Skip to content

Conecto Calendar

chat.conecto/calendarconecto.chatstreamable-httpv1.0.0Scanned

Booking pages, free times and meetings for your agent. Pay per action.

41 tools: 3 can delete or cancel things, 1 do something that can't be undone, 21 change things and 16 only read.

Tools: 3 delete, 1 irreversible, 21 write, 16 read.
  • Reads private data · 12
  • Reads text others write · 5
  • Can send data out · 5
  • 6 findings

Anlyon alternative

25 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

41 tools

Deletes or cancels 3Claude Code: deny
  • account_erase_personErases one person across every area when they ask (GDPR Art.No findings

    Why it is in this group

    • The name "account_erase_person" says "erase": a word for removing or ending something.
    • The description says "Can't be undone".
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Erases one person across every area when they ask (GDPR Art. 17), once you know it is them (they wrote from that address, or confirmed it). Their CRM contact, chat visitor, past meetings and calls are anonymised, so deals stay without them, and a meeting they were only a guest at drops them; their chats, CRM history, form and routing form answers, job applications with the CV, newsletter subscriptions and events are deleted, and the call log's contents that name them are cleared. Kept, each with its reason in the result: accounting records, employment records, signed documents, the audit log, the account's own settings, upcoming meetings, and emails and tickets (outreach emails and replies too) unless correspondence is true. Their address goes on the suppression lists, so it is never mailed again: outreach campaigns stop for them at once. Can't be undone; the owner is emailed. A key of a team other than the company-wide one gets owner_required: pass the request to the owner. Free. Free.

    Annotations the server declares

    • title: Erase a person's data
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • account_refund_topupRefund a top-up paid in the last 24 hours that none of has been used yet: its credit, with the first top-up's bonus, leaves the balance, and the card gets the credit back with its …No findings

    Why it is in this group

    • The name "account_refund_topup" says "refund": a word that usually means money moves, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Refund a top-up paid in the last 24 hours that none of has been used yet: its credit, with the first top-up's bonus, leaves the balance, and the card gets the credit back with its tax. The service fee is kept. Without topup_id, the newest top-up (GET /v1/topups lists them with their ids). Free. Free.

    Annotations the server declares

    • title: Refund a top-up
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • calendar_cancelCancel a booking.No findings

    Why it is in this group

    • The name "calendar_cancel" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Cancel a booking. The attendee, the guests and the hosts are told by email (unless notify is false). Costs $0.01 per call; nothing if it fails.

    Annotations the server declares

    • title: Cancel a meeting
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
Can't be undone 1Claude Code: ask
  • account_emit_eventSend an event you name, custom.<name> (custom.lead_qualified, custom.order_shipped), to every channel subscribed to it (notify_subscribe with "custom.*" or its name: Slack, Teams, …Can send data outNo findings

    Why it is in this group

    • The description's first verb is "send": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • outboundThe description's first verb is "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Send an event you name, custom.<name> (custom.lead_qualified, custom.order_shipped), to every channel subscribed to it (notify_subscribe with "custom.*" or its name: Slack, Teams, a webhook to Zapier, Make, n8n or the business's own systems) and to account_events, where another team's bot can pick it up. data is any JSON object (up to 10 KB); sent_by is added with this bot's name and team. $0.005 for each channel it goes to; free when no channel is subscribed. Costs $0.005 per channel it goes to; nothing if none are found.

    Annotations the server declares

    • title: Send an event of your own
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Changes things 21Claude Code: ask
  • account_add_approval_ruleMake a tool wait for a person: every call of it, those whose argument is over a number (like invoices_create_credit_note when amount is over 500), or those whose argument is one of…No findings

    Why it is in this group

    • The name "account_add_approval_rule" says "add": a word for a change.
    Description, as the server wrote it
    Make a tool wait for a person: every call of it, those whose argument is over a number (like invoices_create_credit_note when amount is over 500), or those whose argument is one of some values (like connect_call when method is POST, PUT, PATCH or DELETE). A held call answers approval_required with an approval_id and asks the approver; when they approve, call again with the same arguments, once (a call no person answers for adds the approval: header X-Conecto-Approval, or _meta.approvalId over MCP). The approver is an email, a saved channel, or a team (its managers, or everyone in it); each approver gets a link of their own, and the person whose call it is never approves it. With two_people_over, calls whose argument is over it need two people. Bills like Xero's bill approval: purchasing_create_bill with argument total holds bills over an amount, tax included; a rule on purchasing_pay_bill also holds batches with such a payment. Removing a rule is the owner's, on their account page, when the account has an owner email. $0.001. Costs $0.001 per call; nothing if it fails.

