| CALDAV_URL | Yes | Root of the CalDAV server, e.g. https://dav.example.net. A calendar collection URL also works. |
| CALDAV_USERNAME | No | Account name. Most hosted services want an app-specific password with it. |
| CALDAV_PASSWORD | No | Password or app-specific password. Deleted from the environment once read. Secret. |
| CALDAV_TOKEN | No | Bearer token, as an alternative to username and password. Not both. Secret. |
| CALDAV_CALENDARS | No | Comma-separated calendars this server may touch, by path or final path segment. Default: all of them. |
| CALDAV_TIMEZONE | No | IANA zone for timestamps that carry no offset, e.g. Europe/Berlin (default: UTC) |
| CALDAV_USER_EMAIL | No | The address you are invited as, so respond_to_event can find your own attendee line |
| CALDAV_MAX_EVENTS | No | Entries a listing returns by default, 1 to 500 (default: 100) |
| CALDAV_READ_ONLY | No | Set to true to register only the read tools (default: false) |
| CALDAV_INSECURE_TLS | No | Set to true to accept a self-signed certificate on the configured host only (default: false) |
| CALDAV_ALLOW_PLAINTEXT | No | Set to true to allow a plain http:// URL to a host that is not loopback, which sends the credentials unencrypted (default: false) |
| CALDAV_ALLOW_TOOLS | No | Comma-separated tool names or list_* prefixes to register; 'essential' selects a curated preset (default: all tools) |
| CALDAV_DENY_TOOLS | No | Comma-separated tool names or list_* prefixes to remove from whatever the allow list left |
| ELICITATION | No | Deliberately unprefixed, and reaches every MCP server in the environment. Set to false to make guarded tools use the two-call token instead of a dialog (default: true) |
| CALDAV_URL | Yes | Root of the CalDAV server, e.g. https://dav.example.net. A calendar collection URL also works. |
| CALDAV_USERNAME | No | Account name. Most hosted services want an app-specific password with it. |
| CALDAV_PASSWORD | No | Password or app-specific password. Deleted from the environment once read. Secret. |
| CALDAV_TOKEN | No | Bearer token, as an alternative to username and password. Not both. Secret. |
| CALDAV_CALENDARS | No | Comma-separated calendars this server may touch, by path or final path segment. Default: all of them. |
| CALDAV_TIMEZONE | No | IANA zone for timestamps that carry no offset, e.g. Europe/Berlin (default: UTC) |
| CALDAV_USER_EMAIL | No | The address you are invited as, so respond_to_event can find your own attendee line |
| CALDAV_MAX_EVENTS | No | Entries a listing returns by default, 1 to 500 (default: 100) |
| CALDAV_READ_ONLY | No | Set to true to register only the read tools (default: false) |
| CALDAV_INSECURE_TLS | No | Set to true to accept a self-signed certificate on the configured host only (default: false) |
| CALDAV_ALLOW_PLAINTEXT | No | Set to true to allow a plain http:// URL to a host that is not loopback, which sends the credentials unencrypted (default: false) |
| CALDAV_ALLOW_TOOLS | No | Comma-separated tool names or list_* prefixes to register; 'essential' selects a curated preset (default: all tools) |
| CALDAV_DENY_TOOLS | No | Comma-separated tool names or list_* prefixes to remove from whatever the allow list left |
| ELICITATION | No | Deliberately unprefixed, and reaches every MCP server in the environment. Set to false to make guarded tools use the two-call token instead of a dialog (default: true) |