Nylas Calendar and Scheduler API vs SavvyCal API + MCP

Nylas Calendar and Scheduler API 88

Changelog entries up to 30 October 2026, the last calendar-specific one on 22 October with event webhook, recurring cancellation and Microsoft availability fixes (30). 20 dated changelog entries between 15 September and 30 October (20). Public dated changelog, open SDK repositories with commits to 30 September (Python) and 13 October (Node), and support (15). Current official SDKs (15). nylas-python v6.18.0 on 30 September 2026. The Node SDK's package.json is still 8.4.0 (24 June 2026) with unreleased commits on main to 13 October (8). 30+20+15+15+8 = 88.

SavvyCal API + MCP 40

Read as a closed service. The newest dated change is the MCP integration of 27 October 2026 on the updates board (30). It is the only dated entry since 7 July, so fewer than three in 90 days (0 of 20). A public updates board, a feature request board and a support address with a stated 24-hour reply within US Central business hours (10 of 15). No official SDKs (0). No package to assess (0). 30 + 0 + 10 + 0 + 0 = 40.

Nylas Calendar and Scheduler API 85

Nylas IAM, launched 6 October 2026, issues API keys bound to one grant, workspace, application or organisation with roles and permissions. Every new IAM key expires, keys can be disabled or rotated, and the IAM guide (re-read 1 November) shows principals and credentials created and rotated through a public /v3/iam API once a first management key is made in the Dashboard. End users connect through OAuth with scopes the app picks. Application keys still reach every grant, so 1 is held back as for nylas-email, and 1 more because the IAM pages name no calendar permission, as nylas-notetaker holds back for Notetaker (28). A principal can be bound to one grant with read permissions, the agent security page shows a scheduling agent limited to reading calendars and creating events, and anything outside the binding answers 403. The MCP confirmation step covers email sends only, so creating, updating or deleting an event needs no confirmation. 3 below nylas-email's 17, which has the send confirmation (14). The MCP and agent security docs say event descriptions and locations can carry hidden instructions and tell agents to treat calendar content as untrusted (13). IAM Access Activity records allowed and denied API, authentication and MCP requests for 400 days with links to request logs, and Dashboard logs are kept 14 days. Requests made with an application key appear only in the logs (13). SOC 2 Type II, ISO 27001 and 27701, CSA STAR, an annual penetration test and a private bug bounty with security@nylas.com, per the 1 October check, and an RFC 9116 security.txt on developer.nylas.com valid to 1 August 2027. www.nylas.com still has none. nylas-email scores this 17 (17). 28+14+13+13+17 = 85.

SavvyCal API + MCP 50

OAuth 2 authorisation code apps with 2-hour access tokens and refresh tokens, and personal access tokens, both in the Authorization header only. The spec declares no scopes for either, and PAT expiry and revocation are not described. The MCP server uses OAuth 2.1 with PKCE S256, dynamic client registration, mcp:read and mcp:write scopes and a revocation endpoint (22 of 30). mcp:read gives a read-only MCP grant, and the vendor says the assistant asks before booking, cancelling, deleting or inviting. REST tokens have no read-only form (14 of 20). Invitee names, answers and metadata written by outsiders come back through events and webhooks with no injection guidance; the AI page says the assistant sees calendar conflicts but not event names (2 of 15). Webhook request logs and a Connected Apps list with revoke, but no per-call audit log for the operator (4 of 15). Valid security.txt to 2 May 2027, a security page and an SSDLC page, but no SOC 2 or ISO 27001 (the page says not yet) and no bug bounty (8 of 20). 22 + 14 + 2 + 4 + 8 = 50.

Nylas Calendar and Scheduler API 71

38 MCP tools with no toolsets found on 1 November (5), plus 5 for limit and select field selection on the REST API (10). Page tokens and time filters on event lists (18). Typed errors with a request ID and a provider error passed through, and a retry table (18). The MCP needs a confirmation call before sending mail, but event create, update and delete need none, event writes have no idempotency key and we found no tool annotations (10). Official SDKs in Node, Python and more (15). 10+18+18+10+15 = 71.

