← CalendarMCP

Changelog

What's shipped. Reverse chronological.

security

API keys and Google tokens are no longer stored in readable form

  • ·API keys are stored as one-way fingerprints. Your key works as before, but the dashboard shows it only once: when you sign up or rotate it. Lost it? Rotate and update your clients.
  • ·Google refresh tokens are encrypted by CalendarMCP before they reach the database, and each one opens only on its own connection.
  • ·Every tool now tells MCP clients whether it only reads or can change your calendar, and list_calendars names the account each calendar belongs to.
feature

Agent-friendly event write schema

  • ·create_event, update_event, and batch_update_events now use Google Calendar-style start/end objects.
  • ·create_event and update_event return structuredContent with eventId and the event object.
  • ·/docs and /api/docs updated so agents discover the write shape directly from the product docs.
seo

Integrations directory, changelog, showcase

  • ·Added /integrations page with setup guides for 14 MCP clients.
  • ·Per-client deep-dive pages: Claude Desktop, Claude Code, Cursor, OpenClaw.
  • ·/changelog (this page), /showcase gallery, and Outlook/iCloud waitlist landing pages.
  • ·Sitemap and footer updated with all new routes.
blog

Blog posts on scheduling, executive assistant, and MCP patterns

  • ·Published five trickle-scheduled blog posts covering real CalendarMCP workflows.
  • ·Topics: travel planning, executive assistant patterns, scheduling automation, team coordination.
  • ·Force-dynamic rendering on blog slug pages so scheduled posts unhide on time.
ops

Stray edit capture + blog infrastructure cleanup

  • ·Captured uncommitted edits from prior automated runs.
  • ·Blog infrastructure stabilization: slug routing, publish-date filtering, sitemap sync.
feature

Ops hardening: test-connection, rate limiting, per-key last-used

  • ·Added test_connection tool. Agents can verify auth without touching real calendar data.
  • ·Per-key rate limiting at the API layer. Default: 100 requests per 60-second window.
  • ·last_used timestamp now tracked per API key. Visible on the dashboard.
  • ·registerTool utility for cleaner tool registration without boilerplate.
  • ·CI smoke test and deploy health check on every push to master.
feature

Per-calendar read/write permissions matrix

  • ·Dashboard now shows a read/write toggle per calendar per Google connection.
  • ·Agents are blocked from writing to read-only calendars at the API layer.
  • ·Read-only guard returns a descriptive error: "Calendar is configured as read-only."
  • ·Matrix grouped by connection for accounts with many calendars.
  • ·Long calendar IDs truncated in the UI to prevent table overflow.
feature

Multi-connection accounts + per-connection calendar management

  • ·A single API key can now hold multiple Google Calendar connections (e.g., work + personal).
  • ·Dashboard "Add calendar" affordance per connection.
  • ·Service account email shown inline in the connection Manage panel.
  • ·Docs updated to reflect multi-connection model.
security

Auth hardening, PostHog analytics, SEO landing pages

  • ·Closed an auth bypass in the OAuth connect flow. Setup flow locked down.
  • ·Removed hardcoded Supabase service key that was present in an early commit.
  • ·OAuth reconnect path correctly branches between update vs. insert.
  • ·PostHog installed with a first-party proxy at /api/ph. Event catalog documented.
  • ·Added sitemap.ts, robots.txt, and improved OG/meta tags across all routes.
  • ·New SEO landing pages: /pricing, /use-cases, /advanced-protection.
  • ·Homepage redesigned as a full marketing landing page.
  • ·Blog infrastructure added with first 5 scheduled posts.
feature

batch_update_events, list_events pagination, /docs page

  • ·batch_update_events: update up to 50 events in a single concurrent API call.
  • ·list_events now supports pagination (pageToken) and a q search param.
  • ·Added /docs page with human-readable tool documentation.
  • ·/api/docs returns machine-readable JSON schema for all 10 tools.
  • ·update_event gains: reminders, transparency, visibility, colorId, attendees, recurrence.
feature

All-day event support

  • ·create_event and update_event gained first-class all-day event support.
  • ·All-day events use Google Calendar date fields, not datetime. Correct behavior for full-day blocks.
infra

Domain migration to calendarmcp.ai, logo and favicon

  • ·All URLs migrated from calendarmcp.vercel.app to calendarmcp.ai.
  • ·New logo, favicon, and app icons across all pages.
feature

Multi-calendar support and service account setup flow

  • ·list_calendars returns all calendars on the connected account.
  • ·All 10 tools accept a calendarId param to target a specific calendar.
  • ·Service account setup wizard at /setup/service-account for Google Advanced Protection users.
infra

Multi-user OAuth system and API key auth

  • ·Full multi-user OAuth flow replacing single service account.
  • ·Each user gets an isolated API key (cmcp_...) after connecting Google.
  • ·Supabase schema: users, connections, api_keys tables. Keys use pgcrypto-backed random defaults.
  • ·Lazy Supabase init for Vercel cold-start compatibility.
feature

Dual-mode auth: OAuth2 + service account

  • ·Two auth paths: standard Google OAuth and service account (for Advanced Protection).
  • ·manage_attendees re-enabled after fixing sendUpdates defaulting to "none".
  • ·Advanced Protection constraint and attendee limitations documented.
launch

Initial release

  • ·Google Calendar MCP server with 9 tools: list_events, get_event, create_event, update_event, delete_event, quick_add_event, list_calendars, find_free_time, manage_attendees.
  • ·Single-user service account auth.
  • ·Deployed on Vercel. Auto-deploy on push to master.