Skip to content
AI Service Catalogue

Sample data. All services, vendors and assessments in this proof of concept are fictional.

Back to the catalogue
MCPIn review

Tundrel Calendar MCP Server

Vendor: Tundrel Systems

Hosted MCP server that lets an AI assistant read calendars, book meetings and send invitations on behalf of the user.

Last updated

Summary

The assessment is in progress. Findings and actions can change.

So far, the server can send invitations to external recipients and uses broad calendar permissions. Both need a closer review.

Assessment areas

  • Privacy

    Not yet assessed

  • Data flow and retention

    Low severity

    The server is hosted in Germany. Calendar data is cached for up to 24 hours.

  • Information security

    Not yet assessed

  • AI regulation

    Not yet assessed

  • Exit options

    Not yet assessed

  • Tool access

    High severity

    Read tools: list_events, find_free_time. Write tools: create_event, update_event. Delete tools: cancel_event. Send tools: send_invitation, which can send email to any address.

  • Authentication

    Medium severity

    The server uses OAuth with broad calendar scopes. It is not yet clear whether scopes can be limited per tool.

  • Hidden instructions in tool descriptions

    Not yet assessed

Actions

Actions for the vendor

  • High severity

    Make it possible to limit send_invitation to recipients inside the organisation.

Actions for the organisation

  • Medium severity

    Decide which tools to allow before a pilot.

Vendor declaration

Answers as given by the vendor. They are not verified unless the assessment says so.

Where is customer data processed and stored?
The vendor hosts the server in Germany.
Is any data transferred outside the EEA, and on what legal basis?
No transfers outside the EEA, according to the vendor.
Is customer data used to train or improve models?
Not applicable. The server does not include a language model.
How long are prompts, outputs and logs kept?
Calendar data is cached for up to 24 hours. Logs are kept for 30 days.
Which subprocessors does the service use?
Hosting provider (Germany).
Which security standards or independent audits does the vendor refer to?
Not provided.
How can the organisation export its data and end the agreement?
Not applicable. Calendar data stays in the organisation's calendar system.

Vendor comments

  • Recipient limits for send_invitation are available on the enterprise plan. We will send documentation.