Personal Agent Protocol
PAP checker
Enter a domain to see whether personal agents such as Meta's Muse can work with it through the Personal Agent Protocol (Poppy, formerly PAP). The checker reads the site the way Personal Agent Protocol 1.0 tells a personal agent to, and then calls each interface it finds.
What the checker tests
A green poppy.json proves little on its own. Most of what breaks in practice sits behind it: an issuer that does not list the domain, or an endpoint that accepts any Session header. Each result links to the section of the spec it enforces.
Discovery
poppy.json at the well-known path, redirects that stay on HTTPS, organization.domain against the host that served it, every required field, scope hints, extensions and each supported_versions document.
Identity and sign-in
Protected resource metadata, the issuer it names, and the issuer's own metadata listing the domain back. Without that two-way link a personal agent refuses the Company.
Interfaces
An MCP initialize call on every MCP server, a load of every OpenAPI description, the tasks endpoint and the browser-session page.
Session header
The checker is a personal agent of its own, with published client metadata and keys. It signs a Session JWT for each call, then sends a forged one that a conforming endpoint must refuse.
The same checks are available as JSON at GET /api/pap-checker?domain=example.com, so a coding agent can run them after each deploy.