Google Calendar MCP server
The server defines 8 tools with visible schemas and basic descriptions, but exhibits significant quality gaps across naming, parameter documentation, error handling, and output schema clarity. Tool names follow verb_noun patterns appropriately (list-acl, insert-acl, get-acl, update-acl, patch-acl, delete-acl, watch-acl, list-calendar-list), but descriptions are extremely sparse and many parameter types are loose. Schemas use Zod validation but lack critical documentation around output structure, error cases, and parameter constraints. Parameters like 'sendNotifications', 'requestData', and 'maxResults' accept string types when they should be boolean or specific objects, creating ambiguity for LLMs. No parameter descriptions visible in schema definitions. Error handling is minimal, responses are generic JSON stringification or basic error text without actionable recovery guidance. Output schemas are completely undocumented, LLMs have no visibility into the structure of results, complicating downstream tool chaining.
Delete access control rule
Get access control rule
Create access control rule
List access control rules
List calendars
Patch access control rule
Update access control rule
Parameter type misalignment: 'sendNotifications', 'maxResults', 'pageToken', 'showDeleted' are defined as string types in Zod schemas (z.string().optional()), but semantically should be boolean or integer with enums. String types force LLMs to guess serialization and invite invalid values.
Output schema completely undocumented. Tools return handleResult(response.data) which is JSON.stringify() of raw Google Calendar API responses. LLMs have zero visibility into field structure, required fields, pagination info, or how to chain results to other tools. This violates the 100% baseline: 'All A+ tools have documented return types.'
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 39 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 0 | - | v1 |
Watch for changes to ACL resources
Parameter descriptions missing from input schemas. Zod definitions include no description field beyond the parameter name. LLMs cannot infer meaning of 'syncToken', 'pageToken', 'showDeleted', 'minAccessRole' etc. from names alone. This violates: '100% of A+ tool params have descriptions.'
Tool descriptions are extremely brief (20-30 chars). 'List access control rules', 'Create access control rule', etc. lack context on when to use each tool vs alternatives, what they return, prerequisites, or side effects. Baseline is 50-200 chars for LLM-optimized descriptions. Current descriptions are at the floor of acceptable (p10 baseline is 34 chars, but that includes very simple tools).
Error handling is generic and non-actionable. handleError() returns 'API Error: {message}' or generic 'Error: {error}' text without recovery guidance. Per pattern:recovery-guide, errors must tell LLMs what to do next, not just that something failed. No error categorization (retryable vs fatal).
'requestData' parameter is a loose z.record(z.any()) object with no schema constraints, type hints, or documentation. LLMs cannot determine what fields are valid, required, or their types. For insert-acl and update-acl, this is the primary payload but is entirely opaque.
No pagination documentation. Tools accept 'pageToken' and 'syncToken' parameters and return raw API responses that may include 'nextPageToken' or pagination metadata, but no description explains how pagination works, what fields to expect, or when pagination is needed.
Authorization token extraction via extra?.requestInfo?.headers?.authorization is non-standard and fragile. MCP does not standardize credential passing via headers. This creates coupling to a specific client implementation and risks silent auth failures if the client doesn't set this header.
No distinction between read-only and destructive operations in tool definitions. delete-acl performs permanent deletion but has no confirmation flow or dry-run option. Agents can trigger irreversible deletions without safeguards.
Raw Google Calendar API response dumped directly to output. Unfiltered responses include metadata, pagination tokens, etags, and other fields irrelevant to chat.