    Annotations the server declares

    • title: Hold a tool for approval
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • account_assign_teamMove a form, a meeting type, a job, an inbox, a phone number, a newsletter, the website chat, a rental, a pipeline, a table or a website to a team.No findings

    Why it is in this group

    • The name "account_assign_team" says "assign": a word for a change.
    Description, as the server wrote it
    Move a form, a meeting type, a job, an inbox, a phone number, a newsletter, the website chat, a rental, a pipeline, a table or a website to a team. What happens through it is charged to that team from now on (a form's responses, a number's calls, an inbox's tickets), and its rental moves with it. Something a bot makes already belongs to the bot's team. Only a key of the company-wide team without limits moves things between teams. $0.001. Costs $0.001 per call; nothing if it fails.

    Annotations the server declares

    • title: Give something to a team
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • account_balanceThe account balance, how much of it is credit bought (AI visibility and the phone run only on that) and how much free and bonus credit, what running calls are holding, this key's d…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The account balance, how much of it is credit bought (AI visibility and the phone run only on that) and how much free and bonus credit, what running calls are holding, this key's daily budget, the auto-reload state, and how much of this month's free reads and downloads is used. Free.

    Annotations the server declares

    • title: Check balance
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • account_data_locationsWhere each area's data is stored and processed: the company that runs each place, the country or region, and what it holds.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Where each area's data is stored and processed: the company that runs each place, the country or region, and what it holds. Every area keeps its records in the database and runs on Conecto's servers; some also use a service named here (email, phone, PDFs, search). For the business's records of processing and its transfer assessments (GDPR Art. 30 and 44). Free.

    Annotations the server declares

    • title: See where the data is
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • account_eventsWhat happened in this account that someone outside the bot did, oldest first: applications, bookings, form responses, signatures, replies, emails received, goals reached on the web…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    What happened in this account that someone outside the bot did, oldest first: applications, bookings, form responses, signatures, replies, emails received, goals reached on the website; and the custom events bots sent with account_emit_event. Kept 30 days. Poll with after = the last event_id you saw. Free.

    Annotations the server declares

    • title: Read recent events
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • account_export_allEverything this account holds, in ZIP files of up to 24 MB saved to its file store: every record of every area as JSON Lines, and the stored files themselves, with a README saying …1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Info

      The description mentions "Credentials".

      Matched text

      description: "...es, with a README saying what is where. Credentials are left out. Runs in the background: p..."

      What this check looks for
    Description, as the server wrote it
    Everything this account holds, in ZIP files of up to 24 MB saved to its file store: every record of every area as JSON Lines, and the stored files themselves, with a README saying what is where. Credentials are left out. Runs in the background: poll the call with account_get_call; the result has a download link for each part. The parts open only for this key and for the owner's and admins' own keys that neither only read nor only draft. A key of a team other than the company-wide one gets owner_required. Free (EU Data Act). One at a time, three a day; the owner is emailed when an export is made. Free. Runs in the background: the reply has a call_id; poll it with the account_get_call tool or GET /v1/calls/<id>.

    Annotations the server declares

    • title: Export everything
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • account_export_personEverything account_find_person finds about one person in one ZIP in the file store: their records as JSON Lines (credentials left out) and the files those records point to, like a …Can send data out1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a destination (input.phone): what the tool writes goes there.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...ile store: their records as JSON Lines (credentials left out) and the files those records p..."

      What this check looks for
    Description, as the server wrote it
    Everything account_find_person finds about one person in one ZIP in the file store: their records as JSON Lines (credentials left out) and the files those records point to, like a CV. Give the person the download link when they ask for a copy of their data (GDPR Art. 15 and 20), once you know it is them. The ZIP opens only for this key and for the owner's and admins' own keys that neither only read nor only draft. A key of a team other than the company-wide one gets owner_required: pass the request to the owner. Free; 20 a day. Free.

