PAP Checker/Sites/saferate.com

PAP discovery report

saferate.com

Publishes a poppy.json with no problems found. Organization: Safe Rate.

Publishes poppy.json

0problems

HTTP 200 Version 0.2 Sign-in direct Routes APIs Checked 18 hours ago First seen 20 Oct 2026

Open poppy.json ↗

Findings14 passed · 1 note

Discovery

poppy.json published

Served over HTTPS at /.well-known/poppy.json.

§3

Protocol version 0.2

Checked against the rules of draft 0.2, the version the document declares.

§3.1

organization.domain matches the host that serves it

It must be the host that serves the document, after any redirects, compared ignoring case.

§3.1

Sign-in

OAuth issuer: https://saferate.com

An HTTPS issuer identifier.

§3.1

Sign-in types: direct

How a user can sign in through a personal agent.

§4.4

Sign-in server

OAuth server metadata published

Found at the issuer (RFC 8414).

§3.2

issuer matches auth.issuer

Exact match, as agents must check.

§3.2

poppy_domains lists saferate.com

The issuer confirms this domain may use it.

§3.2

DPoP algorithms published: ES256

dpop_signing_alg_values_supported lists ES256, which every company must accept.

§3.2, §4.3

token_endpoint published

Issues Session and Account Tokens.

§3.2

revocation_endpoint published

Revokes Account Tokens (sign-out).

§3.2

authorization_endpoint published

Starts Direct Sign-In.

§3.2

Routes

Offers: APIs

At least one of agent, apis or web is listed.

§3.1

APIs

Note

apis[0]: MCP server takes Bearer tokens only

Its protected resource metadata lists no dpop_signing_alg_values_supported, so agents get Bearer tokens for it. Draft 0.2 says new MCP servers should support DPoP; leaving it out is meant for existing servers that cannot verify proofs yet.

§4.3, §6

apis[0]: MCP server names the company's issuer

Its protected resource metadata lists auth.issuer in authorization_servers, so MCP clients can sign in.

§6

poppy.json as served

0.6 KB

{
    "protocol_version": "0.2",
    "organization": {
        "domain": "saferate.com",
        "name": "Safe Rate"
    },
    "auth": {
        "direct": {
            "scopes": [
                "poppy:read",
                "poppy:write"
            ]
        },
        "issuer": "https://saferate.com"
    },
    "apis": [
        {
            "description": "Mortgage rate estimates, lender research and Treasury data in any Session; signed in, the shopper's own Universal Application and the quotes lenders sent them.",
            "resource": "https://mcp.saferate.com/mcp/account",
            "type": "mcp",
            "url": "https://mcp.saferate.com/mcp/account"
        }
    ]
}

OAuth server metadata as served

1.3 KB

{
    "issuer": "https://saferate.com",
    "authorization_endpoint": "https://saferate.com/oauth/authorize",
    "token_endpoint": "https://saferate.com/oauth/token",
    "revocation_endpoint": "https://saferate.com/oauth/revoke",
    "jwks_uri": "https://saferate.com/oauth/jwks.json",
    "poppy_domains": [
        "saferate.com"
    ],
    "authorization_response_iss_parameter_supported": true,
    "client_id_metadata_document_supported": true,
    "code_challenge_methods_supported": [
        "S256"
    ],
    "dpop_signing_alg_values_supported": [
        "ES256"
    ],
    "grant_types_supported": [
        "authorization_code",
        "urn:ietf:params:oauth:grant-type:jwt-bearer",
        "refresh_token"
    ],
    "response_modes_supported": [
        "query"
    ],
    "response_types_supported": [
        "code"
    ],
    "revocation_endpoint_auth_methods_supported": [
        "none",
        "private_key_jwt"
    ],
    "revocation_endpoint_auth_signing_alg_values_supported": [
        "ES256",
        "EdDSA",
        "PS256",
        "RS256"
    ],
    "scopes_supported": [
        "poppy:read",
        "poppy:write"
    ],
    "service_documentation": "https://personalagentprotocol.org/docs/0.2/spec",
    "token_endpoint_auth_methods_supported": [
        "none",
        "private_key_jwt"
    ],
    "token_endpoint_auth_signing_alg_values_supported": [
        "ES256",
        "EdDSA",
        "PS256",
        "RS256"
    ]
}

Each document is checked against the Personal Agent Protocol draft it declares in protocol_version: 0.1, 0.2 or 0.3. Section numbers refer to that draft's specification. Drafts 0.1 and 0.2 are published and frozen; draft 0.3 is in progress, and any draft can change before a stable version; see the path to 1.0.