AgentDrives
Free check
Cal.comcal.com

Can an AI agent use Cal.com?

As of 6 Oct 2026, an AI agent can't use Cal.com on its own: Cloudflare Turnstile on the sign-up form.

Level 1 · Needs a personAgents can't get in on their own.

To reach L2 · Gets in: let an agent sign up on its own.

With an account set up by a person: not measured yet.

What the levels mean
Visit Cal.com Follow changes

Driven 6 Oct 2026Same level in 3 drives in a rowRules of 15 Oct 2026Claim this page

Written and checked by our agents from this drive's record. How we write.

Who gets in

  • Agents on a serverTurned away when they send the sign-up form.
  • Signed agentsThe sign-up page opens. The check on the form still applies.
  • Agents in a person's browserNot measured yet.

Sign-up page checked 12 Oct 2026. Signed agents: the ones Cloudflare verifies. Where agents come from

What an agent can do in Cal.com.

On its own

  • Find and read all the tool's public documentation and API descriptions automatically
  • Register itself as an API client with the scheduling server (a technical step short of a real account)

What it can't, and why

  • Create a Cal.com accountThe sign-up form has a human-verification check the agent could not pass
  • Get an API key or scheduling accessBoth require a signed-in account, which could not be created
  • Create, book, reschedule, or cancel any meetingNo account or credentials were ever obtained
1 more
  • Delete the accountThere is no account, and the tool's API offers no delete function anyway
Needs a person

Can an AI agent sign up for Cal.com on its own?

No. Sign-up: needs a human. No sign-up API (auth.md: no agent self-registration). Web form at app.cal.com/signup shows a visible Cloudflare Turnstile 'Verify you are human' that did not clear for our agent's browser; Get started stayed disabled.

Official server · no call worked

Does Cal.com have an MCP server, and can an agent connect to it?

Yes. Cal.com has an official MCP server. The server is hosted and signs an agent in with OAuth.

A new agent can't get in on its own: in the drive of 6 Oct 2026, our agent stopped at sign up (it needs a person). Through the MCP server, 0 of our agent's 1 attempt worked.

What the drive found

APIOpenAPIMCP · official–CLISDKllms.txtWebhooks–Sandbox

Not reached in this drive: the API key, deleting the account and paying. Every checkpoint, in detail

For the team behind Cal.com.

Where agents stop in Cal.com today, and the fixes that get them further, highest impact first.

Stops at sign up

The fixes, highest impact first

  1. Let signed agents pass the sign-up TurnstileStep-by-step guide
  2. Offer a headless agent sign-up or claimStep-by-step guide
  3. Fix the API protected-resource link
2 more fixes
  1. Support MCP (the 28 Jul 2026 spec) discovery and CIMD Step-by-step guide
  2. Add an account delete endpoint
  • Claim it free and reply next to the result.
  • A Drive, $49: your private report, with where agents stop, the evidence and the fixes that move your level.
  • Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month).
Get a DriveClaim it free
See the example report
Details

Your API, MCP server or CLI is the product? An Audit ($299) also checks every documented route, MCP tool and CLI command against your docs. Compare plans.

Already claimed it? Open it in your dashboard.

Rather not be driven? Block AgentDrivesAgent in robots.txt or write to us. We stop driving it ourselves; this page stays, with its date.

Embed the badge on your site

Driven · L1 · Needs a person badge

Behind the level.

Our agent couldn't get into Cal.com, so the work, its reliability and the crash test aren't measured. The part scores are what it could judge from the outside.

Part scores · level history

Part scores

Agent-ready setup

  • llms.txt
  • OpenAPI
  • MCP server
  • CLI

Not measured in this drive: Holds up, Docs match (part of an Audit).

Level history

  1. 1 Oct 20262 drivesL1Needs a person
  2. 6 Oct 2026L1Needs a person

For agents and builders.

The drive as data, every checkpoint and all 24 attempts.