    Annotations the server declares

    • title: Export a person's data
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • account_pause_teamStops every key of a team at once, this one too if it is the team's: their calls are refused until the owner starts the team again on their account page.No findings

    Why it is in this group

    • The description's first verb is "stop": a word for a change.
    Description, as the server wrote it
    Stops every key of a team at once, this one too if it is the team's: their calls are refused until the owner starts the team again on their account page. For a bot that misbehaves or a team that spends too fast. Free. Free.

    Annotations the server declares

    • title: Pause a team
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • account_request_limitAsk Conecto to raise one of the business's limits: which one (or other, saying which), the number it needs, and why, in 40 to 2,000 characters.No findings

    Why it is in this group

    • The name "account_request_limit" says "request": a word for a change.
    Description, as the server wrote it
    Ask Conecto to raise one of the business's limits: which one (or other, saying which), the number it needs, and why, in 40 to 2,000 characters. Conecto reviews it and approves (maybe with less) or declines; the answer comes as the account.limit_request_answered event and by email to the owner, who is also told now. For an account that has topped up; one request per limit at a time, five in 30 days. Free. Free.

    Annotations the server declares

    • title: Ask for a higher limit
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • account_save_teamA department, location or project group of the account, like Support, Finance or the Hamburg shop.No findings

    Why it is in this group

    • The name "account_save_team" says "save": a word for a change.
    Description, as the server wrote it
    A department, location or project group of the account, like Support, Finance or the Hamburg shop. Its keys (POST /v1/keys with "team") can only work in its areas, only read when read_only is on, and spend against its budget (monthly_budget_usd per budget_period: a month, a fiscal quarter or year, or a project total): a hard budget refuses the call that would pass it, a soft one only warns. At alert_percent you get the event account.budget_alert and the owner an email, once a period. erp_code is the team's cost center in the company's ERP, for statements. drafts_only makes every write of its keys wait for one of its managers (or the owner), for a new bot that should only draft. mailboxes are the Microsoft 365 or Google mailboxes its keys may act as. You may make a team and narrow one; widening its areas, letting it write, ending drafts only, switching a hard budget to soft, and raising or removing a budget are the owner's, on their account page, when the account has an owner email. The company-wide team holds every key no other team does and is never limited to areas. $0.001. Costs $0.001 per call; nothing if it fails.

    Annotations the server declares

    • title: Create or change a team
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • account_set_brandThe business's name as the sender, its logo (a PNG, JPEG, WebP or GIF from the file store), its colour and a footer line (an address, a legal line), on every email to its customers…No findings

    Why it is in this group

    • The name "account_set_brand" says "set": a word for a change.
    Description, as the server wrote it
    The business's name as the sender, its logo (a PNG, JPEG, WebP or GIF from the file store), its colour and a footer line (an address, a legal line), on every email to its customers (bookings, applications, tests, signatures, invoices, newsletters, replies) and on its published pages (forms, booking, careers, newsletters, status, views). Only what you pass changes; an empty string clears it. Mail from Conecto to you keeps Conecto's look. Costs $0.001 per call; nothing if it fails.

    Annotations the server declares

    • title: Set the business's look
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • account_set_email_templateChange an email's subject, headline or opening words in the business's own voice, with {variables} from account_list_email_templates (like {name} or {when}).Can send data outNo findings

    Why it is in this group

    • The name "account_set_email_template" says "set": a word for a change.

    What it can reach

    • outboundThe name "account_set_email_template" says "set" and "email": it writes something other people read.
    Description, as the server wrote it
    Change an email's subject, headline or opening words in the business's own voice, with {variables} from account_list_email_templates (like {name} or {when}). The facts under them (times, places, amounts, links and buttons) stay as they are. Only what you pass changes; an empty string brings back the original words. Plain text; a blank line starts a new paragraph. Costs $0.001 per call; nothing if it fails.

    Annotations the server declares

    • title: Rewrite one of the business's emails
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • account_set_owner_emailWhen the account was made without the owner's email: send that person a link to confirm they own it.Can send data outNo findings

    Why it is in this group

    • The name "account_set_owner_email" says "set": a word for a change.

    What it can reach

    • outboundThe name "account_set_owner_email" says "set" and "email": it writes something other people read.
    Description, as the server wrote it
    When the account was made without the owner's email: send that person a link to confirm they own it. Once they confirm, the owner gets the account's warnings and approval requests, and only the owner raises limits. Nothing changes until they open the link. Free. Free.

