for the operator (4 of 15). Valid security.txt to 2 May 2027, a security page and an SSDLC page, but no SOC 2 or ISO 27001 (the page says not yet) and no bug bounty (8 of 20). 22 + 14 + 2 + 4 + 8 = 50.

Google Calendar API 90

The Google Workspace Status Dashboard lists Calendar with component history and an incidents feed (20). On 1 November the dashboard's 365-day list shows two Calendar incidents, 31 May 2026 (56 minutes, several Workspace products) and 13 March 2026 (2 hours 30 minutes of intermittent errors), with none in the 90 days to 1 November. Other Workspace products have incidents in August and September (Drive, Gmail, Chat, Classroom and Gemini), none naming Calendar. The dashboard tracks the Calendar product rather than the API alone (30). 10,000 requests a minute per project, 600 a minute per user per project and 1,000,000 a day per project, unchanged on 1 November (15). 403 and 429 usageLimits errors with a truncated exponential backoff formula, client-supplied event IDs that return 409 on a duplicate, and ETags with 412 on a stale write (15). No SLA for the API found (0). The REST API is GA. The MCP server is still a developer preview on 1 November (10).

SavvyCal API + MCP 70

Read with the hosted lines. Instatus page at savvycal.instatus.com with App, Microsoft 365, Google Calendar and Integrations components and a month-by-month history (20). No notices from June to November 2026 and 100 per cent App uptime each month, a clean record (30). The only limit with a number is in the OpenAPI spec, 10 event creations a minute per link, failed ones included; nothing covers the rest of the API (7 of 15). That 429 is declared with no Retry-After, backoff guidance or idempotency key, and webhooks are the only place retries are described (3 of 15). No SLA; the terms give the service as is (0). The v1 API is generally available and the MCP server, announced 27 October 2026, is not marked beta (10). 20 + 30 + 7 + 3 + 0 + 10 = 70.

Google Calendar API 88

Google publishes a discovery document rather than OpenAPI, which is a machine-readable contract all the same, at revision 20261028 on 1 November (25). No llms.txt, and developers.google.com/llms.txt and /workspace/calendar/llms.txt returned 404 again on 1 November, but doc pages return Markdown when .md.txt is appended to the URL, which we found no index or link advertising, read as for Drive, Sheets and Forms (5 of 10). Reference pages say what each method does and when to use patch over update, but we couldn't read the MCP tool descriptions (15). Typed parameters with enums such as orderBy and eventTypes (13). An error page that gives each reason code a recommended action, from timeRangeEmpty to fullSyncRequired (15). v3 in the path and dated release notes, latest 12 October 2026, with nothing newer on 1 November (15).

SavvyCal API + MCP 74

OpenAPI 3.0.0 at api.savvycal.com/v1/spec covers all 22 operations with 56 schemas; the MCP tools' schemas could not be read without signing in (23 of 25). llms.txt and a Markdown twin of every docs page (10). Only 8 of the 22 operations carry a description, and those state constraints (events must match an open slot, an invalid filter resets every filter) rather than when to choose another endpoint (10 of 20). Required flags on 14 of 43 parameters, 34 enum properties across the schemas, limit bounded 1 to 100, until at most 31 days after from (12 of 15). Example values on parameters and a documented error shape keyed by field, with 400, 401, 404, 422 and 429 declared per operation, but no full response examples (10 of 15). A /v1 path and a promise that changes are additive, with dated product updates on the feedback board but no API changelog (9 of 15). 23 + 10 + 10 + 12 + 10 + 9 = 74.

Google Calendar API 82

Closed service under Google's API terms, with Apache-2.0 client libraries (15). Google's privacy policy covers end users, and the Workspace data processing terms cover tenants, but we didn't find one retention statement for Calendar API data (18). Dated announcements ahead of changes, such as the 1 June notice for the 29 June GA of writerWithoutPrivateAccess at least 90 days' notice promised before quota charges, and the 12 October notice that Workspace MCP servers reject OAuth clients not marked agentic from 11 November 2026 (15). The Workspace sub-processor list, last modified 19 October 2026, names Google group and third-party sub-processors with the countries each processes in, and covers Calendar as a Core Service for Workspace tenants (20).

SavvyCal API + MCP 73

Closed service with terms that name SavvyCal, Inc. under Minnesota law and forbid automated access to the site, with the API left to the developer docs (15 of 30). The privacy policy (17 October 2026), DPA (16 January 2023) and processor list (24 October 2026) agree on US hosting, Stripe and return or destruction on termination, but no retention period is stated beyond account lifetime (22 of 30). The developer overview promises additive changes; there is no deprecation policy or dated notice, and the terms allow any feature to change without notice (5 of 20). A processor list with purposes, hosting on Fly.io in Virginia and Crunchy Bridge on AWS us-east, but no locations per processor (15 of 20). 15 + 22 + 5 + 15 = 57.