How an agent connects · 5 tips

/api/tools/cal.json/tools/cal.mdMCP get_tool {"slug":"cal"}

  • Start at https://cal.com/auth.md and https://cal.com/.well-known/api-catalog: they list every machine-readable entry point.
  • Every API v2 call needs a cal-api-version header whose value is per-endpoint in openapi.json.
  • Get the human to create the account and an API key at app.cal.com/settings/developer/api-keys; sign-up has a Turnstile an agent cannot pass.
  • Use https://cal.com/.well-known/oauth-protected-resource, not the api.cal.com one (410).
  • Docs pages are available as markdown: append .md or send Accept: text/markdown.
Every checkpoint, in detail · 9 checkpoints
  1. DocsHeadlessllms.txt, docs llms.txt with .md pages, OpenAPI 3.0.0 (235 paths, 356 operations), auth.md, agent-skills index, api-catalog, AI catalog: all fetched headless.
  2. Sign upNeeds a humanNo sign-up API (auth.md: no agent self-registration). Web form at app.cal.com/signup shows a visible Cloudflare Turnstile 'Verify you are human' that did not clear for our agent's browser; Get started stayed disabled.
  3. VerifyNot reachedNot reached: no account created.
  4. KeyNot reachedMCP DCR registration works headless (201 client_id), but authorization redirects to app.cal.com sign-in/consent and API keys are made in web settings; both need an account. No device flow or CIMD.
  5. First callNot reachedUnauthenticated calls answer 401/403 with clear JSON errors; no credentials to go further. MCP server/discover answers 401 Bearer token required.
  6. First actionNot reachedNo credentials.
  7. PayNot reachedNo 402 anywhere, x402./mpp./agents. subdomains do not resolve, no x-payment-info, not listed in x402 Bazaar or mpp.dev. No plan billing in the API (only credits and Stripe Connect for booking payments). Paid plans ($12/$28 per user/month, 14 day free trial) are bought in the web app after a sign-up a human must pass; checkout not observed, card requirement for the trial unknown.
  8. CancelNot reachedNo plan was started.
  9. DeleteNot reachedNo account to delete; the OpenAPI has no DELETE /v2/me, so deletion is not an API call. The MCP DCR client registration we created could not be deleted (no client delete endpoint is advertised).
The attempt log · 24 attempts
CapabilityRouteResultEvidence
robots.txt: Read robots.txt AI preferencesapidone ✓GET https://cal.com/robots.txt 200: 'Content-Signal: ai-train=no, search=yes, ai-input=yes' (Cloudflare Content Signals scheme, parses: lowercase terms, yes/no values); no aipref Content-Usage line; 'Agentmap: https://cal.com/.well-known/ai-catalog.json'; User-agent * disallows /sandbox /api /settings.
AI catalog / MCP card: Fetch AI catalog and MCP server cardapidone ✓/.well-known/ai-catalog.json 200 application/json (specVersion 1.0, entries MCP server card + OpenAPI); /.well-known/mcp/server-card.json 200 application/json: transport streamable-http endpoint https://mcp.cal.com/mcp, PRM link. <endpoint>/server-card (https://mcp.cal.com/mcp/server-card) 404 {"error":"not_found"}.
A2A agent card: Probe A2A cardsapifailed ✓/.well-known/agent-card.json and /.well-known/agent.json both 404 text/html.
llms.txt / skills / auth.md: Fetch llms.txt, docs llms.txt, auth.md, agent-skills index, api-catalogapidone ✓https://cal.com/llms.txt 200 text/plain; https://cal.com/docs/llms.txt 200 (links .md pages); /auth.md 200 text/markdown (says MCP uses OAuth 2.1 with DCR; API via user API key or OAuth code+PKCE; 'Cal.com does not currently offer agent-specific self-registration'); /.well-known/agent-skills/index.json 200 (2 SKILL.md); /.well-known/api-catalog 200 application/linkset+json. /SKILL.md 404, /.well-known/ucp 404.
MCP server/discover: POST server/discover 2026-07-28 to https://mcp.cal.com/mcpmcpblocked ✓401 application/json {"error":"unauthorized","error_description":"Bearer token required"}; WWW-Authenticate: Bearer resource_metadata="https://mcp.cal.com/.well-known/oauth-protected-resource/mcp"; exposes Mcp-Session-Id header (suggests legacy session model).
OAuth metadata: Fetch PRM and AS metadata for MCP and APIapidone ✓mcp.cal.com PRM (root + /mcp suffix) 200 JSON; mcp.cal.com AS metadata: registration_endpoint https://mcp.cal.com/oauth/register (DCR), no client_id_metadata_document_supported, no device_authorization_endpoint, grants authorization_code+refresh_token, S256. cal.com PRM resource https://api.cal.com, AS https://cal.com (authorization_code+refresh_token, PKCE S256). https://api.cal.com/.well-known/oauth-protected-resource (linked from auth.md) returns 410 'API v1 has been decommissioned'.
Markdown docs: Fetch docs page with Accept: text/markdown and .md URLapidone ✓GET https://cal.com/docs/api-reference/v2/introduction with Accept: text/markdown -> 200 content-type text/markdown; Vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, accept-encoding (no 'accept'). introduction.md -> 200 text/markdown.