    Annotations the server declares

    • title: Name the business's owner
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • calendar_bookBook a free time (from calendar_find_times) for someone.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a destination (input.phone): what the tool writes goes there.
    Description, as the server wrote it
    Book a free time (from calendar_find_times) for someone. They get a confirmation email with a calendar invite and a link to reschedule or cancel (if you give their email), and so do their guests (without the link). A round-robin type picks the host by its rules unless you name one. Set confirmation_call_agreed only if the person agreed to a call before the meeting asking whether they can still come. Costs $0.01 per call; nothing if it fails.

    Annotations the server declares

    • title: Book a meeting
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • calendar_connectA link to connect a Google calendar: the owner's for the business's calendar, or with person, that person's own.1 finding

    Why it is in this group

    • The description's first verb is "link": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "calendar_connect" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "link": a word for a change.

      What this check looks for
    Description, as the server wrote it
    A link to connect a Google calendar: the owner's for the business's calendar, or with person, that person's own. The page names the business, one click connects, and bookings then avoid busy times and appear in it (Google also emails the attendee an invitation). The link works once, for an hour. Then pick the calendar with calendar_setup connected_calendar_id. Outlook calendars: the microsoft365 tools work in them directly. A key that only reads or drafts gets the link as "[redacted]"; the owner and admins see it on their account page. Free.

    Annotations the server declares

    • title: Connect Google Calendar
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • calendar_moveMove a booking to another free time.No findings

    Why it is in this group

    • The name "calendar_move" says "move": a word for a change.
    Description, as the server wrote it
    Move a booking to another free time. The attendee and the guests get an updated invite by email. A round-robin meeting keeps its host when they are free then, else goes to the host its rules pick. Costs $0.01 per call; nothing if it fails.

    Annotations the server declares

    • title: Move a meeting
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • calendar_save_meeting_typeCreate or change a kind of meeting people can book, like a Cal.com event type.No findings

    Why it is in this group

    • The name "calendar_save_meeting_type" says "save": a word for a change.
    Description, as the server wrote it
    Create or change a kind of meeting people can book, like a Cal.com event type. It gets its own booking page. Only the fields you pass change. With person it is on that person's own calendar. A business type can be hosted by people like a Cal.com team event, once you choose how (there is no default): round_robin gives each booking to one host free then (the highest priority, then the fewest of this type that month for their weight, then whoever was booked longest ago; fixed hosts join every meeting), collective needs every host free and invites them all. Hosts use their own calendars' hours and Google calendars, unless the type sets hours of its own. Each host keeps their own page, which lists the business types they take; a round robin booked there goes to them. Location kinds: video (a link), phone (we call the attendee), call_us (they call a number), in_person (an address), custom. Costs $0.001 per call; nothing if it fails.

    Annotations the server declares

    • title: Save a meeting type
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • calendar_save_routing_formCreate or change a routing form, like Cal.com's: questions a visitor answers before booking, and routes that send them to a meeting type (for a round-robin type, perhaps only some …No findings

    Why it is in this group

    • The name "calendar_save_routing_form" says "save": a word for a change.
    Description, as the server wrote it
    Create or change a routing form, like Cal.com's: questions a visitor answers before booking, and routes that send them to a meeting type (for a round-robin type, perhaps only some of its hosts), another site, or a message. The first route whose conditions all hold wins; everyone else takes the fallback. It lives at its calendar's address beside the meeting types: cncto.co/book/<calendar>/<slug>. A question keyed name (text) or email (email) fills in the booking form. Only the fields you pass change. Each answer set is kept (calendar_list_routing_responses) and the bot hears of it (calendar.routed). Costs $0.001 per call; nothing if it fails.

    Annotations the server declares

    • title: Save a routing form
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • calendar_setupSet the business's calendar, or a person's own (person: like a Cal.com user, with their own booking page, hours, time zone and Google calendar): its name on booking pages, address,…No findings

    Why it is in this group

    • The description's first verb is "set": a word for a change.
    Description, as the server wrote it
    Set the business's calendar, or a person's own (person: like a Cal.com user, with their own booking page, hours, time zone and Google calendar): its name on booking pages, address, time zone, weekly hours, date exceptions (holidays, special hours), and for the business's calendar reminder emails and confirmation calls. Only the fields you pass change. The first call creates the calendar; then add meeting types with calendar_save_meeting_type. Costs $0.001 per call; nothing if it fails.

