PAPCheckerBot

Identity

• User-Agent: PAPCheckerBot/1.0 (+https://papchecker.com/bot)
• Every request is signed with Web Bot Auth (RFC 9421 HTTP Message Signatures), with Signature-Agent: "https://papchecker.com". The public key is in a signed key directory at /.well-known/http-message-signatures-directory (key id SVR9oF0dUooQvNKhGKo7V-21MtKcUOO7pXdEjIEdMtU). A request that names PAPCheckerBot without a valid signature is not ours.

What it fetches

GET requests for public documents only. It never signs in, starts a session, submits a form or sends anything to a company's endpoints.

• /robots.txt, first, when it looks for new sites
• /.well-known/poppy.json, and one control request at a made-up path when a reply looks like a page the site sends for every address
• For a site that publishes poppy.json: its sign-in server's OAuth metadata (RFC 8414) and the description of each API it lists, an OpenAPI document or MCP resource metadata (RFC 9728), up to five

When

• Weekly: sites already known to publish a poppy.json, and the protocol's design partners, are checked again.
• On request: when someone checks a domain at papchecker.com.

robots.txt

When it looks for new sites, if robots.txt disallows PAPCheckerBot at /.well-known/poppy.json, or does not answer, nothing else is requested from the site. To opt out:

User-agent: PAPCheckerBot
Disallow: /

Checks someone asks for, and weekly checks of a site that publishes a poppy.json, read only the documents the site publishes for agents.

How the results are used

For the reports on this site and the list of sites publishing poppy.json. Nothing is used to train AI models or resold.