Calendly Integration

Calendly scheduling integration. List events, check availability, manage meetings via Calendly API.

Security Scan

The skill's purpose (Calendly integration) is plausible, but the packaging and instructions are inconsistent (the registry lists no required credential or binaries while SKILL.md expects a CALENDLY_API_KEY and a generated CLI), and the runtime instructions include optional steps that would download and execute third-party npm code — review before installing or supplying secrets.

Purpose & Capability

The skill claims to integrate with the Calendly API (listing events, cancelling, scheduling). That requires a Calendly Personal Access Token, but the registry metadata declares no required environment variables or primary credential. Also the SKILL.md and README assume a 'calendly' CLI binary exists (or can be generated), yet the package contains only README.md and SKILL.md — no CLI. These are coherence/packaging issues: the skill as published doesn't include the executable it documents and the manifest doesn't declare the real secret it needs.

Instruction Scope

Runtime instructions are explicit about which CLI commands to run and which Calendly endpoints to use. They instruct storing CALENDLY_API_KEY in environment or in ~/.moltbot/.env or ~/.clawdbot/.env and using time filters for list-events. The instructions do not request unrelated system files, but they do encourage reading/writing bot-specific dotfiles and optionally running npx mcporter to generate a CLI — which grants the agent permission to run code fetched from npm if followed.

Install Mechanism

There is no install spec in the registry (instruction-only), which is low risk. However the README/SKILL.md document using npx mcporter@latest to generate a CLI (and reference calendly-mcp-server npm). Running those commands would download and execute code from npm — a moderate-risk operation if you don't trust the upstream packages. The published skill itself does not include the CLI binary, so following the docs would require fetching external code.

Credentials

The skill requires a Calendly Personal Access Token (CALENDLY_API_KEY) to function, but the registry metadata failed to declare this. The instructions suggest placing the token in environment variables or in bot dotfiles under the user home, which are sensitive locations. No other credentials are requested, which is proportionate to the stated purpose — the concern is the missing declaration and the guidance to store secrets in shared dotfiles without explaining scoping or least-privilege.

Persistence & Privilege

The skill is not forced-always, does not request system-level installs in the registry, and does not declare modifications to other skills or global configuration. Autonomy (model-invocation) is allowed by default, which is normal. There is no indication that the skill requests persistent elevated presence.

What to consider before installing

This skill appears to be a straightforward Calendly CLI wrapper, but the published package is inconsistent and incomplete. Before installing or providing secrets: 1) Confirm provenance — this repo/author (meAmitPatil / kesslerio) and the calendly-mcp-server/npm packages are what you expect. 2) Do not paste your CALENDLY_API_KEY into shared or system-wide dotfiles unless you accept that other local processes or skills may read them; prefer a skill-specific config or runtime secret store. 3) If you must run the documented npx/mcporter commands to generate the CLI, review the code they will fetch (npm package source) — npx executes remote code. 4) Prefer an OAuth flow or least-privilege PAT and rotate the token after initial testing. 5) Because the registry metadata omits the required CALENDLY_API_KEY and the binary is not bundled, treat this package as incomplete/packaging-error rather than production-ready until fixed. If you want a definitive 'benign' judgment, ask the publisher to (a) publish the CLI binary or include a verified install spec, and (b) update the registry to declare CALENDLY_API_KEY as a required credential.

Calendly Skill

Interact with Calendly scheduling via MCP-generated CLI.

Note: Scheduling API features (list-event-types, get-event-type-availability, schedule-event) will be available once calendly-mcp-server v2.0.0 is published to npm. Current CLI uses v1.0.0 for portability.

Quick Start

# Get your Calendly profile (returns user URI)
calendly get-current-user

# List RECENT events (always use --min-start-time for recent queries!)
calendly list-events --user-uri "<YOUR_USER_URI>" --min-start-time "2026-01-20T00:00:00Z"

# Get event details
calendly get-event --event-uuid <UUID>

# Cancel an event
calendly cancel-event --event-uuid <UUID> --reason "Rescheduling needed"

Available Commands

User Info

• get-current-user - Get authenticated user details

Events

• list-events - List scheduled events (requires --user-uri)
• get-event - Get event details (requires --event-uuid)
• cancel-event - Cancel an event (requires --event-uuid, optional --reason)

Invitees

• list-event-invitees - List invitees for an event (requires --event-uuid)

Organization

• list-organization-memberships - List organization memberships

Configuration

API key can be stored in your environment or .env file:

export CALENDLY_API_KEY="<your-pat-token>"
# Or in ~/.moltbot/.env or ~/.clawdbot/.env

Get your Personal Access Token from: https://calendly.com/integrations/api_webhooks

Usage in Moltbot

When user asks about:

• "What meetings do I have?" → list-events with --min-start-time (use recent date!)
• "Cancel my 2pm meeting" → Find with list-events (time-filtered), then cancel-event
• "Who's attending X meeting?" → list-event-invitees

Note: First time, run calendly get-current-user to obtain your User URI.

Getting Your User URI

Run calendly get-current-user to get your user URI. Example:

{
  "resource": {
    "uri": "https://api.calendly.com/users/<YOUR_USER_UUID>",
    "scheduling_url": "https://calendly.com/<your-username>"
  }
}

Examples

# List next 10 events
calendly list-events \
  --user-uri "<YOUR_USER_URI>" \
  -o json | jq .

# Get event details
calendly get-event \
  --event-uuid "<EVENT_UUID>" \
  -o json

# Cancel with reason
calendly cancel-event \
  --event-uuid "<EVENT_UUID>" \
  --reason "Rescheduling due to conflict"

Coming Soon: Scheduling API (v2.0)

Once calendly-mcp-server v2.0.0 is published, these commands will be available:

Scheduling Workflow

# 1. List available event types
calendly list-event-types

# 2. Check availability for a specific event type
calendly get-event-type-availability --event-type "<EVENT_TYPE_URI>"

# 3. Schedule a meeting (requires paid Calendly plan)
calendly schedule-event \
  --event-type "<EVENT_TYPE_URI>" \
  --start-time "2026-01-25T19:00:00Z" \
  --invitee-email "[e-mail]" \
  --invitee-name "John Smith" \
  --invitee-timezone "America/New_York"

Scheduling API Requirements:

• calendly-mcp-server v2.0.0+ (unreleased as of 2026-01-21)
• Paid Calendly plan (Standard or higher)

To upgrade when v2.0 is published:

cd ~/clawd/skills/calendly
MCPORTER_CONFIG=./mcporter.json npx mcporter@latest generate-cli --server calendly --output calendly

Important: Time Filtering

Always use --min-start-time when querying recent events!

The API returns events oldest-first by default and doesn't support pagination via CLI. Without a time filter, you'll get events from years ago.

# Last 7 days
calendly list-events --user-uri "<URI>" --min-start-time "$(date -u -d '7 days ago' +%Y-%m-%dT00:00:00Z)"

# This week
calendly list-events --user-uri "<URI>" --min-start-time "2026-01-20T00:00:00Z" --max-start-time "2026-01-27T23:59:59Z"

# Future events only
calendly list-events --user-uri "<URI>" --min-start-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)"

Notes

• All times in API responses are UTC (convert to Pacific for display)
• Event UUIDs are found in list-events output
• OAuth tools available but not needed with Personal Access Token
• No pagination support in CLI - use time filters instead

---

Generated: 2026-01-20
Updated: 2026-01-21 (Portable CLI with npm v1.0.0; v2.0 scheduling features pending upstream publish)
Source: meAmitPatil/calendly-mcp-server via mcporter