Making any website agent-ready: the three ways to publish poppy.json Free & Pro

"Agent-ready" has a precise meaning under the Personal Agent Protocol. A business is agent-ready when a person’s AI assistant can fetch one file from its domain, learn from that file how to identify itself, how to sign the person in, and which APIs or website entry point to use, and then do all of that. Every platform in this collection is judged against that one test. This page explains the test and the three ways any website can pass it, so the platform pages can be short.

Agent Adapt is a WooCommerce plugin that implements Draft 0.2 of the protocol. It is independent, and not affiliated with or endorsed by the protocol’s authors, Sierra and Meta, or by any platform named in this collection.

The one file

The protocol fixes the address: https://your-domain/.well-known/poppy.json, over HTTPS, at the root of the domain the customer knows you by. An assistant given "your-domain.com" by its user has nowhere else to look. There is no registry, directory or submission form. See What poppy.json is.

The file names the business, points at an OAuth server (the issuer) that handles agent identity and customer sign-in, and lists what the business offers: an OpenAPI-described API, an MCP server, a website entry point for an agent’s own browser, or a Company Agent the assistant can talk to. Nothing in it is private.

So the platform question is really two questions. Can your platform publish that file at that address? And can something answer for the issuer and APIs it names?

What the specification allows

Three facts in the draft make this possible on platforms that were never built for it.

• The file must be served on your domain, but it can be a provider’s document. Since 16 October 2026 section 3 says the well-known URL may redirect, that agents must follow redirects, that every redirect must lead to HTTPS, and that the document speaks for the host that serves it after any redirects, which organization.domain must name. A redirect that stays on your own host (the apex to www, say) is fine. A redirect to a provider’s host is not: the agent would end up with a document for the provider’s domain, not yours. So a provider’s document has to be served on your domain, which the draft spells out: a Company that uses a provider has the provider’s document served on the Company’s own domain. In practice that is a proxy of one path, which most platforms, hosts and CDNs can do.
• The issuer and APIs may live elsewhere. The business is identified by its issuer, an HTTPS URL. The draft’s own examples put the issuer, the API and the MCP server on different hosts from the business’s domain.
• The issuer declares which domains it speaks for. The issuer’s OAuth metadata lists poppy_domains, and an agent checks that your domain is in that list before trusting anything. A provider cannot be made to speak for a domain it has not been told about, and a stranger cannot point their domain at your issuer.

Together those mean the file can be a provider’s document served from your own domain, and everything behind it can be run by a plugin on your own server, by your platform, or by a hosted provider.

The three ways

1. Natively

The platform or your own code serves poppy.json, runs the OAuth server, and answers the agent API from the real catalogue and real customer accounts. This is the strongest position: one domain, one checkout, the customer’s real account. It is what Agent Adapt does for WooCommerce, because WordPress runs on your server and a plugin can do all of it. It is open to any self-hosted platform (Magento, PrestaShop, Shopware, a custom store) with a developer, and to any hosted platform the day its maker implements the protocol. See WooCommerce.

2. By proxying a provider’s document

Your domain serves the one path from a hosted Company’s document: whatever answers /.well-known/poppy.json on your domain fetches the provider’s copy and returns it as its own, and the hosted Company runs the issuer and API on your behalf, knowing your products and policies by some other route (a feed, an API key you grant it, or a crawl of your public pages). The customer still pays on your checkout, because the protocol gives the agent no way to pay. What a hosted Company can do with customer accounts depends on what your platform lets it see.

How the proxy is done depends on what you control. On a server you run, it is a few lines of nginx (proxy_pass) or Apache (mod_proxy); on Netlify, a _redirects line with status 200; on Vercel, a rewrites entry; on WordPress without WooCommerce, a small must-use plugin. Shopify (behind Cloudflare), Squarespace, Wix, Webflow and BigCommerce cannot serve or proxy a root file themselves, so their domain goes through Cloudflare with a Worker on the one path, and the site stays where it is; see Serving poppy.json with a Cloudflare Worker. Business websites that are not shops take the same routes. For Shopify stores, Agent Adapt’s Shopify app runs the hosted side (see Shopify and personal agents); it is built and heading for the Shopify App Store. For the other platforms, Agent Adapt’s hosted Company is built and running, in early access by email, and not yet on sale; ask at [email protected].

3. Not at all, honestly

A platform that can neither serve nor proxy /.well-known/ paths, and will not sit behind a CDN that can, leaves nothing to do, and a business on a marketplace does not control its domain. The honest answer there is to say so and to say what the business can do instead, which is usually to own a domain of its own. See Marketplaces.

How to tell which one you have

Open https://your-domain/.well-known/poppy.json in a private browser window.

What you see	What it means
JSON naming your business	You are agent-ready, or at least discoverable. Check the issuer it names answers too.
Your platform’s own 404 page	The path is free for a file or a proxy, if the platform lets you set one. The platform pages say which do.
A redirect to your home page	The platform catches unknown paths. You need something that answers the path before that catch, usually at the DNS or CDN layer. See Cloudflare.
A redirect to a provider’s address	The earlier route. Since 16 October 2026 the document speaks for the host that serves it, so agents get a document for the provider’s domain, not yours. Replace the redirect with a proxy.
A challenge page from a security service	Agents will be stopped there too. Exclude the path from bot rules.

What agent-ready does not mean

• Not listed anywhere. No assistant is told your store exists. A customer names you, or the assistant already knows your domain. Search engines matter as much as before.
• Not paid by agents. Under the protocol’s current draft the person pays, on your checkout. Payments are an open topic in the protocol.
• Not a product feed. Feeds into a platform’s own assistant and checkout are a different model, described in Personal Agent Protocol, UCP, ACP, AP2 and MCP. A business can do both.
• Not finished. The draft may change incompatibly. Everything on these platform pages was checked on the dates they give.

Common questions

Can one poppy.json cover several domains?

Several domains can name the same issuer, and the issuer lists all of them in poppy_domains. The protocol treats them as one business. A store with a .com and a .co.uk for the same shop publishes the file on both and runs one issuer.

Can poppy.json redirect at all?

Within your own host, yes. The draft (since 16 October 2026) says the well-known URL may redirect, for example from example.com to www.example.com, that agents must follow, and that every redirect must lead to HTTPS; it does not fix the status code. The document the agent ends up with must name the host that served it, compared ignoring case and nothing else, so www.example.com and example.com are different domains. A redirect that lands on a provider’s host does not count.

Can I write poppy.json by hand and upload it?

Yes, if your platform lets you serve a file at that path. The file alone is not enough: it must name an issuer that actually answers the OAuth metadata, token and sign-in requests, and APIs that actually exist. An assistant that reads a hand-written file will try to use everything it lists.

Do I need Agent Adapt to be agent-ready?

No. The protocol is open and anyone can implement it. Agent Adapt is one implementation, for WooCommerce. The platform pages in this collection are written to be useful whichever route you take.