# WhenMeet.me — group scheduling

> Group meeting scheduler — rank times everyone's free across Google & Outlook, book Meet/Teams.

- name: me.whenmeet/scheduler
- version: 1.1.0
- connection class: R2 (oauth_consent_once)
- trust: 82/100 flags: no-repository
- quality: 70/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/me.whenmeet%2Fscheduler
- tools: https://api.protogrid.dev/v1/servers/me.whenmeet%2Fscheduler/tools

**An agent can connect after a one-time OAuth consent by a human.** Remote endpoint behind OAuth 2. Tokens stay with the agent; the registry only exposes the authorization metadata.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "scheduler": {
      "type": "http",
      "url": "https://whenmeet.me/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 98
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-94% +updated-4d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 70/100 (needs work)

### protocol: n/a (weight 25)

- n/a `protocol.modern`, `protocol.stateless`, `protocol.transport`, `protocol.list_ttl`: no remote answered a protocol handshake (not probed yet, unreachable, or local-only)

### authorization: 83 (weight 15)

- pass `auth.prm`: Protected Resource Metadata (RFC 9728) published
- pass `auth.as_metadata`: authorization server metadata reachable
- warn `auth.cimd`: only Dynamic Client Registration, deprecated in 2026-07-28 in favour of CIMD
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 11 of 11 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: find_common_slots (destructiveHint, idempotentHint, openWorldHint); create_meeting (destructiveHint, idempotentHint, openWorldHint); get_meeting_availability (destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 2,571 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 7 tool changes in 30 days
- fail `stability.rug_pull`: 1 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 11, about 2,571 tokens to load them all
- tool set hash: 43a61e71af3cf2e57024d7a9b35b1e1b
- tools last changed: 2026-10-14T01:43:00.304Z
- badge: [![protogrid quality](https://protogrid.dev/badge/me.whenmeet/scheduler.svg)](https://protogrid.dev/servers/me.whenmeet/scheduler)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-14 `suggest_time` changed (description)
  - before: Propose a different time for an existing meeting on behalf of a guest. The host is notified by email and can accept or decline. Authenticated callers (Bearer PAT) skip the bot challenge; an anonymous caller must pass a Cloudflare Turnstile token in `turnstileToken` (only required when the server is configured with a Turnstile secret).
  - after: Propose a different time for an existing meeting on behalf of a guest. The host is notified by email and can accept or decline (at most 10 suggestions per hour per meeting and email; beyond that rate_limited). Authenticated callers (Bearer PAT) skip the bot challenge; an anonymous caller must pass a Cloudflare Turnstile token in `turnstileToken` (only required when the server is configured with a Turnstile secret).
- 2026-10-14 `create_meeting` changed (description, inputSchema)
  - before: Confirm a meeting: writes the event into the authenticated host’s calendar with an optional Google Meet/Teams link, emails invites with an ICS attachment, and returns the share URL (/m/<id>). Requires authentication.
  - after: Confirm a meeting: writes the event into the authenticated host’s calendar with an optional Google Meet/Teams link, emails invites with an ICS attachment, and returns the share URL (/m/<id>). Up to 50 participants; the start must be at most 60 days ahead (bad_window). Requires authentication.
- 2026-10-14 `find_common_slots` changed (description, inputSchema)
  - before: Rank the best meeting times for the given participants, merging live Google/Microsoft calendar data, hand-marked availability and the heat-map sources. Each participant is filtered (Mon–Fri, waking hours) and scored in their OWN timezone; scores factor in buffer time around existing meetings and prefer sooner slots. Returns up to 8 slots: everyone-free slots first (allFree:true), then — only if there are too few — the best compromise slots (allFree:false) with a freeCount. Defaults to the next 14 days. Requires authentication.
