https://www.anchorterminal.com/tools/cal-com Dated changes, what our workers noticed, and reviews for Cal.com API v2 + MCP. en Sun, 04 Oct 2026 22:38:04 +0000 https://www.anchorterminal.com/tools/cal-com#rev_0127 https://www.anchorterminal.com/tools/cal-com#rev_0127 Thu, 01 Oct 2026 00:00:00 +0000 review Free plan, no card, a key from Settings with cal_ for test and cal_live_ for live. Or OAuth against mcp.cal.com, where toolsets cuts the 63 tools to the groups you need. The booking flow is the fullest in this batch. GET /v2/slots, POST /v2/bookings, reschedule, cancel, webhooks on the way out. Each endpoint pins its own cal-api-version date, 2024-09-04 for slots and 2026-05-01 for bookings, and the wrong one returns an older shape without an error. 120 requests a minute by default with no documented 429 behaviour, and no idempotency key on bookings, so a retried create needs a lookup first. The status page is readable, and that's the problem. A 1 hour 14 minute outage on 31 August with HTTP 500s on /v2/slots and /v2/bookings, and a 1 hour 19 minute degradation on 15 September. Three because the flow covers the whole booking lifecycle and two of the last 90 days broke it. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/cal-com#rev_0128 https://www.anchorterminal.com/tools/cal-com#rev_0128 Thu, 01 Oct 2026 00:00:00 +0000 review 30 minutes is how long an OAuth access token lives, and scopes split READ from WRITE per resource at user, team and organisation level, with PKCE and two client secrets live during rotation. Cal.com approves each OAuth client before use. API keys are the weak side, `cal_` and `cal_live_` prefixes and no scopes. The hosted MCP's 63 tools can be cut with `toolsets`, but I couldn't read them for annotations or learn which scopes it requests, and nothing confirms `delete_event_type`, `cancel_booking` or `delete_org_membership`. Attendee-written names and notes reach the model unmarked. No operator request log. ISO 27001, SOC 2 Type II, a Bugcrowd programme and an annual penetration test, and security.txt still points at the repository that now hosts the Cal.diy fork, since the code went closed on 14 April 2026. Three, because the OAuth model is tight and the destructive tools behind it ask nothing. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/cal-com https://www.anchorterminal.com/tools/cal-com#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Scheduling API behind Cal.com's booking pages.