Google Calendar

Name: Google Calendar MCP Server
Availability: InStock
Author: Google Calendar

Productivity9 tools

Google's own remote MCP server for Google Calendar. List calendars, read and search events, check attendee availability, create, update, delete and RSVP to events from an AI assistant. 9 tools, 5 read-only, 1 annotated destructive.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on 18 August 2026.

Anthropic states this reflects the level of review a connector received, not a security audit.

Connect Google Calendar via MCP

https://calendarmcp.googleapis.com/mcp/v1

Works in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.

Google Calendar Tools & Capabilities (9)

list_eventsRead-only

Returns events on the given calendar matching all specified constraints. Time constraints should not be specified unless requested by the user. For open-ended keyword or topic-based searches on the primary calendar, the search_events tool must be used instead.

get_eventRead-only

Returns a single event on the given calendar.

list_calendarsRead-only

Returns the calendars this user has access to (their calendar list). Use this tool to resolve calendar identifying data (for example, 'my family calendar') into its corresponding `calendar_id` (email identifier)

suggest_timeRead-only

Suggests time periods across one or more calendars.

create_eventActs

Creates an event on the given calendar.

update_eventActs

Updates an event on the given calendar.

delete_eventDestructive

Deletes an event on the given calendar.

respond_to_eventActs

Responds to an event on a calendar.

search_eventsRead-only

Searches events on the user's primary calendar using semantic search.

Read from the server on 2026-08-18, including each tool's own safety annotations.

Limits

The destructive tool reaches other people. delete_event cancels a meeting you organised for every attendee, and with notificationLevel unset it emails them all. This is the one tool that should never sit behind blanket auto-approval, and the four documented read-only scopes are the cleanest way to make it unreachable.
The write tools notify everyone by default. All four acting tools treat an unset notificationLevel as ALL. Set it explicitly, or accept that every change an agent makes sends mail to attendees including external ones.
update_event can uninvite people while annotated non-destructive. removedAttendeeEmails removes attendees; overrideReminders replaces all existing reminders rather than adding to them. Neither is covered by the destructive flag.
Google's documented scopes cannot run four of the tools it documents. The setup page names three read-only scopes and lists create_event, update_event, delete_event and respond_to_event in the same page's Tool reference. Both the live descriptor and Google's per-tool pages require calendar.events for those four. We did not test the failure, because testing it would mean calling a writing tool.
search_events is primary-calendar only. Its schema accepts no calendarId, so semantic search cannot reach a shared or secondary calendar; only list_events with fullText can, and that is literal AND matching rather than semantic.
respond_to_event cannot counter-propose, reaching accepted, tentative and declined and nothing else. And responseStatus is an unconstrained string: unlike every other constrained field here, its valid values appear only in prose, with no JSON Schema enum a client can validate against.
Google's setup page omits search_events. Its Tool reference lists eight tools; the live server returns nine, and Google's own MCP reference index publishes a page for all nine.
No tool creates a calendar, changes sharing, or reads settings. The union of all nine input schemas contains no ACL, calendar-creation or settings field. The descriptor nonetheless advertises calendar.acls and calendar.settings.readonly among its twelve scopes, so the token can carry more authority than today's tools exercise.
This is a Developer Preview. Every Google page cited here carries the Workspace Developer Preview Program banner. Preview features can change or be withdrawn.
Prompt injection is Google's own stated risk, not ours. Google's setup page warns that MCP hosts with access to this server "can read, modify, and delete data in your Google Account", that you "must screen prompts and responses for malicious content or prompt injection attacks", and that you should avoid asking a client to process events from unverified sources because those inputs "may contain hidden instructions". On a connector whose input includes event titles and descriptions written by anyone who can invite you, that warning is load-bearing.
Anthropic's directory advertises five prompts the server does not serve. The listing names schedule_meeting and analyze_availability among five prompt_names. A live prompts/list on 2026-08-18 returned an empty array, though the server does declare a prompts capability.
We never read a calendar. Our verification was an anonymous tools/list, which returns tool definitions and no events, plus one unauthenticated tools/call of the zero-argument read-only list_calendars purely to observe the gate. It returned HTTP 401 and no data. No authenticated call was made and no event was ever read, created, changed, deleted or responded to.

Frequently asked questions

Which Google Calendar MCP tool is annotated destructive?

Exactly one of the nine: delete_event. Google annotates it destructiveHint true, idempotentHint true, readOnlyHint false. It removes an event from the calendar named in calendarId, defaulting to your primary calendar. No tool on this server restores a deleted event, and none reports what an event contained before deletion.

Can this connector delete a meeting from other people's calendars?

Yes, when you organised it. Google Calendar stores one event with copies on each attendee's calendar, so deleting an event you own removes it for every attendee. The schema makes this worse by default: notificationLevel is documented as defaulting to ALL, so deletion also emails a cancellation to everyone invited.

Can an AI agent RSVP to invitations on my behalf?

Yes. respond_to_event sets your response status to accepted, tentative or declined, and takes an optional responseComment that other attendees can read. It cannot propose a new time — Calendar's counter-proposal feature is absent from the tool surface. Google annotates it destructiveHint false, which is true of your data and silent about the social signal.

Whose availability can the Google Calendar MCP server see?

suggest_time requires an attendeeEmails array and finds free slots across those people's calendars. It reads whatever free/busy information each address already shares with your Google account, so it surfaces no more than Calendar's own scheduling view would. It is annotated read-only and requires no calendar-writing scope.

Do Google's documented OAuth scopes actually run all nine tools?

No. Google's setup page names three read-only scopes: calendar.calendarlist.readonly, calendar.events.freebusy and calendar.events.readonly. Google's own per-tool reference pages require calendar.events or calendar for create_event, update_event, delete_event and respond_to_event. Consenting to the documented three yields a read-only deployment where the four writing tools fail on authorization.

Does this connector send email to attendees?

Indirectly, and by default. Four tools take a notificationLevel enum whose unspecified value Google documents as treated as ALL, meaning every attendee is emailed. Setting NONE suppresses it and EXTERNAL_ONLY narrows it. An agent that never sets the parameter mails everyone on every create, update, delete and RSVP.

Do I need a paid plan to add Google Calendar MCP to Claude?

Yes, plus a Google Cloud project. Google states you need a Claude Enterprise, Pro, Max or Team plan and must add the server as a custom connector with your own OAuth client ID and secret. You separately enable the Google Calendar API and the Google Calendar MCP API. It is a Developer Preview feature, not a one-click install.