PAP discovery report
coveragecat.com
Publishes a poppy.json with no problems found. Organization: Coverage Cat.
Publishes poppy.json
0problems
HTTP 200 Version 0.2 Routes APIs, web Checked 18 hours ago
First seen 31 Oct 2026
Findings11 passed · 4 notes
Discovery
OK
poppy.json published
Served over HTTPS at /.well-known/poppy.json.
OK
Protocol version 0.2
Checked against the rules of draft 0.2, the version the document declares.
OK
organization.domain matches the host that serves it
It must be the host that serves the document, after any redirects, compared ignoring case.
Sign-in
OK
OAuth issuer: https://coveragecat.com/poppy
An HTTPS issuer identifier.
Note
No sign-in types: signed-out sessions only
With none of direct, device or mediated, the company offers only signed-out Sessions.
Sign-in server
OK
OAuth server metadata published
Found at the issuer (RFC 8414).
OK
issuer matches auth.issuer
Exact match, as agents must check.
OK
poppy_domains lists coveragecat.com
The issuer confirms this domain may use it.
Note
No DPoP algorithm list published
Optional: the issuer need not publish dpop_signing_alg_values_supported. Companies must accept ES256, which personal agents sign with.
OK
token_endpoint published
Issues Session and Account Tokens.
OK
revocation_endpoint published
Revokes Account Tokens (sign-out).
Routes
OK
Offers: APIs, website
At least one of agent, apis or web is listed.
Note
Website: signed-out browsing
No browser_session_endpoint, so personal agents browse the site as ordinary signed-out visitors.
APIs
Note
apis[0]: MCP server takes Bearer tokens only
Its protected resource metadata lists no dpop_signing_alg_values_supported, so agents get Bearer tokens for it. Draft 0.2 says new MCP servers should support DPoP; leaving it out is meant for existing servers that cannot verify proofs yet.
OK
apis[0]: MCP server names the company's issuer
Its protected resource metadata lists auth.issuer in authorization_servers, so MCP clients can sign in.
poppy.json as served
0.6 KB
{
"apis": [
{
"description": "Umbrella and homeowners insurance shopping. Start with umbrella_consumer_prefill or homeowners_consumer_prefill, then use the consumer tools for review, quotes, checkout, and policy support. Returning agents can call consumer_purchases to recover applications across sessions and consumer_intake_issues for live status. If verification.required is true, use consumer_intake_verify_email with shopper approval.",
"type": "mcp",
"url": "https://coveragecat.com/poppy/mcp"
}
],
"auth": {
"issuer": "https://coveragecat.com/poppy"
},
"organization": {
"domain": "coveragecat.com",
"name": "Coverage Cat"
},
"protocol_version": "0.2",
"web": {}
}
OAuth server metadata as served
0.5 KB
{
"client_id_metadata_document_supported": true,
"grant_types_supported": [
"urn:ietf:params:oauth:grant-type:jwt-bearer"
],
"issuer": "https://coveragecat.com/poppy",
"poppy_domains": [
"coveragecat.com"
],
"response_types_supported": [],
"revocation_endpoint": "https://coveragecat.com/poppy/revoke",
"scopes_supported": [],
"token_endpoint": "https://coveragecat.com/poppy/token",
"token_endpoint_auth_methods_supported": [
"private_key_jwt"
],
"token_endpoint_auth_signing_alg_values_supported": [
"ES256",
"RS256"
]
}
Each document is checked against the Personal Agent Protocol draft it declares in protocol_version: 0.1, 0.2 or 0.3. Section numbers refer to that draft's specification. Drafts 0.1 and 0.2 are published and frozen; draft 0.3 is in progress, and any draft can change before a stable version; see the path to 1.0.
PAP Checker