Skills/PyPI/apple-calendar-eventkit-mcp

apple-calendar-eventkit-mcp@0.4.1

CAUTION· not started

Publisher claims: "MCP server that lets Claude read and manage Apple Calendar and Reminders on macOS via EventKit" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher o-uz-ka-an-g-mez · publishing for 2 daysInstalls 91Last detonated 21 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
AUTH_RATE_LIMITCALDAV_PASSWORDCONNECTOR_PASSWORDOAUTH_ALLOW_LOCALHOSTOAUTH_ALLOWED_REDIRECTSOAUTH_KVOAUTH_PROVIDERConfiguration, not credentials: BACKEND, CALDAV_DEFAULT_CALENDAR, CALDAV_URL, CALDAV_USERNAME, DATA_DIR, FORWARDED_ALLOW_IPS, HIDDEN_CALENDARS, ONLY_CALENDARS, PUBLIC_URL, READ_ONLY, READ_ONLY_CALENDARS
Where it talks to
no vendor host named in the codeAlso claude.ai, icloud.com, claude.com, docker.com, google.internal, apple.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names claude.ai, icloud.com, claude.com, docker.com, google.internal, apple.com as well as its own vendor. The guard injects AUTH_RATE_LIMIT, CALDAV_PASSWORD, CONNECTOR_PASSWORD, OAUTH_ALLOW_LOCALHOST, OAUTH_ALLOWED_REDIRECTS, OAUTH_KV, OAUTH_PROVIDER only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx apple-calendar-eventkit-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Privileged sudo command; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

HIGH
Privileged sudo commanddeploy/gcp/setup-vm.sh:12 · Privileged sudo command — agent may execute with elevated privilegesecho '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab >/dev/nullFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commanddeploy/gcp/setup-vm.sh:9 · Privileged sudo command — agent may execute with elevated privilegessudo chmod 600 /swapfileFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commanddeploy/gcp/setup-vm.sh:8 · Privileged sudo command — agent may execute with elevated privilegessudo fallocate -l 1G /swapfileFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdeploy/gcp/setup-vm.sh:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# The code, and a private .env to fill in.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commanddeploy/gcp/setup-vm.sh:11 · Privileged sudo command — agent may execute with elevated privilegessudo swapon /swapfileFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commanddeploy/gcp/setup-vm.sh:10 · Privileged sudo command — agent may execute with elevated privilegessudo mkswap /swapfileFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/apple_calendar_mcp/remote.py:114 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"CONNECTOR_PASSWORD (12+ characters, you type it once when connecting). See .env.example."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdeploy/gcp/setup-vm.sh:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [ ! -f .env ]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsworker/src/auth.ts:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Values shipped in .env.example / docs: never accept one of these.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdeploy/gcp/setup-vm.sh:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileschmod 600 .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationsrc/apple_calendar_mcp/remote.py:181 · Auto-update or dynamic fetch configuration — agent may load new code at runtimedef __init__(self, config: RemoteConfig, db: AuthDB, clock: Callable[[], float] = time.time) -> None:Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathsDockerfile:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Run: docker compose up -d (reads .env, see .env.example)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commanddeploy/gcp/setup-vm.sh:20 · File permission modification command — agent changes file ownership/permissionssudo chmod a+r /etc/apt/keyrings/docker.ascFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Auto-update or dynamic fetch configurationsrc/apple_calendar_mcp/remote.py:617 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeservice: CalendarService, config: RemoteConfig, *, read_only: bool = FalseFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathsdocker-compose.https.yml:14 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesDOMAIN: ${DOMAIN:?set DOMAIN in .env}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commanddeploy/gcp/setup-vm.sh:35 · File permission modification command — agent changes file ownership/permissionschmod 600 .envFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known package.github/workflows/ci.yml:103 · npx invocation of non-well-known package — may execute untrusted code- run: npx wrangler deploy --dry-run --outdir distFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathssrc/apple_calendar_mcp/cli.py:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"from appleid.apple.com). See .env.example."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/apple_calendar_mcp/remote.py:68 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Values shipped in .env.example / docs: a server must never start with one of these.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathsdocker-compose.https.yml:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Needs DOMAIN in .env, pointing at this server's IP.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commanddeploy/gcp/setup-vm.sh:9 · File permission modification command — agent changes file ownership/permissionssudo chmod 600 /swapfileFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsdeploy/gcp/setup-vm.sh:34 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescp .env.example .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandDockerfile:17 · File permission modification command — agent changes file ownership/permissions&& mkdir -p /data && chown app /dataFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packageworker/src/auth.ts:29 · npx invocation of non-well-known package — may execute untrusted codeif (!password) return "CONNECTOR_PASSWORD is not set. Run: npx wrangler secret put CONNECTOR_PASSWORD";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/build-mcpb.sh:18 · npx invocation of non-well-known package — may execute untrusted codenpx --yes "@anthropic-ai/mcpb@$MCPB_VERSION" validate "$stage/manifest.json"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Auto-update or dynamic fetch configurationtests/test_remote_auth.py:452 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeRemoteConfig(public_url=BASE, password="change-me-to-a-long-random-string", data_dir=tmp_path)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Auto-update or dynamic fetch configurationtests/test_cli.py:283 · Auto-update or dynamic fetch configuration — agent may load new code at runtimedef fake_serve(service: Any, config: remote.RemoteConfig, *, read_only: bool = False) -> None:Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathsdocker-compose.yml:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file: .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/build-mcpb.sh:19 · npx invocation of non-well-known package — may execute untrusted codenpx --yes "@anthropic-ai/mcpb@$MCPB_VERSION" pack "$stage" "dist/apple-calendar-mcp-$version.mcpb"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedtests/test_macos_app.py:131 · Python subprocess execution detectedout = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packageworker/src/index.ts:53 · npx invocation of non-well-known package — may execute untrusted codethrow new ConfigError("CALDAV_USERNAME and CALDAV_PASSWORD are not set. Use npx wrangler secret put.");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedtests/test_macos_app.py:135 · Python subprocess execution detectedsubprocess.run(["codesign", "--verify", str(app)], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_caldav_store.py:70 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈67 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for apple-calendar-eventkit-mcp@0.4.1 as of 19 h ago. This is the package itself, not its dependencies.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim o-uz-ka-an-g-mez: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  5. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim o-uz-ka-an-g-mezPropose a patch to the maintainer