Microsoft Graph Calendar API vs SavvyCal API + MCP

Microsoft Graph Calendar API 76

msgraph-sdk-python v1.65.0 on 22 October 2026 (30). Five Python SDK tags since 4 August (v1.61.0 on 5 August to v1.65.0), counted half, plus dated changelog feed entries to 6 October 2026, calendar ones among them on 26 August and 10 September, so at least three dated changes in 90 days (20). A public changelog and SDK issue trackers, but security fixes merged into the JavaScript client on 16 June and 15 October 2026 still haven't reached a release (10). Current SDKs in most languages, with the JavaScript client the exception at 3.0.7 from 19 September 2023 (10). Active tagging on the Python repository, none of it reaching the JavaScript package (6). 30+20+10+10+6 = 76.

SavvyCal API + MCP 40

Read as a closed service. The newest dated change is the MCP integration of 27 October 2026 on the updates board (30). It is the only dated entry since 7 July, so fewer than three in 90 days (0 of 20). A public updates board, a feature request board and a support address with a stated 24-hour reply within US Central business hours (10 of 15). No official SDKs (0). No package to assess (0). 30 + 0 + 10 + 0 + 0 = 40.

Microsoft Graph Calendar API 88

$select, $top, bodyPreview and Prefer: outlook.body-content-type="text" keep event payloads small (23). @odata.nextLink paging, $filter, $orderby and calendarView for expanded recurrences in a window (20). Graph errors carry a code, message and request ID, and 429s say which throttle scope was hit (17). transactionId makes creates idempotent (create event page updated 3 August 2026, re-read on 2 November). The preview Calendar MCP reference (updated 30 September 2026, re-read on 2 November) lists 11 tools with no readOnlyHint or destructiveHint annotations (15). Official SDKs in .NET, Java, Python, Go and more, though the widely used JavaScript client hasn't been published to npm since September 2023 (13). 23+20+17+15+13 = 88.

SavvyCal API + MCP 53

List responses are sized by limit (default 20, at most 100) with no field selection. The MCP server lists 63 tools with no documented toolset or read-only list, though a client can ask for the mcp:read scope alone (10 of 25). Cursor pagination with after, before and limit, and date and status filters on events (17 of 20). Errors name the field, the failed validation and a limit count, which an agent can act on, but a 429 carries no wait time (14 of 20). No idempotency key on booking or link creation, and the MCP annotations could not be read; the docs say the assistant confirms before cancelling, deleting or inviting (6 of 20). Creating an event needs five fields, and there is no official SDK in any language (6 of 15). 10 + 17 + 14 + 6 + 6 = 53.

Microsoft Graph Calendar API 72

OAuth 2.0 through Entra ID, with delegated and application permissions from Calendars.ReadBasic (no bodies) through Calendars.Read to Calendars.ReadWrite (30). Calendars.ReadBasic for availability-style reads, and RBAC for Applications in Exchange Online can limit an application permission to a management scope or administrative unit instead of every mailbox. Nothing asks for confirmation before a delete (18). Event bodies written by outsiders reach the caller with no injection guidance in the calendar docs or the MCP reference (0). Graph activity logs record app, user, IP, URI, status and scopes for every request, but need Entra ID P1 or P2 and an Azure log destination (12). microsoft.com's security.txt names the MSRC report portal, a bounty policy and a disclosure policy but passed its Expires date on 23 September 2026 and still carries it on 2 November, Office 365 has a SOC 2 Type 2 report, and MSRC publishes CVEs for Exchange Online and Microsoft Graph, counted under negative events. Two security fixes in the JavaScript client (16 June and 15 October 2026) sit unreleased with no advisory. Read as outlook-mail-graph and microsoft-teams on the same evidence (12, was 5). 30+18+0+12+12 = 72.

SavvyCal API + MCP 50

OAuth 2 authorisation code apps with 2-hour access tokens and refresh tokens, and personal access tokens, both in the Authorization header only. The spec declares no scopes for either, and PAT expiry and revocation are not described. The MCP server uses OAuth 2.1 with PKCE S256, dynamic client registration, mcp:read and mcp:write scopes and a revocation endpoint (22 of 30). mcp:read gives a read-only MCP grant, and the vendor says the assistant asks before booking, cancelling, deleting or inviting. REST tokens have no read-only form (14 of 20). Invitee names, answers and metadata written by outsiders come back through events and webhooks with no injection guidance; the AI page says the assistant sees calendar conflicts but not event names (2 of 15). Webhook request logs and a Connected Apps list with revoke, but no per-call audit log for the operator (4 of 15). Valid security.txt to 2 May 2027, a security page and an SSDLC page, but no SOC 2 or ISO 27001 (the page says not yet) and no bug bounty (8 of 20). 22 + 14 + 2 + 4 + 8 = 50.

