This week Cisco used WebexOne to announce that AI agents, Claude among them, will join Webex spaces, meetings and calls to carry out multi-step work on a team’s behalf. A few days earlier, the MCP community met in Toronto to keep building the protocol those agents use to reach the tools around them. The direction is settled: agents are moving out of chat windows and into the places where work is planned.

That raises a question few of the launch posts asked: when your agent books a meeting, how does it know you’re actually free?

For the past six months I’ve been running an MCP server and a scheduling agent in production at Calendrz, the calendar product I build. Here’s what we learned about letting AI near a calendar.

The single-calendar blind spot

Most agents that “manage your calendar” are connected to one calendar: the account you signed in with. That’s fine if your whole life lives in one Google Workspace. For most of the people we serve, it doesn’t:

• a consultant with a Microsoft 365 login for each of three clients;
• a founder with a company account, an advisory account and a personal Gmail;
• an employee whose school pick-up, physio appointment and Tuesday commute sit in a personal calendar their employer never sees.

An agent that sees only one of these calendars will confidently offer slots that are already taken. It won’t feel like an AI failure. It will feel like you double-booked yourself, and the cost of an awkward reschedule lands on you.

Speed isn’t what makes an agent good at scheduling. Seeing every calendar you’re committed to is.

What we built, and why it’s shaped the way it is

Calendrz started as an availability mirroring service. Connect your accounts and, when you’re busy in one, every other calendar is auto-blocked with a private marker. No event titles, attendees or links leave the calendar they came from. That one picture of your real availability turned out to be exactly what an agent needs.

So when we opened Calendrz to AI assistants through the Calendrz MCP server, and later through our own Smart Scheduler, we followed four rules.

1. Answer “when am I free?” across every connected account

Tools like find_free_slots and get_busy_times look at your whole profile, not one account. The agent never has to work out which of your five calendars matters. It gets one answer that already accounts for all of them.

2. Keep a human on the final “yes”

The Smart Scheduler proposes a time with full event details, then waits. It writes nothing to your calendar until you say “go”. People forgive an agent that gets a proposal wrong. A meeting it silently sends to a client is much harder to forgive. Agents that act inside meetings will need the same discipline.

3. Tools should explain themselves when the agent gets them wrong

Our production logs taught us this one. Language models are good at calling tools and imperfect at matching parameter names exactly. One assistant called our get_events tool with start and end, the field names it had seen in the tool’s response. The tool expects startDate and endDate, so the call was rejected with a bare validation error.

We changed two things. We rewrote the tool descriptions to spell out the exact input key names, so a model guesses right the first time. And when input validation does fail, the server now replays the accepted parameters in the error, so the agent can correct itself on the next call instead of telling you it couldn’t check your calendar. (The nightly AI agent that reads our production logs caught the first issue and proposed the fix itself.)

4. Least privilege, by design

Agents never see the Google or Microsoft OAuth tokens behind your connected accounts. Profile data is sanitised before it leaves the server. Destructive tools, like removing a connected account, carry an explicit warning in their response. Requests are stateless and authenticated with short-lived tokens. If you wouldn’t hand a new assistant your passwords on day one, don’t hand them to an agent either.

What this means for the agent wave

The Webex announcement, and others like it from the big collaboration platforms, will put agents in meetings that generate follow-ups: “let’s reconvene Thursday”, “can we get the CFO in next week?”. Each of those becomes a scheduling request. The quality of that request depends on the calendar data the agent can reach.

If you’re evaluating agents for your team, ask three questions:

1. Which calendars can it see? One, or every calendar you’re accountable to?
2. Who confirms? Does it propose and wait, or act and apologise?
3. What does it leak? When it blocks time on a client’s calendar, does it copy your private meeting titles across?

Try it with the assistant you already use

The Calendrz MCP server works with Claude, ChatGPT and any MCP-aware client today. Point it at https://app.calendrz.com/mcp, sign in with Google or Microsoft, and your assistant can find free time across every connected account, book meetings with video links attached, and respond to invites, without seeing anything it shouldn’t.

Agents are coming to your meetings either way. Give yours the full picture of your calendars. If you want to see how we’ve done it, Calendrz is free to try. I’d also like to hear how others are handling agent access to calendars.