    Annotations the server declares

    • title: Set up the calendar
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 16Show 16 read-only tools
  • account_audit_logThe account's admin and security actions, newest first: keys made and revoked, limits and auto-reload, the owner's sign-ins, connectors, exports, vault reads and writes, credential…Reads private data1 finding

    Why it is in this group

    • The name "account_audit_log" says "log": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "vault": it reads secrets.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...ctors, exports, vault reads and writes, credentials set and everything deleted. Ordinary wo..."

      What this check looks for
    Description, as the server wrote it
    The account's admin and security actions, newest first: keys made and revoked, limits and auto-reload, the owner's sign-ins, connectors, exports, vault reads and writes, credentials set and everything deleted. Ordinary work is in the call log (account_list_calls). verify: true also checks the hash chain, which breaks where an entry was changed or removed. Free.

    Annotations the server declares

    • title: Read the audit log
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • account_find_personEvery record this account holds about one person, by their email address or phone number, across every area: CRM, chats, emails, tickets, forms, bookings, calls, applications, invo…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "account_find_person" says "find": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "email": it reads mail.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Every record this account holds about one person, by their email address or phone number, across every area: CRM, chats, emails, tickets, forms, bookings, calls, applications, invoices, orders, newsletters, HR and the call log, with their chats and CRM history. For a person who asks what the business keeps about them (GDPR Art. 15). Shows each kind with its count and ids; account_export_person gives them a copy, account_erase_person erases what may go. Free.

    Annotations the server declares

    • title: Find a person's data
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • account_get_brandThe name, logo, colour and footer line the business's emails and published pages carry.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "account_get_brand" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "email": it reads mail.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    The name, logo, colour and footer line the business's emails and published pages carry. Free.

    Annotations the server declares

    • title: See the business's look
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • account_get_callOne call by id: its status (queued, running, succeeded, failed), cost and result.No findings

    Why it is in this group

    • The name "account_get_call" says "get": a word for reading.
    Description, as the server wrote it
    One call by id: its status (queued, running, succeeded, failed), cost and result. Use it to poll a background call until it finishes. Free.

    Annotations the server declares

    • title: Get a call
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • account_get_limitsThe limits a business can ask Conecto to raise (calls a minute, new email addresses a day, phone numbers and more): each one's standard and current value and the most that can be a…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "account_get_limits" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "email": it reads mail.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    The limits a business can ask Conecto to raise (calls a minute, new email addresses a day, phone numbers and more): each one's standard and current value and the most that can be asked for, and the business's requests with their answers. Free.

    Annotations the server declares

    • title: Read the limits
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • account_list_approval_rulesThe tools that wait for a person's approval, with their thresholds and approvers.No findings

    Why it is in this group

    • The name "account_list_approval_rules" says "list": a word for reading.
    Description, as the server wrote it
    The tools that wait for a person's approval, with their thresholds and approvers. Free.

    Annotations the server declares

    • title: List approval rules
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • account_list_callsRecent calls on this account, newest first, optionally only failed or succeeded ones, or one area's.No findings

    Why it is in this group

    • The name "account_list_calls" says "list": a word for reading.
    Description, as the server wrote it
    Recent calls on this account, newest first, optionally only failed or succeeded ones, or one area's. Free.

    Annotations the server declares

    • title: List calls
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • account_list_email_templatesEvery email Conecto sends to the business's customers (bookings, applications, interviews, tests, signatures, invoices and quotes, newsletter sign-ups), with when it goes out and i…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "account_list_email_templates" says "list": a word for reading.

    What it can reach

    • private-dataThe name "account_list_email_templates" says "list" and "email": it reads mail.
    • private-dataThe description's first sentence says "email": it reads mail.
    • untrusted-inputThe name "account_list_email_templates" says "list" and "email": it reads inbound email, which other people can write.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Every email Conecto sends to the business's customers (bookings, applications, interviews, tests, signatures, invoices and quotes, newsletter sign-ups), with when it goes out and its subject, headline and opening words as they are now, and the {variables} each can use. Free.

    Annotations the server declares

    • title: See what the business's emails say
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • account_list_teamsThe account's teams, the company-wide one first: each with its areas, whether it only reads, its budget (hard or soft, and its period) and alert line, this period's spend, its ERP …No findings

    Why it is in this group

    • The name "account_list_teams" says "list": a word for reading.
    Description, as the server wrote it
    The account's teams, the company-wide one first: each with its areas, whether it only reads, its budget (hard or soft, and its period) and alert line, this period's spend, its ERP code, whether it is paused, its keys, and its people with who manages it. A person's own assistant works within their teams. Free.

