Google Calendar
4 reviewed Dtwo policies for Google Calendar MCP servers — egress + ingress controls for governing what AI agents can do with Google Calendar.
On this page
Reusable DTwo policies for Google Calendar MCP servers — Google's official remote Calendar server (create_event/update_event/delete_event/respond_to_event plus the read tools), the community nspady/google-calendar-mcp (create-event, update-event, delete-event, search-events, get-freebusy, manage-accounts), and taylorwilsdon/google_workspace_mcp, whose consolidated manage_event tool spans create, update, and delete behind one name. The Anthropic Claude connector is read-only, so all write risk comes from the official Google server or the community servers wired in behind a gateway. Its risk profile is dominated by externally visible writes and read-side leakage, not just deletion: a create/update with an external attendee and sendUpdates: all emails the event body outside the org (an under-watched exfil channel), visibility: public / guestsCan* flags hand a private event to the world, recurring-series-wide edits and deletes silently move or wipe standing meetings with no MCP-level undo, and read responses expose attendee email lists, private event bodies, and live meeting-join links across every calendar the OAuth grant covers.
Available policies
| Policy | Direction | Purpose | Framework bundles |
|---|---|---|---|
| guard-external-attendees | ingress | Deny event-write calls (create/update/manage_event) that invite any attendee whose domain is outside the corporate allowlist; closes the calendar-invite exfil channel. |
soc2, hipaa, gdpr-ccpa |
| guard-public-exposure | ingress | Deny create/update calls that set visibility: public or hand edit / invite / self-add control to guests. |
soc2 |
| freeze-destructive-events | ingress | Deny event deletes (including manage_event delete actions) for non-admins, and deny recurring-series-wide changes for everyone. |
soc2, hipaa, gdpr-ccpa, sox |
| redact-attendee-pii | egress | Redact attendee emails and names, meeting-join links, and PII/PHI in calendar read responses (transform-only); reads still return, scrubbed. | soc2, hipaa, gdpr-ccpa |
Tool naming on the DTwo gateway
DTwo prefixes tool names with the MCP server name configured on the gateway, and the three Calendar implementations disagree on delimiters for the same operations — create_event (Google, snake), create-event (nspady, kebab), gcal_* (Claude connector), and manage_event (taylorwilsdon, consolidated). The policies here match on the suffix and normalize -/_ so they stay portable across naming conventions, and the destructive-ops policy inspects the action argument on manage_event because the tool name alone cannot tell a reschedule from a delete. Always confirm the exact tool name your gateway sends using the dump-input debug technique before deploying.
Identity claims
The identity-gated policies read input.subject.claims.groups with placeholder group names — replace them with your own IdP group names at import time: guard-external-attendees exempts calendar-external-schedulers, freeze-destructive-events exempts calendar-admins (deletes only — series-wide changes are denied even for admins), and redact-attendee-pii exempts calendar-full-read. Missing claims fail closed for grants (no group → not exempt).
Contributing
To add a Google Calendar policy:
- Create
apps/google-calendar/<policy-slug>/withpolicy.mdand atests.yamltest file. - Add a row to the table above.
- Declare
apps: ["google-calendar"]in the policy frontmatter, plus any industry / bundle slugs that apply. - If the policy fits a framework bundle, link to it from the matching landing page.
- Run
pnpm manifestfrom the repo root.
See CONTRIBUTING.md for the full process.