PAP discovery report

tilopay.shop

Publishes a poppy.json with no problems found. Organization: Tilopay.

Publishes poppy.json

0problems

HTTP 200 Version 0.1 Routes APIs Checked 18 hours ago First seen 12 Oct 2026

Open poppy.json ↗

Findings11 passed · 2 notes

Discovery

OK

poppy.json published

Served over HTTPS at /.well-known/poppy.json.

§3

OK

Protocol version 0.1

A major.minor version this checker reads.

§3.1

OK

organization.domain matches the domain checked

It must match the host the agent requested, ignoring a leading www.

§3.1

Sign-in

OK

OAuth issuer: https://mcp.tilopay.com

An HTTPS issuer identifier.

§3.1

Note

No sign-in types: signed-out sessions only

With none of direct, device or mediated, the company offers only signed-out Sessions.

§4.4

Sign-in server

OK

OAuth server metadata published

Found at the issuer (RFC 8414).

§3.2

OK

issuer matches auth.issuer

Exact match, as agents must check.

§3.2

OK

poppy_domains lists tilopay.shop

The issuer confirms this domain may use it.

§3.2

OK

token_endpoint published

Issues Session and Account Tokens.

§3.2

OK

revocation_endpoint published

Revokes Account Tokens (sign-out).

§3.2

Routes

OK

Offers: APIs

At least one of agent, apis or web is listed.

§3.1

APIs

OK

apis[0]: MCP server names the company's issuer

Its protected resource metadata lists auth.issuer in authorization_servers, so MCP clients can sign in.

§6

Extensions

Note

Custom extension tilopay.com/hosted-checkout

§3.3

poppy.json as served

0.5 KB

{
    "protocol_version": "0.1",
    "organization": {
        "name": "Tilopay",
        "domain": "tilopay.shop"
    },
    "auth": {
        "issuer": "https://mcp.tilopay.com"
    },
    "apis": [
        {
            "type": "mcp",
            "url": "https://mcp.tilopay.com/pap/mcp",
            "description": "Búsqueda de tiendas, catálogo, cotización y compra en comercios afiliados a Tilopay"
        }
    ],
    "extensions": {
        "tilopay.com/hosted-checkout": {
            "version": "1",
            "card_data_accepted": false,
            "notes": "El pago siempre ocurre en el formulario seguro de Tilopay (3DS); el agente nunca ve datos de tarjeta.",
            "currencies": [
                "CRC",
                "USD",
                "GTQ",
                "PAB"
            ]
        }
    }
}

OAuth server metadata as served

1.0 KB

{
    "issuer": "https://mcp.tilopay.com",
    "token_endpoint": "https://mcp.tilopay.com/pap/oauth/token",
    "revocation_endpoint": "https://mcp.tilopay.com/pap/oauth/revoke",
    "grant_types_supported": [
        "urn:ietf:params:oauth:grant-type:jwt-bearer",
        "refresh_token"
    ],
    "token_endpoint_auth_methods_supported": [
        "private_key_jwt"
    ],
    "token_endpoint_auth_signing_alg_values_supported": [
        "ES256",
        "ES384",
        "RS256",
        "PS256",
        "EdDSA"
    ],
    "revocation_endpoint_auth_methods_supported": [
        "private_key_jwt"
    ],
    "scopes_supported": [
        "poppy:read",
        "poppy:write"
    ],
    "client_id_metadata_document_supported": true,
    "poppy_domains": [
        "tilopay.shop",
        "mcp.tilopay.com",
        "tilopay.com",
        "los-patitos.tilopay.shop",
        "pachecura-store.tilopay.shop",
        "v26ru6u.tilopay.shop",
        "mi-tienda.tilopay.shop",
        "mi-tienda-2.tilopay.shop",
        "77eaa4b.tilopay.shop",
        "tienda-tilopay.tilopay.shop",
        "los-patitos-s-a.tilopay.shop",
        "mi-tienda-3.tilopay.shop",
        "los-patitos-s-a-2.tilopay.shop",
        "tilopay.tilopay.shop",
        "hotel-los-farallones.tilopay.shop",
        "restaurante-auramar.tilopay.shop"
    ]
}