Personal Agent Protocol draft 0.2 published, draft 0.3 in progress · What changes in poppy.json →
PAP Checker/Sites/stays.papsandbox.com
PAP discovery report

stays.papsandbox.com

Publishes a poppy.json with no problems found. Organization: Harbour Row Stays.

Publishes poppy.json
0problems
HTTP 200 Version 0.3 Sign-in direct, device, mediated Routes agent, APIs, web Checked 18 hours ago First seen 26 Oct 2026

Draft 0.3 of the Personal Agent Protocol is still in progress: it is not published or frozen, and its text is still changing. These results follow draft 0.3 as written on 2 November 2026, and will change when the draft does.

Open poppy.json ↗
Findings27 passed · 2 notes · 4 skipped

Results from the Personal Agent Protocol's official Company validator, commit 7205250, draft 0.3 (read-only survey + file check). The Skills rows are PAP Checker's own reading of skill_index.

Discovery
Note
Draft 0.3 is still in progress
Draft 0.3 is not published or frozen yet, and its text is still changing. These results follow it as written on 2 November 2026, and may change when the draft does.
§1
OK
poppy.json is served over HTTPS at the well-known path
Served at https://stays.papsandbox.com/.well-known/poppy.json.
discovery.https
§3
OK
Every redirect of the well-known URL is to an HTTPS URL
No redirects.
discovery.redirects-https
§3
OK
Redirects of the well-known URL end at /.well-known/poppy.json, with no query
No redirects.
discovery.redirects-well-known
§3
OK
poppy.json is a JSON object
The JSON document a Company publishes at /.well-known/poppy.json.
discovery.json
§2
OK
poppy.json fields have the forms section 3.1 describes
discovery.schema
§2
OK
protocol_version is the version this validator checks
protocol_version 0.3.
discovery.protocol-version
§3.1
OK
organization.domain is the host that serves poppy.json, after redirects
organization.domain stays.papsandbox.com matches the host.
discovery.domain-matches-host
§3.1
OK
poppy.json lists at least one of agent, apis, or web
At least one of agent, apis, or web.
discovery.interface-present
§3.1
OK
Extension names are ones the protocol defines, or start with a domain
Anyone else MUST start an extension's name with a domain they control, such as example.com/gift-wrap.
discovery.extension-names
§3.3
OK
A Company that turns off sign-in lists no way to sign in
Sign-in isn't turned off.
discovery.sign-in-disabled
§3.2
Skipped
The excluded-tasks document loads and has the fields in 9.1
Not checked: the validator checks this only in its online mode, which we do not run.
discovery.excluded-tasks
§9.1
Skipped
Each openapi or mcp reference in an alternative names an API listed in poppy.json
Not checked: the validator checks this only in its online mode, which we do not run.
discovery.alternative-references
§9.2
Sign-in server
OK
The Company has an issuer when it offers account access
A Company that offers sign-in MUST have an OAuth issuer.
metadata.issuer-required
§3.2
OK
The domain's protected resource metadata is for https://{organization.domain} and names authorization servers
metadata.resource-metadata
§3.2
OK
auth.issuer is one of authorization_servers, and is present when there are several
One authorization server, https://stays.papsandbox.com.
metadata.issuer-chosen
§3.1
OK
The issuer publishes OAuth Authorization Server Metadata
Loaded from https://stays.papsandbox.com/.well-known/oauth-authorization-server.
metadata.published
§3.2
OK
The metadata has the fields section 3.2 requires, in the right forms
The Personal Agent uses these fields of the metadata.
metadata.schema
§3.2
OK
The metadata's issuer exactly matches the issuer the protected resource metadata names
MUST check that its issuer exactly matches the issuer it found, character for character.
metadata.issuer-matches
§3.2
OK
protected_resources includes https://{organization.domain}
MUST list https://{domain} for every domain whose issuer it is, with no path, port, or trailing slash.
metadata.protected-resources
§3.2
OK
The metadata has a token_endpoint
metadata.token-endpoint
§3.2
OK
The metadata has a revocation_endpoint
metadata.revocation-endpoint
§3.2
OK
grant_types_supported includes refresh_token
Required, and it MUST include refresh_token (4.4).
metadata.grant-types
§3.2
OK
The metadata has an authorization_endpoint when it offers Direct Sign-In
metadata.authorization-endpoint
§3.2
OK
The metadata has a device_authorization_endpoint when it offers Device Sign-In
metadata.device-authorization-endpoint
§3.2
OK
scopes_supported lists every scope a sign-in can grant
A Company that offers sign-in SHOULD publish it and include every scope a Personal Agent can request (4.7).
metadata.scopes-supported
§3.2
OK
Every scope in scopes_supported has a description
Every scope is described in auth.scopes.
metadata.scopes-described
§4.7
Skipped
Other Company domains select the same issuer
Not checked: The issuer's protected_resources lists no other domain.
metadata.same-issuer
§3.2
Skipped
Other domains with the same issuer have matching scope descriptions and hints
Not checked: The issuer's protected_resources lists no other domain.
metadata.same-auth
§3.2
OK
With Mediated Sign-In listed, the issuer's metadata lists its grant type
metadata.mediated-grant
Mediated Sign-In §2
Skills
Note
Skills listed: change-booking, find-rooms-and-rates
Skills describe how to carry out a task at the company, such as the order of API calls. A skill is the company's content: it grants no account access, scopes or approval.
§9.4
OK
change-booking: SKILL.md matches its digest
The sha256 of the file served matches the digest in the index (4,713 bytes).
§9.4
OK
find-rooms-and-rates: SKILL.md matches its digest
The sha256 of the file served matches the digest in the index (2,319 bytes).
§9.4

