caldav-mcp

# caldav-mcp

<!-- badges: start -->

[![CI](https://img.shields.io/github/actions/workflow/status/ni-c/caldav-mcp/ci.yml?branch=main&label=CI)](https://github.com/ni-c/caldav-mcp/actions/workflows/ci.yml)
[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ni-c/caldav-mcp/badge)](https://scorecard.dev/viewer/?uri=github.com/ni-c/caldav-mcp)
<a href="https://socket.dev/npm/package/@ni-c/caldav-mcp"><img src="https://socket.dev/api/badge/npm/package/@ni-c/caldav-mcp" alt="Socket supply-chain report" height="20"></a>
[![Glama score](https://glama.ai/mcp/servers/ni-c/caldav-mcp/badges/score.svg)](https://glama.ai/mcp/servers/ni-c/caldav-mcp)
<br>
[![npm version](https://img.shields.io/npm/v/%40ni-c%2Fcaldav-mcp)](https://www.npmjs.com/package/@ni-c/caldav-mcp)
[![container image](https://img.shields.io/badge/ghcr.io-ni--c%2Fcaldav--mcp-4f46e5?logo=docker&logoColor=white)](https://github.com/ni-c/caldav-mcp/pkgs/container/caldav-mcp)
[![HTTP via mcp-hub](https://img.shields.io/badge/HTTP-via%20mcp--hub-4f46e5?logo=modelcontextprotocol&logoColor=white)](https://mcp-hub.ni-c.de)
<br>
[![docs](https://img.shields.io/badge/docs-caldav--mcp.ni--c.de-4f46e5?logo=readthedocs&logoColor=white)](https://caldav-mcp.ni-c.de)
[![sponsor](https://img.shields.io/badge/sponsor-ni--c-ea4aaa?logo=githubsponsors&logoColor=white)](https://github.com/sponsors/ni-c)
<!-- badges: end -->

A [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server for
[CalDAV](https://datatracker.ietf.org/doc/html/rfc4791), the open calendar
standard behind Nextcloud, Radicale, Baikal, SOGo, Fastmail, mailbox.org and
iCloud.

Lets MCP clients like Claude Code, Claude Desktop or Codex work with your
calendar: see what is on, find a free slot, create and change events, keep tasks
and dated notes, and answer an invitation — against your own server, with no
vendor API in between.

Twenty-two tools is the ceiling, not the floor: `CALDAV_ALLOW_TOOLS=essential`
registers a curated seven instead, and a model picks the right tool far more
reliably from seven than from twenty-two — see
[choosing which tools load](#choosing-which-tools-load).

<picture>
  <source media="(prefers-color-scheme: dark)" srcset="https://caldav-mcp.ni-c.de/architecture-dark.svg">
  <source media="(prefers-color-scheme: light)" srcset="https://caldav-mcp.ni-c.de/architecture-light.svg">
  <img alt="An MCP client speaks stdio to caldav-mcp, which speaks WebDAV over HTTPS to a CalDAV server. Answers come back marked as untrusted calendar content." src="https://caldav-mcp.ni-c.de/architecture.svg">
</picture>

![Two tool calls against a local Radicale: listing the calendars this server may use, and expanding a weekly meeting into its occurrences.](https://caldav-mcp.ni-c.de/demo.gif)

## What makes it different

**Recurring entries are expanded here, not asked of the server.** A weekly
meeting is stored as one rule plus a handful of exceptions; this server turns
that into individual occurrences, each with an id of its own, so one of them can
be moved without touching the rest. RFC 4791 does offer server-side expansion —
but support for it is uneven and its absence is _silent_: a server that ignores
the request answers with the master component, so the result looks thin rather
than wrong. Doing it here behaves the same everywhere, and it means a 09:00
meeting stays at 09:00 across a daylight-saving change.

**Times carry their zone, not just an offset.** Every timestamp comes back three
ways at once: the instant with an explicit offset, the IANA zone the entry was
written in, and a flag for whole-day entries. Only the zone survives a
daylight-saving change — an event pinned to `+02:00` moves an hour every winter —
and a whole-day entry reported as midnight is how a public holiday shows up as a
one-minute appointment.

