# Personal Agent Protocol

A file at /.well-known/poppy.json that tells a person's own AI agent how to sign in to a business and reach it.

**[Capabilities](/docs/capabilities)** · checked once per host (item type `pap`) · 14 checks that can fail it

It is how a customer's personal agent starts a session with a company, signs in on the customer's behalf, and finds the company's agent, APIs or website. Every rule a site can break is a MUST in the draft, and a compliant agent refuses a document that breaks one, so a broken file turns customers' agents away.

## Adoption

**Early pilots** (L1)

Named early adopters exist, behind flags or trials. Nothing has been independently measured yet. Direction of travel: ▲ rising, as of 2026-10-14.

Draft 0.1 was published on 2026-10-09 by Sierra with Meta and 43 named design partners. Five days later 27 live documents from 10 publishers existed, every one valid; none of the design partners publishes one yet.

| Adopter | Depth | Evidence |
|---|---|---|
| Tilopay (15 storefronts) | production | [tilopay.shop](https://tilopay.shop/.well-known/poppy.json) |
| Print with Poppy | production | [printwithpoppy.com](https://printwithpoppy.com/.well-known/poppy.json) |
| Emora Health | production | [emorahealth.com](https://emorahealth.com/.well-known/poppy.json) |

## What we check

Absence is never a finding: every check below runs only when this technology is detected, so a site that has not
adopted this is not assessed on it and appears in no report.

| Check | Kind | Raises | On whose authority |
|---|---|---|---|
| Personal Agent Protocol Not HTTPS | high severity | conformance, usability, security ([CWE-319](https://cwe.mitre.org/data/definitions/319.html)) | specification: [Personal Agent Protocol specification, draft 0.1](https://github.com/personal-agent-protocol/personal-agent-protocol/blob/main/content/spec.mdx)<br>Related: [OWASP Agentic ASI07 (2026) — Insecure Inter-Agent Communication](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/); [OWASP API API8 (2023) — Security Misconfiguration](https://api-security.owasp.org/editions/2023/en/0xa8-security-misconfiguration/); [ASVS V12.2.1 (5.0.0) — TLS for external HTTP services](https://github.com/OWASP/ASVS/blob/v5.0.0/5.0/docs_en/OWASP_Application_Security_Verification_Standard_5.0.0_en.json) |
| Personal Agent Protocol Invalid Version | high severity | conformance, usability | specification: [Personal Agent Protocol specification, draft 0.1](https://github.com/personal-agent-protocol/personal-agent-protocol/blob/main/content/spec.mdx) |
| Personal Agent Protocol Missing Organization | high severity | conformance, usability | specification: [Personal Agent Protocol specification, draft 0.1](https://github.com/personal-agent-protocol/personal-agent-protocol/blob/main/content/spec.mdx) |
| Personal Agent Protocol Domain Mismatch | high severity | conformance, usability | specification: [Personal Agent Protocol specification, draft 0.1](https://github.com/personal-agent-protocol/personal-agent-protocol/blob/main/content/spec.mdx) |
| Personal Agent Protocol Missing Auth | high severity | conformance, usability | specification: [Personal Agent Protocol specification, draft 0.1](https://github.com/personal-agent-protocol/personal-agent-protocol/blob/main/content/spec.mdx) |
| Personal Agent Protocol Issuer Not HTTPS | high severity | conformance, usability | specification: [Personal Agent Protocol specification, draft 0.1](https://github.com/personal-agent-protocol/personal-agent-protocol/blob/main/content/spec.mdx) |
| Personal Agent Protocol Insecure Endpoint | high severity | conformance, usability, security ([CWE-319](https://cwe.mitre.org/data/definitions/319.html)) | specification: [Personal Agent Protocol specification, draft 0.1](https://github.com/personal-agent-protocol/personal-agent-protocol/blob/main/content/spec.mdx)<br>Related: [OWASP Agentic ASI07 (2026) — Insecure Inter-Agent Communication](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/); [OWASP API API8 (2023) — Security Misconfiguration](https://api-security.owasp.org/editions/2023/en/0xa8-security-misconfiguration/); [ASVS V12.2.1 (5.0.0) — TLS for external HTTP services](https://github.com/OWASP/ASVS/blob/v5.0.0/5.0/docs_en/OWASP_Application_Security_Verification_Standard_5.0.0_en.json) |
| Personal Agent Protocol Issuer Metadata Missing | high severity | conformance, usability | specification: [Personal Agent Protocol specification, draft 0.1](https://github.com/personal-agent-protocol/personal-agent-protocol/blob/main/content/spec.mdx) |
| Personal Agent Protocol Issuer Mismatch | high severity | conformance, usability | specification: [Personal Agent Protocol specification, draft 0.1](https://github.com/personal-agent-protocol/personal-agent-protocol/blob/main/content/spec.mdx) |
| Personal Agent Protocol Domain Not Listed | high severity | conformance, usability | specification: [Personal Agent Protocol specification, draft 0.1](https://github.com/personal-agent-protocol/personal-agent-protocol/blob/main/content/spec.mdx) |
| Personal Agent Protocol No Channel | medium severity | conformance, usability | specification: [Personal Agent Protocol specification, draft 0.1](https://github.com/personal-agent-protocol/personal-agent-protocol/blob/main/content/spec.mdx) |
| Personal Agent Protocol Browser Session Off Domain | medium severity | conformance, usability | specification: [Personal Agent Protocol specification, draft 0.1](https://github.com/personal-agent-protocol/personal-agent-protocol/blob/main/content/spec.mdx) |
| Personal Agent Protocol Unknown API Type | medium severity | conformance, usability | specification: [Personal Agent Protocol specification, draft 0.1](https://github.com/personal-agent-protocol/personal-agent-protocol/blob/main/content/spec.mdx) |
| Personal Agent Protocol Issuer Metadata Incomplete | medium severity | conformance, usability | specification: [Personal Agent Protocol specification, draft 0.1](https://github.com/personal-agent-protocol/personal-agent-protocol/blob/main/content/spec.mdx) |
| Personal Agent Protocol Partially Assessed | coverage note | nothing | our own coverage |

