Personal Agent Protocol draft 0.2 published, draft 0.3 in progress · What changes in poppy.json →
PAP Checker/Sites/ample.computer
PAP discovery report

ample.computer

Publishes a poppy.json with 1 problem to fix. Organization: Ample Computer.

Publishes poppy.json, with problems
1problem
HTTP 200 Version 0.1 Sign-in direct Routes APIs Checked 18 hours ago First seen 17 Oct 2026
Open poppy.json ↗
Findings1 problem · 12 passed · 2 notes
Discovery
OK
poppy.json published
Served over HTTPS at /.well-known/poppy.json.
§3
Note
Served after 1 redirect
Allowed when every hop is HTTPS. Under draft 0.1 the document speaks for the domain that was requested, so organization.domain must name that domain (a leading www. is ignored), not the host it redirects to. Final URL: https://api.ample.computer/.well-known/poppy.json
§3
OK
Protocol version 0.1
Checked against the rules of draft 0.1, the version the document declares.
§3.1
Problem
organization.domain does not match the domain requested
The document says api.ample.computer; it was requested at ample.computer. Under draft 0.1 they must match, ignoring case and a leading www.
How to fix →
§3.1 (0.1)
Sign-in
OK
OAuth issuer: https://api.ample.computer/poppy
An HTTPS issuer identifier.
§3.1
OK
Sign-in types: direct
How a user can sign in through a personal agent.
§4.4
Sign-in server
OK
OAuth server metadata published
Found at the issuer (RFC 8414).
§3.2
OK
issuer matches auth.issuer
Exact match, as agents must check.
§3.2
OK
poppy_domains lists api.ample.computer
The issuer confirms this domain may use it.
§3.2
Note
DPoP algorithms published: ES256
Draft 0.1 sets no rule on which DPoP algorithms a company accepts. From draft 0.2, companies must accept ES256 and a published list must include it.
§3.2
OK
token_endpoint published
Issues Session and Account Tokens.
§3.2
OK
revocation_endpoint published
Revokes Account Tokens (sign-out).
§3.2
OK
authorization_endpoint published
Starts Direct Sign-In.
§3.2
Routes
OK
Offers: APIs
At least one of agent, apis or web is listed.
§3.1
APIs
OK
apis[0]: MCP server names the company's issuer
Its protected resource metadata lists auth.issuer in authorization_servers, so MCP clients can sign in.
§6

poppy.json as served

0.9 KB
{
    "apis": [
        {
            "description": "Deploy and manage apps, servers, databases and object storage on Ample.",
            "type": "mcp",
            "url": "https://api.ample.computer/mcp"
        }
    ],
    "auth": {
        "custom_scopes": {
            "buckets:*": "Read, create, change and delete object storage",
            "budgets:read": "View usage and budgets",
            "databases:*": "Read, create, change and delete databases",
            "servers:exec": "Run commands on servers",
            "servers:read": "View apps, servers, deployments and logs",
            "servers:write": "Deploy, change and delete apps and servers",
            "tokens:*": "Create and revoke access credentials within these permissions",
            "volumes:*": "Read, create, change and delete storage volumes"
        },
        "direct": {
            "scopes": [
                "servers:read",
                "servers:write",
                "servers:exec",
                "volumes:*",
                "databases:*",
                "buckets:*",
                "tokens:*",
                "budgets:read"
            ]
        },
        "issuer": "https://api.ample.computer/poppy"
    },
    "organization": {
        "domain": "api.ample.computer",
        "name": "Ample Computer"
    },
    "protocol_version": "0.1"
}

OAuth server metadata as served

1.0 KB
{
    "authorization_endpoint": "https://api.ample.computer/poppy/authorize",
    "authorization_response_iss_parameter_supported": true,
    "client_id_metadata_document_supported": true,
    "code_challenge_methods_supported": [
        "S256"
    ],
    "dpop_signing_alg_values_supported": [
        "ES256"
    ],
    "grant_types_supported": [
        "urn:ietf:params:oauth:grant-type:jwt-bearer",
        "authorization_code",
        "refresh_token"
    ],
    "issuer": "https://api.ample.computer/poppy",
    "poppy_domains": [
        "api.ample.computer"
    ],
    "registration_endpoint": "https://api.ample.computer/oauth/register",
    "response_types_supported": [
        "code"
    ],
    "revocation_endpoint": "https://api.ample.computer/oauth/revoke",
    "revocation_endpoint_auth_methods_supported": [
        "none",
        "private_key_jwt"
    ],
    "scopes_supported": [
        "servers:read",
        "servers:write",
        "servers:exec",
        "volumes:*",
        "databases:*",
        "buckets:*",
        "tokens:*",
        "budgets:read"
    ],
    "token_endpoint": "https://api.ample.computer/oauth/token",
    "token_endpoint_auth_methods_supported": [
        "none",
        "private_key_jwt"
    ],
    "token_endpoint_auth_signing_alg_values_supported": [
        "ES256",
        "RS256"
    ]
}

Each document is checked against the Personal Agent Protocol draft it declares in protocol_version: 0.1, 0.2 or 0.3. Section numbers refer to that draft's specification. Drafts 0.1 and 0.2 are published and frozen; draft 0.3 is in progress, and any draft can change before a stable version; see the path to 1.0.