carddav-mcpYour address book, over the open standard

MCP server for CardDAV address books: contacts, groups and photos

One protocol, most address books
CardDAV is the standard behind Nextcloud, Radicale, Baikal, Fastmail, mailbox.org and iCloud, so one server reaches all of them. It walks from the URL you paste to the address books behind it the way a real client does — a server root or a single collection URL both work — and reports which vCard versions each book accepts.
Both kinds of group
vCard 4 writes a group as KIND:group with MEMBER properties. Apple got there first and shipped X-ADDRESSBOOKSERVER-KIND on top of vCard 3, which is what most address books actually store. This server reads both and writes whichever the book already uses — because a group in the other convention is not a footnote, it is invisible in the client the person is looking at.
Only the tools you want
CARDDAV_READ_ONLY=true registers the read tools and nothing else. CARDDAV_ALLOW_TOOLS cuts finer — essential for a curated handful, your own comma-separated list, or a whole family with list_* — and CARDDAV_DENY_TOOLS subtracts. Whatever is filtered out does not exist on the protocol rather than failing when called, and a name that matches no tool stops the server at startup instead of quietly going missing.
A person is asked, not just told
The destructive tools ask a person first, through MCP elicitation — a dialog the model cannot answer on its behalf, falling back to a server-issued token bound to the exact target where the client cannot show one. Contact data is marked untrusted, and read-only mode simply does not register the write tools.

One client, one server, one address book — and nothing else on the wire.

Three tool calls against a local Radicale: listing the contacts in an address book, finding one by name, and reading a group with its member count.

Running it elsewhere

A client that cannot spawn a local process — ChatGPT connectors, Claude on the web, Cursor, LibreChat — cannot start this server the way Claude Code does. mcp-hub is the bridge: one container serves many stdio MCP servers over Streamable HTTP behind a single OAuth 2.1 login, and it speaks both protocol revisions, so a question this server asks reaches the person at the far end instead of stopping at the gateway. See connecting clients.

carddav-mcpYour address book, over the open standard

One protocol, most address books

Both kinds of group

Only the tools you want

A person is asked, not just told

Running it elsewhere ​

Running it elsewhere