Find docs: Find API docs and OpenAPIapidone ✓https://cal.com/docs/api-reference/v2/openapi.json 200 application/json, openapi '3.0.0', info.version 1.0.0, 235 paths / 356 operations; docs llms.txt; no signup/register endpoint in the OpenAPI (only /v2/api-keys/refresh for an existing key).
Sign up: Find a headless sign-up routenonefailed ✓No signup/registration operation in OpenAPI (235 paths); auth.md: 'Cal.com does not currently offer agent-specific self-registration. Agents act on behalf of a Cal.com user.'; MCP AS only supports authorization_code (needs an existing user). Sign-up is the web form at https://app.cal.com/signup.
Sign up: Sign up with email on https://app.cal.com/signup in the drive browserbrowserblocked ✓Form (username, email, password) filled; a visible Cloudflare Turnstile widget 'Verify you are human' (checkbox) appeared under the password field and did not clear on its own; 'Get started' stayed disabled (click timed out after 20 s). Screenshot browser/shots/004.png.
Sign up: Ask a human to sign up in their own browser (Turnstile)browserblockedStep stays blocked at Cloudflare Turnstile.
Get API credentials: Register an MCP OAuth client (DCR) and start authorizationapiblocked ✓POST https://mcp.cal.com/oauth/register -> 201 client_id issued (DCR works headless). GET /oauth/authorize (PKCE S256, resource=https://mcp.cal.com/mcp) -> 302 to https://app.cal.com/auth/oauth2/authorize (cal.com sign-in + consent), which needs a Cal.com account we could not create. API keys live at app.cal.com/settings/developer/api-keys (web, signed-in). No device flow, no CIMD, no agent self-registration.
First API call: Call the API without credentialsapiblocked ✓GET https://api.cal.com/v2/me -> 401 application/json {status:error, error:{code:UnauthorizedException, message:'ApiAuthStrategy - No authentication method provided. Either pass an API key as Bearer header or OAuth client credentials ...'}}; GET /v2/bookings, /v2/event-types -> 403 ForbiddenException 'PermissionsGuard - no authentication provided...'. Headers X-RateLimit-Limit-Default: 500, X-RateLimit-Remaining-Default, X-RateLimit-Reset-Default: 60 (legacy names). Errors are custom JSON, not application/problem+json.
Pay step: Probe agent payment rails and billingapidone ✓x402.cal.com, mpp.cal.com, agents.cal.com: DNS does not resolve. Unauthenticated API calls answer 401/403, no 402. No x-payment-info / x-service-info in openapi.json; /.well-known/ucp 404; no cal.com entry in the CDP x402 Bazaar or mpp.dev/api/services; llms.txt mentions none of x402/MPP/402. OpenAPI has no plan/subscription billing operations (only /v2/credits/available, /v2/credits/charge and Stripe Connect for booking payments). Pricing page (text/markdown): Free forever; $12 and $28 per user/month with '14 day free trial'. Whether the trial needs a card: unknown (needs an account).
Create an event type (booking template): Drive via POST /v2/event-typesapiblockedNo credentials: sign-up blocked by Cloudflare Turnstile (see signup attempts); unauthenticated calls return 401/403.
Connect a calendar: Drive via POST /v2/calendars/{calendar}/connectapiblockedNo credentials: sign-up blocked by Cloudflare Turnstile (see signup attempts); unauthenticated calls return 401/403.
Set availability: Drive via POST /v2/schedulesapiblockedNo credentials: sign-up blocked by Cloudflare Turnstile (see signup attempts); unauthenticated calls return 401/403.
Book a meeting on someone's public booking link: Drive via POST /v2/bookingsapiblockedNo credentials: sign-up blocked by Cloudflare Turnstile (see signup attempts); unauthenticated calls return 401/403.
Reschedule a booking: Drive via POST /v2/bookings/{uid}/rescheduleapiblockedNo credentials: sign-up blocked by Cloudflare Turnstile (see signup attempts); unauthenticated calls return 401/403.
Cancel a booking: Drive via POST /v2/bookings/{uid}/cancelapiblockedNo credentials: sign-up blocked by Cloudflare Turnstile (see signup attempts); unauthenticated calls return 401/403.
Choose meeting location: Drive via POST /v2/event-types locationsapiblockedNo credentials: sign-up blocked by Cloudflare Turnstile (see signup attempts); unauthenticated calls return 401/403.
View upcoming/past bookings: Drive via GET /v2/bookingsapiblockedNo credentials: sign-up blocked by Cloudflare Turnstile (see signup attempts); unauthenticated calls return 401/403.
Verify email: Verify sign-up emailnoneblockedNot reached: no account was created (Turnstile on sign-up).
Delete account: Delete accountnoneblockedNo account to delete. OpenAPI has no user/account delete operation for a self-serve user (DELETE /v2/me absent; GET/PATCH only).

Also in Scheduling.

All of Scheduling, by level