    Annotations the server declares

    • title: List teams
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • calendar_find_timesFree start times for a meeting type between two dates (up to 62 days), shown in the time zone you ask for.Reads private dataNo findings

    Why it is in this group

    • The name "calendar_find_times" says "find": a word for reading.

    What it can reach

    • private-dataThe name "calendar_find_times" says "find" and "calendar": it reads calendars.
    • private-dataThe description's first sentence says "meeting": it reads calendars.
    Description, as the server wrote it
    Free start times for a meeting type between two dates (up to 62 days), shown in the time zone you ask for. For a round-robin type, host shows only that host's free times. Book one with calendar_book. Free.

    Annotations the server declares

    • title: Find free times
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • calendar_get_setupThe calendar's settings, booking page, iCal subscribe link, connected Google calendar (with the calendars to choose from) and confirmation calls; for the business's calendar also i…Reads private dataNo findings

    Why it is in this group

    • The name "calendar_get_setup" says "get": a word for reading.

    What it can reach

    • private-dataThe name "calendar_get_setup" says "get" and "calendar": it reads calendars.
    • private-dataThe description's first sentence says "calendar": it reads calendars.
    Description, as the server wrote it
    The calendar's settings, booking page, iCal subscribe link, connected Google calendar (with the calendars to choose from) and confirmation calls; for the business's calendar also its meeting types and its people's calendars. person reads someone's own calendar. Free.

    Annotations the server declares

    • title: Get the calendar setup
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • calendar_list_bookingsBookings between two times (default: from now on), soonest first, with each one's hosts, guests and confirmation call.Reads private dataNo findings

    Why it is in this group

    • The name "calendar_list_bookings" says "list": a word for reading.

    What it can reach

    • private-dataThe name "calendar_list_bookings" says "list" and "calendar": it reads calendars.
    Description, as the server wrote it
    Bookings between two times (default: from now on), soonest first, with each one's hosts, guests and confirmation call. person lists the meetings that person has. Free.

    Annotations the server declares

    • title: List bookings
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • calendar_list_meeting_typesThe meeting types people can book, with their booking pages: the business's, then each person's own (meeting_type is how the other tools name each one).Reads private dataNo findings

    Why it is in this group

    • The name "calendar_list_meeting_types" says "list": a word for reading.

    What it can reach

    • private-dataThe name "calendar_list_meeting_types" says "list" and "calendar": it reads calendars.
    • private-dataThe description's first sentence says "meeting": it reads calendars.
    Description, as the server wrote it
    The meeting types people can book, with their booking pages: the business's, then each person's own (meeting_type is how the other tools name each one). person lists only theirs. Free.

    Annotations the server declares

    • title: List meeting types
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • calendar_list_routing_formsThe routing forms, with their addresses, questions, routes and how many people answered each.Reads private dataNo findings

    Why it is in this group

    • The name "calendar_list_routing_forms" says "list": a word for reading.

    What it can reach

    • private-dataThe name "calendar_list_routing_forms" says "list" and "calendar": it reads calendars.
    Description, as the server wrote it
    The routing forms, with their addresses, questions, routes and how many people answered each. Free.

    Annotations the server declares

    • title: List routing forms
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • calendar_list_routing_responsesWhat people answered on the routing forms, newest first: their answers, where each was sent, and the booking it led to.Reads private dataNo findings

    Why it is in this group

    • The name "calendar_list_routing_responses" says "list": a word for reading.

    What it can reach

    • private-dataThe name "calendar_list_routing_responses" says "list" and "calendar": it reads calendars.
    Description, as the server wrote it
    What people answered on the routing forms, newest first: their answers, where each was sent, and the booking it led to. Free.

    Annotations the server declares

    • title: List routing form answers
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

300 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 5 outbound tools breaks every one.

Reads text others write5
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out5
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__calendar__account_emit_event",
      "mcp__calendar__account_export_person",
      "mcp__calendar__account_set_email_template",
      "mcp__calendar__account_set_owner_email",
      "mcp__calendar__calendar_book"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

3 warn3 info
  • The server marks "calendar_connect" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "link": a word for a change.

    What this check looks for
  • The server marks "account_owner_link" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "account_owner_link" says "link": a word for a change.

