agentic‑readiness docs
/
Scan at scale Blog Build one › Run a scan ›

DocsCapabilitiesPersonal Agent Protocol

Personal Agent Protocol

A file at /.well-known/poppy.json that tells a person's own AI agent how to sign in to a business and reach it.

adoption Early pilotstrend ▲ risingchecked once per sitechecks 14verified 2026-10-14
Set up Personal Agent Protocol on your site How to tell a customer's own AI agent where to sign in and what it can use, in the shape draft 0.1 requires.
Free Publish a Personal Agent Protocol file

Why an agent cares

It is how a customer's personal agent starts a session with a company, signs in on the customer's behalf, and finds the company's agent, APIs or website. Every rule a site can break is a MUST in the draft, and a compliant agent refuses a document that breaks one, so a broken file turns customers' agents away.

Adoption

Early pilots. Named early adopters exist, behind flags or trials. Nothing has been independently measured yet.

Direction of travel: ▲ rising, as at .

Draft 0.1 was published on 2026-10-09 by Sierra with Meta and 43 named design partners. Five days later 27 live documents from 10 publishers existed, every one valid; none of the design partners publishes one yet.

AdopterDepthEvidence
Tilopay (15 storefronts)productiontilopay.shop
Print with Poppyproductionprintwithpoppy.com
Emora Healthproductionemorahealth.com

What we check

Absence is never a finding. Every check below runs only when this technology is detected, so a site that has not adopted this is not assessed on it and appears in no report. 14 of these 15 can fail it. In Lumar these appear once per site, in the site-wide results of each crawl.
CheckSeverityRaisesOn whose authority
Personal Agent Protocol Not HTTPShighconformance, usability, security (CWE-319)specification: Personal Agent Protocol specification, draft 0.1
Personal Agent Protocol Invalid Versionhighconformance, usabilityspecification: Personal Agent Protocol specification, draft 0.1
Personal Agent Protocol Missing Organizationhighconformance, usabilityspecification: Personal Agent Protocol specification, draft 0.1
Personal Agent Protocol Domain Mismatchhighconformance, usabilityspecification: Personal Agent Protocol specification, draft 0.1
Personal Agent Protocol Missing Authhighconformance, usabilityspecification: Personal Agent Protocol specification, draft 0.1
Personal Agent Protocol Issuer Not HTTPShighconformance, usabilityspecification: Personal Agent Protocol specification, draft 0.1
Personal Agent Protocol Insecure Endpointhighconformance, usability, security (CWE-319)specification: Personal Agent Protocol specification, draft 0.1
Personal Agent Protocol Issuer Metadata Missinghighconformance, usabilityspecification: Personal Agent Protocol specification, draft 0.1
Personal Agent Protocol Issuer Mismatchhighconformance, usabilityspecification: Personal Agent Protocol specification, draft 0.1
Personal Agent Protocol Domain Not Listedhighconformance, usabilityspecification: Personal Agent Protocol specification, draft 0.1
Personal Agent Protocol No Channelmediumconformance, usabilityspecification: Personal Agent Protocol specification, draft 0.1
Personal Agent Protocol Browser Session Off Domainmediumconformance, usabilityspecification: Personal Agent Protocol specification, draft 0.1
Personal Agent Protocol Unknown API Typemediumconformance, usabilityspecification: Personal Agent Protocol specification, draft 0.1
Personal Agent Protocol Issuer Metadata Incompletemediumconformance, usabilityspecification: Personal Agent Protocol specification, draft 0.1
Personal Agent Protocol Partially Assessedcoverage notenothingour own coverage

Examples

Both run through the same checks as a live scan: the first passes, the second is flagged.

correctjson
{
  "protocol_version": "0.1",
  "organization": { "name": "Example Company", "domain": "example.com" },
  "auth": {
    "issuer": "https://auth.example.com",
    "direct": { "scopes": ["poppy:read", "poppy:write"] },
    "device": { "scopes": ["poppy:read"] }
  },
  "agent": {
    "protocols": [{ "type": "poppy", "endpoint": "https://api.example.com/poppy/conversations" }]
  },
  "web": { "browser_session_endpoint": "https://example.com/poppy/browser-session" },
  "apis": [
    { "type": "openapi", "url": "https://api.example.com/openapi.json", "description": "Orders and returns" },
    { "type": "mcp", "url": "https://mcp.example.com/mcp", "description": "Product search" }
  ],
  "extensions": { "operations": { "version": "1", "endpoint": "https://api.example.com/poppy/operations" } }
}
present but wrongjson
{
  "protocol_version": "1",
  "organization": { "name": "Example Company", "domain": "another-company.example" },
  "agent": {
    "protocols": [{ "type": "poppy", "endpoint": "http://api.example.com/poppy/conversations" }]
  },
  "apis": [{ "type": "graphql", "url": "https://api.example.com/graphql", "description": "Everything" }]
}

Specifications

DocumentRevisionKind
Personal Agent Protocol specification, draft 0.1Draft 0.1 (2026-10-09)specification
RFC 8414 — OAuth 2.0 Authorization Server MetadataPublished RFCspecification
Sierra: Sharing a draft of Personal Agent ProtocolLiving documentguidance

Last re-read against the published documents: .