PAP discovery report
globalresearch.ca
Publishes a poppy.json with 1 problem to fix. Organization: Globalresearch.
Publishes poppy.json, with problems
1problem
HTTP 200 Version 0.2 Routes APIs Checked 9 hours ago
First seen 4 Nov 2026
Findings1 problem · 12 passed · 3 notes
Discovery
OK
poppy.json published
Served over HTTPS at /.well-known/poppy.json.
Note
Served after 1 redirect
Allowed when every hop is HTTPS. The document speaks for the host that serves it after the redirects, so organization.domain must name that host. Final URL: https://www.globalresearch.ca/.well-known/poppy.json
Note
No Cache-Control header
Personal agents should cache the document according to its HTTP caching headers.
OK
Protocol version 0.2
Checked against the rules of draft 0.2, the version the document declares.
Problem
organization.domain does not match the host that serves it
The document says globalresearch.ca; it is served from www.globalresearch.ca. The domain must be the host that serves the document after any redirects, compared ignoring case and nothing else, so www.example.com and example.com differ.
How to fix →
Sign-in
OK
OAuth issuer: https://edge.sill.so/v1/poppy/XeZNTVszgGMxPeeXuNaaMomY-2Gt0HkvPr6qz92L3EA
An HTTPS issuer identifier.
Note
No sign-in types: signed-out sessions only
With none of direct, device or mediated, the company offers only signed-out Sessions.
Sign-in server
OK
OAuth server metadata published
Found at the issuer (RFC 8414).
OK
issuer matches auth.issuer
Exact match, as agents must check.
OK
poppy_domains lists globalresearch.ca
The issuer confirms this domain may use it.
OK
DPoP algorithms published: ES256, EdDSA
dpop_signing_alg_values_supported lists ES256, which every company must accept.
OK
token_endpoint published
Issues Session and Account Tokens.
OK
revocation_endpoint published
Revokes Account Tokens (sign-out).
Routes
OK
Offers: APIs
At least one of agent, apis or web is listed.
APIs
OK
apis[0]: MCP server takes DPoP tokens
Its protected resource metadata lists dpop_signing_alg_values_supported with ES256, so agents get DPoP Session Tokens for it.
OK
apis[0]: MCP server names the company's issuer
Its protected resource metadata lists auth.issuer in authorization_servers, so MCP clients can sign in.
poppy.json as served
0.4 KB
{
"protocol_version": "0.2",
"organization": {
"name": "Globalresearch",
"domain": "globalresearch.ca"
},
"auth": {
"issuer": "https://edge.sill.so/v1/poppy/XeZNTVszgGMxPeeXuNaaMomY-2Gt0HkvPr6qz92L3EA"
},
"apis": [
{
"type": "mcp",
"url": "https://edge.sill.so/v1/mcp/XeZNTVszgGMxPeeXuNaaMomY-2Gt0HkvPr6qz92L3EA",
"description": "Per-site Sill MCP server. Streamable HTTP, MCP 2025-06-18+.",
"resource": "https://edge.sill.so/v1/mcp/XeZNTVszgGMxPeeXuNaaMomY-2Gt0HkvPr6qz92L3EA"
}
]
}
OAuth server metadata as served
0.7 KB
{
"issuer": "https://edge.sill.so/v1/poppy/XeZNTVszgGMxPeeXuNaaMomY-2Gt0HkvPr6qz92L3EA",
"token_endpoint": "https://edge.sill.so/v1/poppy/XeZNTVszgGMxPeeXuNaaMomY-2Gt0HkvPr6qz92L3EA/token",
"revocation_endpoint": "https://edge.sill.so/v1/poppy/XeZNTVszgGMxPeeXuNaaMomY-2Gt0HkvPr6qz92L3EA/revoke",
"response_types_supported": [],
"grant_types_supported": [
"urn:ietf:params:oauth:grant-type:jwt-bearer"
],
"token_endpoint_auth_methods_supported": [
"private_key_jwt"
],
"token_endpoint_auth_signing_alg_values_supported": [
"ES256",
"EdDSA"
],
"dpop_signing_alg_values_supported": [
"ES256",
"EdDSA"
],
"scopes_supported": [
"poppy:read"
],
"poppy_domains": [
"globalresearch.ca"
],
"service_documentation": "https://docs.sill.so/protocols/pap"
}
Each document is checked against the Personal Agent Protocol draft it declares in protocol_version: 0.1, 0.2 or 0.3. Section numbers refer to that draft's specification. Drafts 0.1 and 0.2 are published and frozen; draft 0.3 is in progress, and any draft can change before a stable version; see the path to 1.0.
PAP Checker