Personal Agent Protocol draft 0.1 was published on 9 Oct 2026 · What goes in poppy.json →
PAP Checker/Sites/neutral-state-jev-dub-bench.vercel.app
PAP discovery report

neutral-state-jev-dub-bench.vercel.app

Publishes a poppy.json with no problems found. Organization: Dub.

Publishes poppy.json
0problems
HTTP 200 Version 0.1 Sign-in direct Routes APIs Checked 18 hours ago First seen 13 Oct 2026
Open poppy.json ↗
Findings13 passed
Discovery
OK
poppy.json published
Served over HTTPS at /.well-known/poppy.json.
§3
OK
Protocol version 0.1
A major.minor version this checker reads.
§3.1
OK
organization.domain matches the domain checked
It must match the host the agent requested, ignoring a leading www.
§3.1
Sign-in
OK
OAuth issuer: https://neutral-state-jev-dub-bench.vercel.app
An HTTPS issuer identifier.
§3.1
OK
Sign-in types: direct
How a user can sign in through a personal agent.
§4.4
Sign-in server
OK
OAuth server metadata published
Found at the issuer (RFC 8414).
§3.2
OK
issuer matches auth.issuer
Exact match, as agents must check.
§3.2
OK
poppy_domains lists neutral-state-jev-dub-bench.vercel.app
The issuer confirms this domain may use it.
§3.2
OK
token_endpoint published
Issues Session and Account Tokens.
§3.2
OK
revocation_endpoint published
Revokes Account Tokens (sign-out).
§3.2
OK
authorization_endpoint published
Starts Direct Sign-In.
§3.2
Routes
OK
Offers: APIs
At least one of agent, apis or web is listed.
§3.1
APIs
OK
apis[0]: MCP server names the company's issuer
Its protected resource metadata lists auth.issuer in authorization_servers, so MCP clients can sign in.
§6

poppy.json as served

0.5 KB
{
    "protocol_version": "0.1",
    "organization": {
        "name": "Dub",
        "domain": "neutral-state-jev-dub-bench.vercel.app"
    },
    "auth": {
        "issuer": "https://neutral-state-jev-dub-bench.vercel.app",
        "direct": {
            "scopes": [
                "poppy:read",
                "poppy:write",
                "app.propose",
                "browser.headless"
            ]
        },
        "custom_scopes": {
            "app.propose": "Ask for changes that you approve before they run",
            "browser.headless": "Use a browser signed in as you"
        }
    },
    "apis": [
        {
            "type": "mcp",
            "url": "https://neutral-state-jev-dub-bench.vercel.app/api/neutral-state/mcp",
            "description": "Dub tools, limited to the agent profile you choose"
        }
    ]
}

OAuth server metadata as served

1.1 KB
{
    "issuer": "https://neutral-state-jev-dub-bench.vercel.app",
    "authorization_endpoint": "https://neutral-state-jev-dub-bench.vercel.app/api/neutral-state/oauth/authorize",
    "token_endpoint": "https://neutral-state-jev-dub-bench.vercel.app/api/neutral-state/oauth/token",
    "registration_endpoint": "https://neutral-state-jev-dub-bench.vercel.app/api/neutral-state/oauth/register",
    "revocation_endpoint": "https://neutral-state-jev-dub-bench.vercel.app/api/neutral-state/oauth/revoke",
    "response_types_supported": [
        "code"
    ],
    "grant_types_supported": [
        "authorization_code",
        "refresh_token",
        "urn:ietf:params:oauth:grant-type:jwt-bearer"
    ],
    "code_challenge_methods_supported": [
        "S256"
    ],
    "token_endpoint_auth_methods_supported": [
        "none",
        "private_key_jwt"
    ],
    "scopes_supported": [
        "app.read",
        "app.write",
        "app.authored",
        "app.propose",
        "browser.headless",
        "poppy:read",
        "poppy:write"
    ],
    "poppy_domains": [
        "neutral-state-jev-dub-bench.vercel.app"
    ],
    "token_endpoint_auth_signing_alg_values_supported": [
        "ES256",
        "RS256",
        "EdDSA"
    ],
    "authorization_response_iss_parameter_supported": true,
    "dpop_signing_alg_values_supported": [
        "ES256",
        "RS256",
        "EdDSA"
    ]
}

Rules from Personal Agent Protocol draft 0.1 (updated 12 Oct 2026). Section numbers refer to the specification. The draft can change before a stable version; see the path to 1.0.