poppy.json as served

2.6 KB
{
    "protocol_version": "0.3",
    "organization": {
        "name": "Harbour Row Stays",
        "domain": "stays.papsandbox.com",
        "logo_uri": "https://stays.papsandbox.com/poppy/logo.svg"
    },
    "auth": {
        "issuer": "https://stays.papsandbox.com",
        "scopes": {
            "bookings:read": "See your bookings: dates, room, rate plan and price. Read only.",
            "bookings:write": "Change a booking: new dates, room or rate plan, such as adding breakfast. Moving to a non-refundable rate can't be undone. You still approve each change. Doesn't include reading your bookings."
        },
        "scope_hints": {
            "bookings:read": {
                "changes": "none",
                "personal_data": true
            },
            "bookings:write": {
                "changes": "irreversible",
                "personal_data": true
            }
        }
    },
    "agent": {
        "protocols": [
            {
                "type": "poppy",
                "endpoint": "https://stays.papsandbox.com/poppy/conversations"
            }
        ]
    },
    "apis": [
        {
            "type": "openapi",
            "url": "https://stays.papsandbox.com/poppy/openapi.json",
            "description": "Room availability and rates, the guest's bookings, and changes to a booking"
        },
        {
            "type": "mcp",
            "url": "https://stays.papsandbox.com/poppy/mcp",
            "description": "Room availability and rates, the guest's bookings, and changes to a booking, as MCP tools"
        }
    ],
    "web": {
        "browser_session_endpoint": "https://stays.papsandbox.com/poppy/browser-session"
    },
    "feedback": {
        "endpoint": "https://stays.papsandbox.com/poppy/feedback"
    },
    "excluded_tasks": {
        "url": "https://stays.papsandbox.com/poppy/excluded-tasks.json"
    },
    "extensions": {
        "operations": {
            "version": "2"
        },
        "mediated-sign-in": {
            "version": "1",
            "fields": [
                {
                    "name": "email",
                    "label": "Email",
                    "secret": false
                },
                {
                    "name": "password",
                    "label": "Password",
                    "secret": true
                }
            ],
            "scopes": [
                "bookings:read"
            ]
        }
    },
    "skill_index": {
        "$schema": "https://schemas.agentskills.io/discovery/0.2.0/schema.json",
        "skills": [
            {
                "name": "change-booking",
                "description": "Change the User's booking at Harbour Row Stays. Move it to new dates, change the room, or change the rate plan, such as adding breakfast. Also reads their bookings. Use when the User asks to move, extend, shorten or upgrade a stay, or to add breakfast.",
                "type": "skill-md",
                "url": "https://stays.papsandbox.com/.well-known/agent-skills/change-booking/SKILL.md",
                "digest": "sha256:d9c07290102b82f711a9ca0c433ae27ccf675595edf2f030d6362b400faede5e"
            },
            {
                "name": "find-rooms-and-rates",
                "description": "Check which rooms are free at Harbour Row Stays for given dates, and the rate plans for a room with prices, breakfast and cancellation terms. No sign-in needed. Use when the User asks about availability, prices or what a rate includes.",
                "type": "skill-md",
                "url": "https://stays.papsandbox.com/.well-known/agent-skills/find-rooms-and-rates/SKILL.md",
                "digest": "sha256:e8fc5e24b798a83a98c31154d4061e742b7f0f71cae389a55703f401a5211046"
            }
        ]
    }
}

OAuth server metadata as served

1.0 KB
{
    "issuer": "https://stays.papsandbox.com",
    "token_endpoint": "https://stays.papsandbox.com/oauth/token",
    "revocation_endpoint": "https://stays.papsandbox.com/oauth/revoke",
    "authorization_endpoint": "https://stays.papsandbox.com/oauth/authorize",
    "device_authorization_endpoint": "https://stays.papsandbox.com/oauth/device",
    "protected_resources": [
        "https://stays.papsandbox.com",
        "https://stays.papsandbox.com/poppy/mcp"
    ],
    "response_types_supported": [
        "code"
    ],
    "grant_types_supported": [
        "refresh_token",
        "authorization_code",
        "urn:ietf:params:oauth:grant-type:device_code",
        "https://personalagentprotocol.org/grant/mediated-sign-in"
    ],
    "code_challenge_methods_supported": [
        "S256"
    ],
    "token_endpoint_auth_methods_supported": [
        "private_key_jwt"
    ],
    "token_endpoint_auth_signing_alg_values_supported": [
        "ES256",
        "PS384"
    ],
    "revocation_endpoint_auth_methods_supported": [
        "private_key_jwt"
    ],
    "dpop_signing_alg_values_supported": [
        "ES256"
    ],
    "authorization_response_iss_parameter_supported": true,
    "client_id_metadata_document_supported": true,
    "scopes_supported": [
        "bookings:read",
        "bookings:write"
    ]
}

Each document is checked against the Personal Agent Protocol draft it declares in protocol_version: 0.1, 0.2 or 0.3. Section numbers refer to that draft's specification. Drafts 0.1 and 0.2 are published and frozen; draft 0.3 is in progress, and any draft can change before a stable version; see the path to 1.0.