Google Calendar plugin
The Google Calendar plugin lets a Vaubaan Gateway mission use Google Calendar without handing the agent a credential. Google Calendar through Google's own Calendar MCP server: read the agenda, suggest a time, create, change and delete events, answer invitations — one resource per calendar.
- Version:
0.1.0(package@vaubaan/plugin-google-calendar) - Health: not enough reports yet — what this means
- Source: plugins/google-calendar, catalog risk-catalog.yaml version 1 of 2026-10-27
- How to connect an account: Connect Google Calendar
- How it is modelled: handbook
One account is one Google account: you sign in at Google through the OAuth broker this gateway is enrolled with, with nothing to create or paste. One resource is one calendar of that account; a mission touches only the calendars it was given. Inviting people of the company and people outside it are separate permissions, decided by each calendar's internal domains, and so are letting Google email the guests of a change, and deleting.
Permissions
Each permission is a named risk of the plugin's catalog: a mission holds an explicit list of them, never "all". The severity is computed from the permission's six axes (undo, blast radius, data, cost, visible to, lasts); nothing is decided from it.
| Permission | What it allows | Severity | Why it is a risk |
|---|---|---|---|
google-calendar.calendar-list | List the calendars of the mission | low | The names of the calendars the mission was given, answered by the gateway from what discovery found. Nothing of an event. |
google-calendar.event-read | Read events (titles, times, places, guests, descriptions) | low | Listing, searching and reading the events of a calendar of the mission. An agenda says who meets whom, when and where, and a description may hold a meeting link or a document; it is also text written by others, a path for prompt injection. |
google-calendar.free-busy-read | Read when people are free or busy | low | Suggesting a time reads the busy slots of the people named — never their events — as far as their calendar shares it with this account. No calendar of the mission bounds who is asked about. |
google-calendar.event-create | Create events | low | A new event on a calendar of the mission. Alone it reaches nobody but the calendar's readers; inviting people is a permission of its own, by who they are. |
google-calendar.event-change | Change events (time, title, description, place, guests) | medium | Moving or rewriting an existing event, the ones others organised included when the account may edit them. Undone by changing it back, but whoever read it meanwhile acted on it. |
google-calendar.event-delete | Delete events | medium | Removing an event from a calendar of the mission; on an event this account organises, Google cancels it for every guest. Google keeps deleted events in its trash for a while, but a cancelled meeting is not undone for the people who were told. |
google-calendar.event-respond | Answer invitations (accept, maybe, decline) | low | Accepting, tentatively accepting or declining an invitation, with an optional comment. Google tells the organizer, who may be outside the company. |
google-calendar.invite-internal | Invite people of the company | medium | Adding guests whose address is on an internal domain of the calendar (its `internal_domains`) or a meeting room. Google emails them the event, its description and attachments included: it stays inside the company. |
google-calendar.invite-external | Invite people outside the company | high | Adding guests on any other domain. Google emails them the event, its description and attachments included: the way calendar content leaves the company, and a way to spam in the account's name. Scheduling with customers needs it; it is best asked for. |
google-calendar.notify-guests | Let Google email the guests about a change or a cancellation | high | A change or a deletion sent with any notification level but NONE: Google emails the event's current guests, who may be outside the company, the new version of the event. Who they are is not known before the call. An agent that sets notificationLevel to NONE does not need this permission. |
google-calendar.uncategorized-write | Uncategorized Google Calendar write | high (the catch-all: touched only by a call no other permission covers) | Catch-all for writes no entry above covers; none of the offered tools reaches it today. A tool Google adds is not offered until it is modelled. Never offered in a preset. |
Presets
A preset pre-fills the permissions of a mission for one account, with a limit per period, a rate and whether each permission runs freely or asks the mission creator first. The person creating the mission adjusts it; the mission stores the explicit list.
Read-only
read-only — List the calendars, read and search their events and see when people are free. Nothing is changed and nobody is emailed.
| Permission | What it allows | Limit per period | Rate | Runs |
|---|---|---|---|---|
google-calendar.calendar-list | List the calendars of the mission | 500 | 20 per minute | runs freely |
google-calendar.event-read | Read events (titles, times, places, guests, descriptions) | 2000 | 60 per minute | runs freely |
google-calendar.free-busy-read | Read when people are free or busy | 300 | 20 per minute | runs freely |
Assistant
assistant — Run the agenda like an assistant. Reading, creating and moving events, answering invitations, inviting colleagues and telling the guests of a change run freely; deleting an event and inviting anyone outside the company ask first.
| Permission | What it allows | Limit per period | Rate | Runs |
|---|---|---|---|---|
google-calendar.calendar-list | List the calendars of the mission | 500 | 20 per minute | runs freely |
google-calendar.event-read | Read events (titles, times, places, guests, descriptions) | 2000 | 60 per minute | runs freely |
google-calendar.free-busy-read | Read when people are free or busy | 300 | 20 per minute | runs freely |
google-calendar.event-create | Create events | 100 | 10 per minute | runs freely |
google-calendar.event-change | Change events (time, title, description, place, guests) | 200 | 10 per minute | runs freely |
google-calendar.event-respond | Answer invitations (accept, maybe, decline) | 100 | 10 per minute | runs freely |
google-calendar.invite-internal | Invite people of the company | 100 | 10 per minute | runs freely |
google-calendar.notify-guests | Let Google email the guests about a change or a cancellation | 50 | 5 per minute | runs freely |
google-calendar.event-delete | Delete events | 30 | 5 per minute | ask me first |
google-calendar.invite-external | Invite people outside the company | 30 | 5 per minute | ask me first |
Tools
| Tool | What it does |
|---|---|
google_calendar__list_calendars | List the calendars |
google_calendar__list_events | List events |
google_calendar__search_events | Search events |
google_calendar__get_event | Read an event |
google_calendar__suggest_time | Suggest a time |
google_calendar__create_event | Create an event |
google_calendar__update_event | Change an event |
google_calendar__delete_event | Delete an event |
google_calendar__respond_to_event | Answer an invitation |
Health
Health: not enough reports yet. A plugin version is deemed validated by the community with at least 200 reports and 90 % of them successful, over the last 90 days, as reported by the instances whose operators turned community telemetry on. It is a community signal, not a security guarantee.