What problem does it solve? NanoClaw agent containers cannot access Google Calendar without exposing raw OAuth credentials, and wiring a calendar MCP server requires coordinated Dockerfile edits, database updates, and container rebuilds that are easy to get wrong. ## Core Features & Use Cases - OneCLI-managed OAuth: Uses stub credentials with a onecli-managed placeholder so containers never receive raw tokens; the OneCLI gateway injects real tokens at request time. - Multi-calendar and multi-account support: Installs @cocal/google-calendar-mcp, exposing tools like list-calendars, list-events, search-events, create-event, and get-freebusy. - Per-group wiring with guard test: Registers the MCP server and .calendar-mcp mount per agent group in the central DB, plus a vitest dependency-guard test that keeps the Dockerfile install pinned. - Use Case: An operator wants an agent to answer "what's on my work calendar next Monday?" — this skill installs the calendar MCP server, wires it into the group's config, rebuilds the image, and verifies the tool works. ## Quick Start Ask the agent to add the Google Calendar tool to a specific NanoClaw agent group using OneCLI-managed OAuth and then verify by asking it to list your calendars.