Security

Authentication boundaries, authorization, capability exposure, and data minimization for FullCalendar WebMCP.

Protocol Tooling adapts WebMCP agents to your calendar persistence. It does not authenticate users, store credentials, or authorize mutations. Your host application and backend remain authoritative.

Session and authorization

WebMCP tools run in the user’s authenticated browser session. That lets agents act on behalf of a logged-in user — it is not authorization.

Tool availability is not authorization. A registered tool does not mean the current user may perform the action. Enforce permissions on every repository operation, the same path your UI uses.

When authorization fails, propagate the error from your repository. Failed mutations do not call onEventsChanged.

Capabilities

useFullCalendarWebMCP accepts optional capabilities to control which tools register:

useFullCalendarWebMCP({
  calendarRef,
  events: repository,
  onEventsChanged: refreshEvents,
  capabilities: {
    read: true,
    create: true,
    update: true,
    delete: false, // calendar_delete_event is not registered
  },
});

Capability	Tools when `false`
`read`	`calendar_list_events`, `calendar_get_event`
`create`	`calendar_create_event`
`update`	`calendar_update_event`
`delete`	`calendar_delete_event`

Omitted fields default to enabled. calendar_get_context is always registered — it exposes viewport/timezone context, not persisted events.

Capability hiding is defense in depth, not a security boundary. Clients can still call your API directly. Match capabilities to UI permissions, but enforce authorization server-side.

Event titles, metadata, and similar fields are user-controlled and may contain adversarial text. Protocol Tooling sets WebMCP trust annotations on read tools that return user content. Annotations are behavioral hints, not access controls.

Data minimization

Core write fields: title, start, end, allDay
metadata is optional, host-selected, JSON-safe, and read-only on WebMCP writes
FullCalendar extendedProps are never exposed automatically

Project only fields agents need. See Custom event model.

Origin

Tools register for same-origin agents by default. Protocol Tooling does not pass cross-origin exposedTo. WebMCP requires a Secure Context (HTTPS in production).

Checklist

Authenticate and authorize every repository call server-side
Enforce tenant/resource isolation
Expose only needed tools via capabilities and fields via metadata
Gate tool registration on auth state (re-mount or unregister on logout)