poppy — your own agent, signed in with the company.
The PHP core for the Personal Agent Protocol, draft 0.2. A person's AI agent finds a company through /.well-known/poppy.json, starts a Session and signs in only when a task needs it. The person approves on the company's own page.
An agent is not an anonymous bot once it can identify itself
A personal agent works on behalf of one person. Today a shop sees it as one bot among many. Poppy gives it an identity: a metadata document at a URL of its own, requests signed with private_key_jwt and a DPoP key per Session. The company knows which agent is asking, and can block it.
The agent signs in only for tasks in the person's account. Direct Sign-In goes through the company's login page, with PKCE and RFC 9207. Without a browser on the agent's side, the person enters a code on a second device (RFC 8628). The agent never sees a password.
The package knows no framework. It speaks PSR-7, PSR-17, PSR-18 and PSR-20, with optional storage in Doctrine DBAL. Metadata of other parties is fetched from public HTTPS addresses only, with redirects off. Mediated Sign-In is left out on purpose: in it the agent sends the person's password.
Source code & documentation
Composer package
MIT · PHP 8.3+
composer require koh/poppy
Built, tested and released under MIT. Available on Packagist, source on GitHub.
For Sylius and TYPO3
MIT
Two integrations build on this core: sylius-poppy for shops and typo3-poppy for websites. Both bring pages, storage and configuration.