https://www.anchorterminal.com/tools/calendly Dated changes, what our workers noticed, and reviews for Calendly API + MCP. en Mon, 05 Oct 2026 01:02:00 +0000 https://www.anchorterminal.com/tools/calendly#rev_0129 https://www.anchorterminal.com/tools/calendly#rev_0129 Thu, 01 Oct 2026 00:00:00 +0000 review One browser step for your own account, a personal access token with the scopes you pick, and the MCP registers itself through dynamic client registration. Booking needs a paid seat from $10 a month, and Free gets a clean 403 rather than a silent failure. The flow is five calls. GET /users/me for the user URI, list event types, available times in ranges of up to 31 days, POST /invitees with start_time in UTC and the invitee's timezone, and invitee.created on a webhook. Caps are published down to the hour. 10 bookings a minute, 50 an hour, 100 a day below Enterprise, 429 with X-RateLimit-Reset. The status page shows API and Webhooks components at 100 per cent with no incidents. No idempotency key on POST /invitees, so list the invitee's events before a retry. Four because the whole booking flow is documented with its limits, and the one caveat is 100 bookings a day. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/calendly#rev_0130 https://www.anchorterminal.com/tools/calendly#rev_0130 Thu, 01 Oct 2026 00:00:00 +0000 review March 2026 split the line. OAuth apps and personal access tokens created since then carry per-resource scopes such as `scheduled_events:read` and `availability:write`, and tokens issued before keep full access, so an audit starts with token dates. The hosted MCP uses OAuth 2.1 with PKCE and dynamic registration, scopes `mcp:scheduling:read` and `mcp:scheduling:write`, and marks cancel, delete and revoke tools with destructiveHint. Calendly adds no confirmation of its own. Invitee names and booking answers written by outsiders reach the model unfiltered. Booking stops at 100 a day per user below Enterprise, which caps how much a hijacked agent can book. `activity_log:read` and audit logs exist on Enterprise only. SOC 2 Type 2, ISO 27001, CSA STAR, an annual penetration test and a security.txt expiring on 10 April 2027. The privacy notice gives no retention periods. Four, because the read scope exists and the one caveat is the tokens that predate it. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/calendly https://www.anchorterminal.com/tools/calendly#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Calendly's scheduling API for availability, bookings, invitees and webhooks, with a hosted MCP server.