Most calendars make agents scrape a screen or borrow a password. Windy Calendar gives them a real door: they prove who they are, ask for what they need, and the owner stays in charge.
Every call carries an Eternitas passport (an EPT). Windy Calendar checks its signature, the signed revocation list and the live status feed on every request. No passport, no tools.
The passport names the agent’s human owner, and that owner’s calendar is the one it can use. An agent can’t reach anyone else’s calendar.
What an agent may do depends on its live Eternitas trust score, the owner’s limits for that agent, and whether the change touches someone else.
Two endpoints over plain HTTPS. GET /tools lists what this agent may use; POST /invoke runs one.
POST https://windycalendar.com/invoke
Authorization: Bearer <your Eternitas passport token>
Content-Type: application/json
{"name": "book_appointment",
"arguments": {"starts_at_utc": "2026-10-14T18:00:00Z",
"booker_name": "Sarah Lee", "booker_email": "sarah@example.com",
"idempotency_key": "intro-sarah-2026-10-14"}}
idempotency_key and a retry returns the first booking instead of a second one.slot_taken and the next open times.confirm_required (waiting in the owner’s Windy Inbox), rate_limited (the owner’s daily limit), agent_blocked (the owner turned you off).28 tools, from the live contract control.mcp.v1. Tools that are built but not switched on yet are not listed.
| Tool | What it does | Access |
|---|---|---|
get_health | Returns what is healthy and what is broken (database, email sender, booking lock); each finding names the tool call that addresses it. | reads |
get_status | Returns the running version, whether the database is reachable, and the number of upcoming appointments. | reads |
get_config | Returns the owner's configuration (secrets omitted): timezone, confirmation from-address, reminder cadence. | reads |
get_logs | Returns the owner's recent activity log: timestamp, actor, action. | reads |
run_selftest | Runs a non-destructive check of the booking path: slot-lock index present, database answers a query, .ics invite generates. | reads |
get_capabilities | Returns whether taking bookings, confirmation email, reminders and .ics invites work right now: supported, unsupported or unknown (probed, never assumed). | reads |
reconnect | Re-establishes and verifies the database connection without a restart. | reads |
check_for_update | Returns the running version against the fleet's published version. | reads |
list_settings | Returns every setting the owner can change (timezone, display name, from-address, reminder cadence) with type, current value and description. | reads |
set_setting | Sets one setting by path (from list_settings). | asks first below top trust |
undo_last_change | Reverts the most recent setting change, stepping back through the owner's change history. | asks first below top trust |
enter_safe_mode | Holds new bookings. | reads |
exit_safe_mode | Leaves safe mode: the booking page and agents can take new bookings again. | asks first below top trust |
reset_to_defaults | Resets notification and display settings to defaults (reminders day-before and hour-before) and resumes bookings if paused. | always confirms |
list_appointments | Returns the owner's appointments in a date range (default next 7 days) in a timezone (default the owner's): time, kind (single | meeting), title, booker name, location. | reads |
get_appointment | Returns one booking or meeting by id: time, kind (single | meeting), title, booker name and contact, location, status. | reads |
get_availability | Returns the open bookable slots for a date range in a timezone, earliest first; optional count limits to the first N. | reads |
set_availability | Replaces the owner's weekly open hours and slot length. | asks first below top trust |
block_time | Marks a time range unavailable. | asks first below top trust |
book_appointment | Books a time on the owner's calendar. | asks first below top trust |
reschedule_appointment | Moves a booking to a new time, frees the old one atomically and notifies the owner and the booker. | asks first below top trust |
cancel_appointment | Cancels a booking, frees its slot atomically and notifies the other party. | asks first below top trust |
set_reminder_policy | Sets how far ahead reminder emails go, separately for the owner and the booker. | asks first below top trust |
set_meeting_location | Sets where one appointment happens: a physical address or a meeting link. | asks first below top trust |
create_meeting | Creates a meeting on the owner's calendar and emails an invitation (with Accept/Decline links and an .ics) to up to 10 people. | asks first below top trust |
get_booking_page | Returns the public booking-page URL. | reads |
get_calendar_feed | Returns the read-only .ics subscription URL (private; no login, no two-way sync). | reads |
rotate_feed_token | Issues a new secret token for the .ics feed and week view and revokes every previously shared feed or calendar URL. | asks first below top trust |