    What this check looks for
  • The server marks "account_dashboard_link" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "account_dashboard_link" says "link": a word for a change.

    What this check looks for
  • The description mentions "Credentials".

    Matched text

    description: "...es, with a README saying what is where. Credentials are left out. Runs in the background: p..."

    What this check looks for
  • The description mentions "credentials".

    Matched text

    description: "...ctors, exports, vault reads and writes, credentials set and everything deleted. Ordinary wo..."

    What this check looks for
  • The description mentions "credentials".

    Matched text

    description: "...ile store: their records as JSON Lines (credentials left out) and the files those records p..."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http calendar https://api.conecto.chat/mcp/calendar --header 'Authorization: <your-authorization>'
claude mcp add --transport http calendar https://api.conecto.chat/mcp/calendar --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__calendar__calendar_get_setup",
      "mcp__calendar__calendar_list_meeting_types",
      "mcp__calendar__calendar_find_times",
      "mcp__calendar__calendar_list_bookings",
      "mcp__calendar__calendar_list_routing_forms",
      "mcp__calendar__calendar_list_routing_responses",
      "mcp__calendar__account_get_call",
      "mcp__calendar__account_list_calls",
      "mcp__calendar__account_get_limits",
      "mcp__calendar__account_search",
      "mcp__calendar__account_get_brand",
      "mcp__calendar__account_list_email_templates",
      "mcp__calendar__account_audit_log",
      "mcp__calendar__account_list_teams",
      "mcp__calendar__account_list_approval_rules",
      "mcp__calendar__account_find_person"
    ],
    "ask": [
      "mcp__calendar__calendar_setup",
      "mcp__calendar__calendar_connect",
      "mcp__calendar__calendar_save_meeting_type",
      "mcp__calendar__calendar_book",
      "mcp__calendar__calendar_move",
      "mcp__calendar__calendar_save_routing_form",
      "mcp__calendar__account_balance",
      "mcp__calendar__account_set_owner_email",
      "mcp__calendar__account_owner_link",
      "mcp__calendar__account_dashboard_link",
      "mcp__calendar__account_request_limit",
      "mcp__calendar__account_events",
      "mcp__calendar__account_emit_event",
      "mcp__calendar__account_set_brand",
      "mcp__calendar__account_set_email_template",
      "mcp__calendar__account_export_all",
      "mcp__calendar__account_save_team",
      "mcp__calendar__account_pause_team",
      "mcp__calendar__account_assign_team",
      "mcp__calendar__account_add_approval_rule",
      "mcp__calendar__account_export_person",
      "mcp__calendar__account_data_locations"
    ],
    "deny": [
      "mcp__calendar__calendar_cancel",
      "mcp__calendar__account_refund_topup",
      "mcp__calendar__account_erase_person"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as calendar. Review it before you use it.

Capability tags behind 17 rules
  • mcp__calendar__calendar_get_setup private-data
  • mcp__calendar__calendar_list_meeting_types private-data
  • mcp__calendar__calendar_find_times private-data
  • mcp__calendar__calendar_book outbound
  • mcp__calendar__calendar_list_bookings private-data
  • mcp__calendar__calendar_list_routing_forms private-data
  • mcp__calendar__calendar_list_routing_responses private-data
  • mcp__calendar__account_set_owner_email outbound
  • mcp__calendar__account_get_limits private-data, untrusted-input
  • mcp__calendar__account_emit_event outbound
  • mcp__calendar__account_search private-data, untrusted-input
  • mcp__calendar__account_get_brand private-data, untrusted-input
  • mcp__calendar__account_list_email_templates private-data, untrusted-input
  • mcp__calendar__account_set_email_template outbound
  • mcp__calendar__account_audit_log private-data
  • mcp__calendar__account_find_person private-data, untrusted-input
  • mcp__calendar__account_export_person outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/chat.conecto/calendar/verify?hash=3643de691a90588acff924fb28a7268d28076f9afb317aac573f80b686066eb1" | jq -e '.changed == false'

Pinned hash 3643de691a90, from Nov 2, 2026, 21:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/chat.conecto/calendar/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for chat.conecto/calendar
[![anlyon.dev](https://anlyon.dev/badge/chat.conecto/calendar.svg)](https://anlyon.dev/servers/chat.conecto/calendar)

Source: MCP Registry. Synced Nov 2, 2026, 22:17 UTC.