Microsoft Graph Calendar API 93

OpenAPI for all of Graph v1.0 in microsoftgraph/msgraph-metadata, plus CSDL metadata (25). No llms.txt, but every learn.microsoft.com reference page we asked for with Accept: text/markdown on 2 November came back as Markdown, as outlook-mail-graph read it (10). Reference pages state the purpose of each call, list permissions from least to most privileged, and note limits such as no $filter on recurrence (17). Typed properties and enums in the metadata (13). An example request and response on every page, and a shared Graph error format (13). v1.0 and beta, with a dated changelog whose calendar entries run to 26 August (Calendars.Read.All and Calendars.ReadWrite.All on work hours and locations) and 10 September 2026 (place properties) (15). 25+10+17+13+13+15 = 93.

SavvyCal API + MCP 74

OpenAPI 3.0.0 at api.savvycal.com/v1/spec covers all 22 operations with 56 schemas; the MCP tools' schemas could not be read without signing in (23 of 25). llms.txt and a Markdown twin of every docs page (10). Only 8 of the 22 operations carry a description, and those state constraints (events must match an open slot, an invalid filter resets every filter) rather than when to choose another endpoint (10 of 20). Required flags on 14 of 43 parameters, 34 enum properties across the schemas, limit bounded 1 to 100, until at most 31 days after from (12 of 15). Example values on parameters and a documented error shape keyed by field, with 400, 401, 404, 422 and 429 declared per operation, but no full response examples (10 of 15). A /v1 path and a promise that changes are additive, with dated product updates on the feedback board but no API changelog (9 of 15). 23 + 10 + 10 + 12 + 10 + 9 = 74.

Microsoft Graph Calendar API 65

Graded on the v1.0 REST API. A public Microsoft service health page at status.cloud.microsoft (20), per the 1 October check. Its robots.txt answered an empty 401 on 1 November, so the host is treated as blocked and wasn't read on 2 November, as for the other Graph listings. No readable components or incident history (5). Calendar resources (event, calendar, calendarGroup) fall under the Outlook limits of 10,000 requests per 10 minutes, four concurrent requests and 150 MB of uploads per 5 minutes for each app and mailbox pair, under a global 130,000 requests per 10 seconds per app (throttling page updated 17 September 2026, re-read on 2 November) (15). 429 responses carry Retry-After and throttle headers with backoff guidance, and event creation takes a transactionId that Microsoft documents as reducing unnecessary retries on the server, so a retried create isn't doubled (15). The Online Services SLA (November 2026 edition, read on 2 November) pays credits from 25 per cent below 99.9 per cent uptime for Exchange Online, the service that holds every work calendar, but measures downtime as users unable to send or receive email with Outlook Web Access and has no Microsoft Graph entry. None of Exchange Online's four service levels (Outlook Web Access email, email delivery time, guaranteed delivery, email ingress and egress) measures calendar access, so a calendar outage isn't downtime under it. microsoft-teams and outlook-mail-graph take 7 because their levels measure the same function the API serves (messaging and meetings, sending and receiving email), and onedrive-sharepoint 10 because its level covers reading and writing the content its API reads and writes. Here no level covers what the API does (0). Calendar endpoints are generally available on v1.0 (10). 20+5+15+15+0+10 = 65.

SavvyCal API + MCP 70

Read with the hosted lines. Instatus page at savvycal.instatus.com with App, Microsoft 365, Google Calendar and Integrations components and a month-by-month history (20). No notices from June to November 2026 and 100 per cent App uptime each month, a clean record (30). The only limit with a number is in the OpenAPI spec, 10 event creations a minute per link, failed ones included; nothing covers the rest of the API (7 of 15). That 429 is declared with no Retry-After, backoff guidance or idempotency key, and webhooks are the only place retries are described (3 of 15). No SLA; the terms give the service as is (0). The v1 API is generally available and the MCP server, announced 27 October 2026, is not marked beta (10). 20 + 30 + 7 + 3 + 0 + 10 = 70.

Microsoft Graph Calendar API 35

No x402, MPP or L402 (0). Calendar endpoints aren't on the metered API list (re-read on 2 November, only SharePoint and OneDrive assignSensitivityLabel is metered) and Microsoft 365 plan prices are public, but work calendars need a licensed mailbox (15). Personal Outlook.com accounts work with delegated permissions at no cost and no card (20). A person registers an app in Entra and, for application permissions, an admin consents (0). 0+15+20+0 = 35.

SavvyCal API + MCP 30

No x402, MPP or L402 (0). Per-seat plan prices public, nothing per call (10). A Free plan with the API, webhooks and MCP server included and no card mentioned, though booking through a link needs Basic or Premium and there is no self-serve trial (20). A person signs up in a browser and approves the OAuth consent (0). 0 + 10 + 20 + 0 = 30.