Skip to main content
Glama
ryanmish

iCloud Calendar MCP

by ryanmish

iCloud Calendar MCP

A self-hosted iCloud Calendar service for ChatGPT and other remote MCP clients. It uses iCloud CalDAV, OAuth, server-side write controls, and Cloudflare Tunnel.

Status: Personal setup flow deployed on the dev box. Public HTTPS, OAuth discovery, and refusal of unauthenticated MCP access passed on 2026-10-09. Writes are disabled. Offline tests cover the calendar tools, Better Auth code exchange and refresh, encrypted credentials, and access controls. Owner login, iCloud access, and a real ChatGPT connection still need the owner's secure setup and live test.

Tools

Tool

Function

get_profile

Identify the permitted account connection

list_calendars

List readable calendars and enabled write operations

search_events

Read or search a window of at most 93 days

get_event

Read an event resource and its ETag

create_event

Create one timed or all-day event

update_event

Update one simple event with an ETag check

Recurring events can be read. Their expanded occurrences share the resource event ID; the recurrence_id identifies an occurrence. This version does not write recurrence, invitations, RSVP responses, or deletions. Search reports truncation and skipped resources. Free-time calculation and pagination are planned.

Related MCP server: iCloud CalDAV MCP Connector

Access controls

Each installation supports one iCloud account and one service owner. OAuth grants access to this service. The Apple app-specific password grants the service access to iCloud. These are separate credentials.

The service requires HTTPS configuration, signed tokens for its exact resource, and calendar:read. Writes also require calendar:write, an exact writable calendar ID, and an enabled operation. Writes are disabled until the operator sets that policy. There is no unauthenticated mode. See SECURITY.md.

Develop

Use Python 3.12 or later and uv 0.12.22:

uv sync --locked --extra test
uv run --locked pytest -q
uv run --locked ruff check src tests

Tests use generated signing keys and fake calendars. They do not access real accounts. The HTTP tests run in memory without a network listener.

Host on the devbox

Start with the personal setup guide. It covers service password login, secret files, migration, Cloudflare Tunnel, and ChatGPT. See the deployment record for verified host preparation and the current setup state. Use compose.personal.yaml for the new guided flow. It adds a small Better Auth service beside the existing Python server. The intended MCP URL is https://cal.ryanmish.com/mcp. No live endpoint is claimed.

Create the one-owner account with a service password. Then connect iCloud with its actual account address and an app-specific password. The next form fills the address from your signup entry or saved connection. You select calendar rights before you approve ChatGPT. This path needs no Apple Developer account. The service password and iCloud password are separate. Optional Apple identity login remains available for installations with the required developer settings.

The original external-issuer guide and compose.yaml remain available. Do not combine the two Compose files. Never enter Apple credentials in chat. Test a separate calendar before enabling normal writes.

Reminders research

See Apple Reminders research for existing tools, shared setup, repeat behavior, synchronization limits, and required permissions. This is a proposed extension. Reminders tools are not implemented in this server.

Next work

See current test readiness for the first-login repair, local startup proof, and approved deployment steps. See the deployment record for live verification results.

See cPanel email research for a proposed separate, read-only IMAP adapter. No email connection or tools are enabled.

See the login and iCloud setup research for the Better Auth flow, Apple registration questions, and private ChatGPT setup.

  1. Complete secure host setup and first-owner signup.

  2. Verify the container and Cloudflare route on the devbox.

  3. Verify login and calendar reads with ChatGPT.

  4. Verify conditional writes in a test calendar.

  5. Add free-time calculation, result pagination, and request limits.

  6. Add separate user connections and isolation checks before shared hosting.

The current scope is a personal installation. Shared public hosting needs further work.

The Node service uses Node 24.16.0. Run npm ci, npm run check, npm test, and npm run build from web/. Tests use fake credentials and an in-memory database.

Sources and license

This service reuses CalDAV discovery and resource code from duanefields/dav-mcp. See THIRD_PARTY_NOTICES.md.

MIT license. This is an independent project. Apple and OpenAI do not endorse it.

Related MCP Connectors

Related MCP Servers