iCloud Calendar MCP Server

An MCP (Model Context Protocol) server for iCloud Calendar access via CalDAV.

Installation

# Using uvx (recommended)
uvx icloud-calendar-mcp

# Using pip
pip install icloud-calendar-mcp
icloud-calendar-mcp

Requirements

• Java 21+ must be installed
• iCloud credentials (Apple ID + App-Specific Password)

Setup

1. Get an App-Specific Password

1. Go to appleid.apple.com
2. Sign in and go to Security > App-Specific Passwords
3. Generate a new password for "iCloud Calendar MCP"

2. Set Environment Variables

export ICLOUD_USERNAME="your-apple-id@icloud.com"
export ICLOUD_PASSWORD="your-app-specific-password"

3. Configure Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "icloud-calendar": {
      "command": "uvx",
      "args": ["icloud-calendar-mcp"],
      "env": {
        "ICLOUD_USERNAME": "your-apple-id@icloud.com",
        "ICLOUD_PASSWORD": "your-app-specific-password"
      }
    }
  }
}

Available Tools

Security

This server is designed with security as a primary concern:

• App-Specific Passwords - Never use your main Apple ID password
• Environment Variables Only - Credentials loaded from environment only
• Input Validation - All inputs validated with SSRF protection
• Rate Limiting - 60 reads/min, 20 writes/min
• Error Sanitization - No credentials leaked in error messages
• OWASP MCP Top 10 - Full compliance with 282 security tests
• ReDoS Protection - All regex patterns tested against DoS
• Unicode Security - Protection against encoding attacks
• No Third-Party Data - Data only transmitted to iCloud CalDAV

Test Coverage

• 843 total tests
• 282 security tests covering OWASP MCP Top 10
• ReDoS, Unicode, SSRF, injection protection

Links

• GitHub Repository
• npm Package
• Security Policy
• MCP Documentation

License

Apache-2.0