SavvyCal API + MCP 53

List responses are sized by limit (default 20, at most 100) with no field selection. The MCP server lists 63 tools with no documented toolset or read-only list, though a client can ask for the mcp:read scope alone (10 of 25). Cursor pagination with after, before and limit, and date and status filters on events (17 of 20). Errors name the field, the failed validation and a limit count, which an agent can act on, but a 429 carries no wait time (14 of 20). No idempotency key on booking or link creation, and the MCP annotations could not be read; the docs say the assistant confirms before cancelling, deleting or inviting (6 of 20). Creating an event needs five fields, and there is no official SDK in any language (6 of 15). 10 + 17 + 14 + 6 + 6 = 53.

Nylas Calendar and Scheduler API 91

OpenAPI 3.1 file at developer.nylas.com/openapi.json with 140 paths and 244 operations on 1 November, 20 of the paths and 34 operations for calendars, events, availability and scheduling (25). llms.txt and Markdown docs (10). Guides say when to use each API, and the MCP page lists each tool with a one-line purpose and no when-not-to guidance (15). Typed parameters in the reference (12). An errors page with a JSON shape (type, message, provider_error, request_id) and a retry yes or no for each status code (14). v3 in the path and a dated changelog with 20 entries between 15 September and 30 October 2026 (15). 25+10+15+12+14+15 = 91.

SavvyCal API + MCP 74

OpenAPI 3.0.0 at api.savvycal.com/v1/spec covers all 22 operations with 56 schemas; the MCP tools' schemas could not be read without signing in (23 of 25). llms.txt and a Markdown twin of every docs page (10). Only 8 of the 22 operations carry a description, and those state constraints (events must match an open slot, an invalid filter resets every filter) rather than when to choose another endpoint (10 of 20). Required flags on 14 of 43 parameters, 34 enum properties across the schemas, limit bounded 1 to 100, until at most 31 days after from (12 of 15). Example values on parameters and a documented error shape keyed by field, with 400, 401, 404, 422 and 429 declared per operation, but no full response examples (10 of 15). A /v1 path and a promise that changes are additive, with dated product updates on the feedback board but no API changelog (9 of 15). 23 + 10 + 10 + 12 + 10 + 9 = 74.

Nylas Calendar and Scheduler API 40

No x402, MPP or L402 (0). Per-account prices published without login, such as $1.50 a calendar-only account a month on Pro monthly and $1.35 on annual, re-read 1 November (20). Free plan with 5 connected accounts, "No credit card required" (20). Keys can be minted by API, but only after a person makes a first management key in the Dashboard after a browser signup, and each calendar owner completes OAuth (0). 0+20+20+0 = 40.

SavvyCal API + MCP 30

No x402, MPP or L402 (0). Per-seat plan prices public, nothing per call (10). A Free plan with the API, webhooks and MCP server included and no card mentioned, though booking through a link needs Basic or Premium and there is no self-serve trial (20). A person signs up in a browser and approves the OAuth consent (0). 0 + 10 + 20 + 0 = 30.

Nylas Calendar and Scheduler API 82

Closed service under Californian law, with MIT SDKs (15). The privacy policy keeps customer data for the life of the account plus two months and lets EEA customers pick UK or US data centres, per the 1 October check and as nylas-email read it on 1 November. A sub-processor page dated 28 August 2026, with changes announced on the status page (24). v2 deprecation documented and a dated changelog, but no deprecation policy found. The 10 October changelog capped availability ranges at 732 days on the day it took effect (10). Sub-processors listed, AWS and GCP named as hosts, US and EU regions (18). 15+24+10+18 = 67.

SavvyCal API + MCP 73

Closed service with terms that name SavvyCal, Inc. under Minnesota law and forbid automated access to the site, with the API left to the developer docs (15 of 30). The privacy policy (17 October 2026), DPA (16 January 2023) and processor list (24 October 2026) agree on US hosting, Stripe and return or destruction on termination, but no retention period is stated beyond account lifetime (22 of 30). The developer overview promises additive changes; there is no deprecation policy or dated notice, and the terms allow any feature to change without notice (5 of 20). A processor list with purposes, hosting on Fly.io in Virginia and Crunchy Bridge on AWS us-east, but no locations per processor (15 of 20). 15 + 22 + 5 + 15 = 57.