  - after: Rank the best meeting times for the given participants, merging live Google/Microsoft calendar data, hand-marked availability and the heat-map sources. Each participant is filtered (Mon–Fri, waking hours) and scored in their OWN timezone; scores factor in buffer time around existing meetings and prefer sooner slots. Returns up to 8 slots: everyone-free slots first (allFree:true), then — only if there are too few — the best compromise slots (allFree:false) with a freeCount. Defaults to the next 14 days; the window may end at most 60 days from now (bad_window). Up to 50 participants; reading other people’s connected calendars is limited to 30 new addresses per hour and 50 per day (lookup_limit), and each read is shown to the calendar owner. Requires authentication.
- 2026-10-12 `book_slot` added
  - Book a time on someone’s WhenMeet.me booking link. startsAt must be a slot start from get_booking_slots. Writes the event to the host’s calendar (Google Meet / Teams link added automatically), emails invites with an ICS to you, your guests and the host (or the team), and returns bookingId, conferenceUrl, meetingUrl and manageUrl (cancel / reschedule). name/email default to the authenticated user — pass them to book for someone else. Requires authentication (anonymous bookings need a human bot-check).
- 2026-10-12 `get_booking_slots` added
  - Bookable times on someone’s WhenMeet.me booking link (whenmeet.me/@nickname[/slug]) — personal or team link. Returns the link (title, durationMin, required questions, team mode), the host’s timezone and slots[{start,end,othersFree,othersTotal}]. Only times and counts are ever exposed, never anyone’s calendar. Called with a token, othersFree/othersTotal also show which slots suit YOUR calendar and the optional guests (othersFree === othersTotal = good for everyone). Defaults to the next 14 days. No auth needed.
- 2026-10-12 `list_my_event_types` added
  - Your own booking link and its link types: profile (nickname, timezone, weekly hours), publicUrl (whenmeet.me/@nickname), and eventTypes[] with url, duration, settings and — for team links — mode ("all" = everyone must be free, "any" = whoever is free, in turn) and members with their status. Zero-config: if you have a calendar connected but never opened /links, this provisions the default 30-minute link first (idempotent), so the link is live. Requires authentication.
- 2026-10-12 `set_manual_availability` changed (description) **meaning changed**
  - before: Publish hand-marked FREE time slots for an email address (the no-calendar fallback, e.g. Apple iCloud users). Replaces previously marked slots inside the window; the group heat-map updates immediately. Authenticated callers (Bearer PAT) skip the bot challenge; an anonymous caller must pass a Cloudflare Turnstile token in `turnstileToken` (only required when the server is configured with a Turnstile secret).
  - after: Publish hand-marked FREE time slots for an email address (the no-calendar fallback, e.g. Apple iCloud users). Replaces previously marked slots inside the window. Only one of YOUR addresses (account email, a connected calendar, a team address you joined; needs a Bearer PAT) goes live right away, for everyone — then the result is {ok, saved, free, busy} and the group heat-map updates immediately. For any other address nothing is published yet: the result is {ok: true, pending: true} and that person gets an email to confirm (confirmation emails are limited per day: 3 per address and 20 in total for your account; beyond that the call fails with rate_limited). To collect someone else's times, send them an ask-link instead (the picker's "Copy ask-link"). An anonymous caller must pass a Cloudflare Turnstile token in `turnstileToken` (only required when the server is configured with a Turnstile secret).

Full history: https://api.protogrid.dev/v1/servers/me.whenmeet%2Fscheduler/changes

## Remotes

- https://whenmeet.me/mcp (streamable-http, auth oauth2, reachable true, uptime30d 0.9375)

