Slotlock

io.github.PILOTAAI/slotlock

Calendars for AI agents: free/busy, next free slot, and bookings PostgreSQL never double-books.

Connect this server

Add this to your MCP client config — claude_desktop_config.json (Claude Desktop) or .cursor/mcp.json (Cursor).Suits: Claude Desktop · Cursor.

{
  "mcpServers": {
    "slotlock": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/pilotaai/slotlock:0.6.0"
      ],
      "env": {
        "DATABASE_URL": "<your DATABASE_URL>",
        "SLOTLOCK_AUTH_TOKEN": "<your SLOTLOCK_AUTH_TOKEN>",
        "SLOTLOCK_CONFIRMATION_SECRET": "<your SLOTLOCK_CONFIRMATION_SECRET>",
        "SLOTLOCK_METRICS_TOKEN": "<your SLOTLOCK_METRICS_TOKEN>",
        "PORT": "8080",
        "SLOTLOCK_MIGRATE_DATABASE_URL": "<your SLOTLOCK_MIGRATE_DATABASE_URL>",
        "SLOTLOCK_CONFIRM_WRITES": "none",
        "SLOTLOCK_REST_API": "on",
        "SLOTLOCK_SHARED_LIMITS": "off",
        "SLOTLOCK_WEBHOOKS": "on",
        "SLOTLOCK_TENANT": "default"
      }
    }
  }
}
Environment variables
  • DATABASE_URLrequiredsecretpostgres:// URL of a PostgreSQL 16 or newer database the container can reach, as a role that is not a superuser and has no BYPASSRLS: serve refuses one, since row-level security would not confine it. Without SLOTLOCK_MIGRATE_DATABASE_URL this role also applies the schema, so it must be able to create it.
  • SLOTLOCK_AUTH_TOKENsecretOptional bearer token for SLOTLOCK_TENANT, with read and write (never admin): at least 32 random characters (openssl rand -hex 32). Leave it unset to accept only API keys (slotlock key create).
  • SLOTLOCK_CONFIRMATION_SECRETsecretSigns pending write confirmations: at least 32 random characters, different from the token. Required unless SLOTLOCK_CONFIRM_WRITES is none.
  • SLOTLOCK_METRICS_TOKENsecretServes Prometheus metrics at /metrics to this bearer token: at least 32 random characters, different from every other secret. Off without it.
  • PORTPort the server listens on inside the container.
  • SLOTLOCK_MIGRATE_DATABASE_URLsecretpostgres:// URL of the schema owner. When set, migration runs as this role and grants the DATABASE_URL role only what it needs at runtime.
  • SLOTLOCK_CONFIRM_WRITESWrites that wait for a person to confirm them: none, all, or a comma-separated list of slotlock_create_event, slotlock_book_together, slotlock_book_pool, slotlock_update_event, slotlock_delete_event. Clients without MCP 2026-07-28 form elicitation have guarded writes refused.
  • SLOTLOCK_REST_APIon: also serve the tools as a REST API under /v1, and the application API (resources, bookable hours, holds, reservations, coverage, maintenance) for admin keys, described by an OpenAPI 3.1 document at /openapi.json. Writes that wait for confirmation answer 428 there. off: MCP and A2A only.
  • SLOTLOCK_SHARED_LIMITSon: tenant request budgets (SLOTLOCK_LIMITS' tenant_* and app_*) are shared by every server of a deployment through PostgreSQL, so N servers allow a tenant its rate once, not N times. off: each server keeps its own.
  • SLOTLOCK_WEBHOOKSon: deliver each tenant's changes to its webhooks (POST /v1/webhooks), signed as Standard Webhooks; never to a private network address. private: those too, for testing. off: keep the change feed (GET /v1/changes), send nothing.
  • SLOTLOCK_TENANTThe tenant SLOTLOCK_AUTH_TOKEN acts in; API keys act in their own tenant.

A starting point — check the repository for exact arguments and setup. Restart your client after editing the config.

Category
Developer Tools
Version
0.6.0
Registry
active
Published
10/29/2026
Browse all Developer Tools →

Add the badge to your site

Show visitors that Slotlock is listed here — it’s also the link we check for a free listing.

Slotlock — listed on Serverdex

HTML — for your website

<a href="https://serverdex.io/server/io-github-pilotaai-slotlock?utm_source=badge"><img src="https://serverdex.io/brand/badge.svg" alt="Slotlock — listed on Serverdex" width="123" height="40" loading="lazy"></a>

Recommended. A dofollow link from your own domain is the one that counts for search engines, and it's the link we check for a free listing.

Markdown — for your README

[![Slotlock — listed on Serverdex](https://serverdex.io/brand/badge.svg)](https://serverdex.io/server/io-github-pilotaai-slotlock?utm_source=badge)

Nice for visibility, but GitHub marks README links nofollow, so it doesn't pass authority. Use the HTML badge on your site as well.