## Examples

Both run through the same checks as a live scan: the first passes, the second is flagged.

**Correct**

```json
{
  "protocol_version": "0.1",
  "organization": { "name": "Example Company", "domain": "example.com" },
  "auth": {
    "issuer": "https://auth.example.com",
    "direct": { "scopes": ["poppy:read", "poppy:write"] },
    "device": { "scopes": ["poppy:read"] }
  },
  "agent": {
    "protocols": [{ "type": "poppy", "endpoint": "https://api.example.com/poppy/conversations" }]
  },
  "web": { "browser_session_endpoint": "https://example.com/poppy/browser-session" },
  "apis": [
    { "type": "openapi", "url": "https://api.example.com/openapi.json", "description": "Orders and returns" },
    { "type": "mcp", "url": "https://mcp.example.com/mcp", "description": "Product search" }
  ],
  "extensions": { "operations": { "version": "1", "endpoint": "https://api.example.com/poppy/operations" } }
}
```

**Present but wrong**

```json
{
  "protocol_version": "1",
  "organization": { "name": "Example Company", "domain": "another-company.example" },
  "agent": {
    "protocols": [{ "type": "poppy", "endpoint": "http://api.example.com/poppy/conversations" }]
  },
  "apis": [{ "type": "graphql", "url": "https://api.example.com/graphql", "description": "Everything" }]
}
```

## Specifications

| Document | Revision | Kind |
|---|---|---|
| [Personal Agent Protocol specification, draft 0.1](https://github.com/personal-agent-protocol/personal-agent-protocol/blob/main/content/spec.mdx) | Draft 0.1 (2026-10-09) | specification |
| [RFC 8414 — OAuth 2.0 Authorization Server Metadata](https://www.rfc-editor.org/rfc/rfc8414) | Published RFC | specification |
| [Sierra: Sharing a draft of Personal Agent Protocol](https://sierra.ai/blog/poppy) | Living document | guidance |

Last re-read against the published documents: 2026-10-14.