## Packages

_none_

## Tools (11)

- `book_slot`: Book a time on someone’s WhenMeet.me booking link. startsAt must be a slot start from get_booking_slots. Writes the event to the host’s calendar (Google Meet / Teams link added automatically), emails invites with an ICS to you, your guests and the host (or the team), and returns bookingId, conferenceUrl, meetingUrl and manageUrl (cancel / reschedule). name/email default to the authenticated user — pass them to book for someone else. Requires authentication (anonymous bookings need a human bot-check).
- `create_meeting`: Confirm a meeting: writes the event into the authenticated host’s calendar with an optional Google Meet/Teams link, emails invites with an ICS attachment, and returns the share URL (/m/<id>). Up to 50 participants; the start must be at most 60 days ahead (bad_window). Requires authentication.
- `find_common_slots`: Rank the best meeting times for the given participants, merging live Google/Microsoft calendar data, hand-marked availability and the heat-map sources. Each participant is filtered (Mon–Fri, waking hours) and scored in their OWN timezone; scores factor in buffer time around existing meetings and prefer sooner slots. Returns up to 8 slots: everyone-free slots first (allFree:true), then — only if there are too few — the best compromise slots (allFree:false) with a freeCount. Defaults to the next 14 days; the window may end at most 60 days from now (bad_window). Up to 50 participants; reading other people’s connected calendars is limited to 30 new addresses per hour and 50 per day (lookup_limit), and each read is shown to the calendar owner. Requires authentication.
- `get_booking_slots`: Bookable times on someone’s WhenMeet.me booking link (whenmeet.me/@nickname[/slug]) — personal or team link. Returns the link (title, durationMin, required questions, team mode), the host’s timezone and slots[{start,end,othersFree,othersTotal}]. Only times and counts are ever exposed, never anyone’s calendar. Called with a token, othersFree/othersTotal also show which slots suit YOUR calendar and the optional guests (othersFree === othersTotal = good for everyone). Defaults to the next 14 days. No auth needed.
- `get_manual_availability`: Read previously hand-marked free slots for an email within a window.
- `get_meeting`: Read a meeting by its share-link id (the UUID from /m/<id>): time, title, conference URL, host, and any proposed alternate times with their status.
- `get_meeting_availability`: Aggregated group availability for an existing meeting (the symmetric heat-map): per-30-min-slot counts of how many participants are free, plus ranked slots (per-participant timezones, buffer + soonness scoring, allFree:true everyone-free slots and allFree:false compromise slots). Individual calendars are never exposed. No auth needed — the meeting id is the capability.
- `list_my_event_types`: Your own booking link and its link types: profile (nickname, timezone, weekly hours), publicUrl (whenmeet.me/@nickname), and eventTypes[] with url, duration, settings and — for team links — mode ("all" = everyone must be free, "any" = whoever is free, in turn) and members with their status. Zero-config: if you have a calendar connected but never opened /links, this provisions the default 30-minute link first (idempotent), so the link is live. Requires authentication.
- `respond_to_suggestion`: Accept or decline a proposed alternate time. Accepting moves the meeting (calendar event included) and re-sends invites. Only the meeting host may call this — requires authentication.
- `set_manual_availability`: Publish hand-marked FREE time slots for an email address (the no-calendar fallback, e.g. Apple iCloud users). Replaces previously marked slots inside the window. Only one of YOUR addresses (account email, a connected calendar, a team address you joined; needs a Bearer PAT) goes live right away, for everyone — then the result is {ok, saved, free, busy} and the group heat-map updates immediately. For any other address nothing is published yet: the result is {ok: true, pending: true} and that person gets an email to confirm (confirmation emails are limited per day: 3 per address and 20 in total for your account; beyond that the call fails with rate_limited). To collect someone else's times, send them an ask-link instead (the picker's "Copy ask-link"). An anonymous caller must pass a Cloudflare Turnstile token in `turnstileToken` (only required when the server is configured with a Turnstile secret).
- `suggest_time`: Propose a different time for an existing meeting on behalf of a guest. The host is notified by email and can accept or decline (at most 10 suggestions per hour per meeting and email; beyond that rate_limited). Authenticated callers (Bearer PAT) skip the bot challenge; an anonymous caller must pass a Cloudflare Turnstile token in `turnstileToken` (only required when the server is configured with a Turnstile secret).