**Writing reads first, and never rebuilds.** A CalDAV `PUT` replaces the entire
resource, so every change here is applied to the entry _as stored_. The
properties this server does not model — attendees, attachments, reminders it
cannot write, whatever a vendor added — survive because they are never touched,
not because anything preserves them. Every write carries the entry's ETag, so a
change somebody made in the meantime is reported instead of overwritten, and an
entry too large to read in full is refused rather than written from a truncated
read.

**Calendar content is treated as somebody else's writing.** On a server with
scheduling enabled, anyone who knows your address can put an entry in your
calendar without you accepting it. Summaries, descriptions, locations and
organiser names are therefore marked as untrusted data, stripped of the
characters a reader cannot see, and — for a single entry — fenced inside a
delimiter the entry itself cannot forge.

## Requirements

- Node.js 22 or newer, or Docker
- A CalDAV server and an account on it

Most hosted services want an **app-specific password** rather than the account
password: Nextcloud, Fastmail and iCloud all issue one per application. Google
Calendar is not supported — it requires OAuth and has deprecated password
authentication for CalDAV.

Tested against Radicale and Baikal (sabre/dav) in CI on every pull request.

## Configuration

| Variable                 | Required | Description                                                                                                                                                                           |
| ------------------------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `CALDAV_URL`             | yes      | Root of the CalDAV server, e.g. `https://dav.example.net`. A calendar collection URL works too and limits the server to that one calendar.                                            |
| `CALDAV_USERNAME`        | yes¹     | Account name.                                                                                                                                                                         |
| `CALDAV_PASSWORD`        | yes¹     | Password or app-specific password. Deleted from the environment once read.                                                                                                            |
| `CALDAV_TOKEN`           | yes¹     | Bearer token instead of username and password. Not both.                                                                                                                              |
| `CALDAV_CALENDARS`       | no       | Comma-separated calendars this server may touch, by path or final path segment. Default: every calendar the account can see.                                                          |
| `CALDAV_TIMEZONE`        | no       | IANA zone for timestamps that carry no offset, e.g. `Europe/Berlin`. Default `UTC`.                                                                                                   |
| `CALDAV_USER_EMAIL`      | no       | The address you are invited as, so `respond_to_event` can find your own attendee line.                                                                                                |
| `CALDAV_MAX_EVENTS`      | no       | Entries a listing returns by default, 1–500. Default `100`.                                                                                                                           |
| `CALDAV_READ_ONLY`       | no       | `true` registers only the read tools. Default `false`.                                                                                                                                |
| `CALDAV_INSECURE_TLS`    | no       | `true` accepts a self-signed certificate **on the configured host only**. Default `false`.                                                                                            |
| `CALDAV_ALLOW_PLAINTEXT` | no       | `true` allows a plain `http://` URL to a host that is not loopback, which sends the credentials unencrypted on every request. Otherwise such a URL refuses to start. Default `false`. |
| `CALDAV_ALLOW_TOOLS`     | no       | Tool names, a prefix with one trailing `*`, or `essential`.                                                                                                                           |
| `CALDAV_DENY_TOOLS`      | no       | Subtracted from whatever the allow list left.                                                                                                                                         |
| `ELICITATION`            | no       | **Not prefixed** — one export reaches every MCP server in the environment. `false` makes guarded tools use the two-call token instead of a dialog. Default `true`.                    |

¹ Either `CALDAV_USERNAME` + `CALDAV_PASSWORD`, or `CALDAV_TOKEN`.

Booleans are compared against the literal string `true` where the switch _lifts_
a protection (`CALDAV_INSECURE_TLS`, `CALDAV_ALLOW_PLAINTEXT`), and read tolerantly — `1`, `yes`, `TRUE` —
where it turns one on (`CALDAV_READ_ONLY`). A typo should never quietly remove a
guard.

The server starts without credentials on purpose, so a registry or a sandbox
inspector can list its tools; every call then fails with setup instructions.

### Choosing which tools load

Twenty-two tools is a lot of context on every request, and a model picks worse
from a long list than from a short one.

```sh
CALDAV_ALLOW_TOOLS=essential                       # a curated seven
CALDAV_ALLOW_TOOLS=list_events,get_event,create_event
CALDAV_ALLOW_TOOLS=list_*                          # one trailing * only
CALDAV_DENY_TOOLS=delete_event                     # subtracted from the above
```

`essential` selects `list_calendars`, `list_events`, `get_event`,
`search_events`, `get_free_busy`, `create_event` and `update_event` — enough to
see what is on, find a gap and put something in, with nothing irreversible in
re