---
title: Security
description: Authentication boundaries, authorization, capability exposure, and data minimization for FullCalendar WebMCP.
---

Protocol Tooling adapts WebMCP agents to your calendar persistence. It does not authenticate users, store credentials, or authorize mutations. Your host application and backend remain authoritative.

## Session and authorization

WebMCP tools run in the user's authenticated browser session. That lets agents act on behalf of a logged-in user — it is not authorization.

**Tool availability is not authorization.** A registered tool does not mean the current user may perform the action. Enforce permissions on every repository operation, the same path your UI uses.

When authorization fails, propagate the error from your repository. Failed mutations do not call `onEventsChanged`.

## Capabilities

`useFullCalendarWebMCP` accepts optional `capabilities` to control which tools register:

```ts
useFullCalendarWebMCP({
  calendarRef,
  events: repository,
  onEventsChanged: refreshEvents,
  capabilities: {
    read: true,
    create: true,
    update: true,
    delete: false, // calendar_delete_event is not registered
  },
});
```

| Capability | Tools when `false` |
|---|---|
| `read` | `calendar_list_events`, `calendar_get_event` |
| `create` | `calendar_create_event` |
| `update` | `calendar_update_event` |
| `delete` | `calendar_delete_event` |

Omitted fields default to enabled. `calendar_get_context` is always registered — it exposes viewport/timezone context, not persisted events.

Capability hiding is defense in depth, not a security boundary. Clients can still call your API directly. Match capabilities to UI permissions, but enforce authorization server-side.

## Untrusted content

Event titles, metadata, and similar fields are user-controlled and may contain adversarial text. Protocol Tooling sets WebMCP trust annotations on read tools that return user content. Annotations are behavioral hints, not access controls.

## Data minimization

- Core write fields: `title`, `start`, `end`, `allDay`
- `metadata` is optional, host-selected, JSON-safe, and read-only on WebMCP writes
- FullCalendar `extendedProps` are never exposed automatically

Project only fields agents need. See [Custom event model](/integrations/fullcalendar/guides/custom-event-model).

## Origin

Tools register for same-origin agents by default. Protocol Tooling does not pass cross-origin `exposedTo`. WebMCP requires a [Secure Context](https://webmachinelearning.github.io/webmcp/) (HTTPS in production).

## Checklist

- [ ] Authenticate and authorize every repository call server-side
- [ ] Enforce tenant/resource isolation
- [ ] Expose only needed tools via `capabilities` and fields via `metadata`
- [ ] Gate tool registration on auth state (re-mount or unregister on logout)