Implement Personal Agent Protocol (Poppy) discovery

Publish public discovery metadata for the Personal Agent Protocol draft 0.1. This check is informational and does not affect readiness levels or percentage scores.

Website-only discovery

Serve JSON at https://YOUR-DOMAIN/.well-known/poppy.json:

{
  "protocol_version": "0.1",
  "organization": { "name": "Example Company", "domain": "example.com" },
  "web": {}
}

Replace the example organization with your actual name and domain. The domain must match the hostname of the requested well-known URL, ignoring leading www.. HTTPS redirects to a hosting provider are allowed, but that provider's hostname must not replace your organization domain. Return JSON, not your SPA's HTML fallback. Unknown fields and optional extensions are allowed.

Session-enabled interfaces

Declare the interfaces you actually implement: agent.protocols entries with type and HTTPS endpoint, apis entries with type, HTTPS url, and description, or web.browser_session_endpoint. Agent/API declarations and browser-session endpoints require auth.issuer.

The issuer must publish RFC 8414 metadata with:

• issuer exactly matching auth.issuer;
• poppy_domains containing organization.domain;
• HTTPS token_endpoint and revocation_endpoint;
• authorization_endpoint when auth.direct is declared;
• device_authorization_endpoint when auth.device is declared.

For issuer https://auth.example.com/tenant, publish metadata at https://auth.example.com/.well-known/oauth-authorization-server/tenant. Direct, device, and mediated sign-in declarations contain scope arrays. Mediated sign-in also describes its endpoint and credential fields; never put actual credentials or secrets in discovery metadata.

Publish only capabilities backed by working implementations. Passing this check confirms public discovery and issuer binding, not functioning sessions, sign-in, API authorization, or conversations. The draft may change before version 1.0.

Verify

Scan your site and inspect checks.discovery.personalAgentProtocol. Its details.issuerValidation reports verified, notRequired, unverified, invalid, or notChecked. Use the audit evidence to diagnose invalid fields, redirects, and issuer/domain mismatches. Network failures and unsupported major versions return unableToCheck while retaining available discovery evidence.