--- url: https://ora.ai/pap/fin.ai title: "fin.ai PAP report" description: "Working: every Personal Agent Protocol check Ora ran on fin.ai, row by row, with its outcome, severity and spec section." crawled_at: 2026-10-18T19:27:24Z lastmod: 2026-10-15T18:22:16.265Z ask: https://ora-ai.ora.run/ask docs: https://ora-ai.ora.run/.well-known/ora/docs lang: en --- Personal Agent Protocol report # fin.ai fin.ai publishes a poppy.json, and no P0 or P1 check fails. Verdict · Working · Profile pap-0.1@2026-10-09 PAP Draft 0.1 (published 2026-10-09; may change) Last run Oct 15, 2026, 6:22 PM UTC Tier 1 probed Not probed Each row is one check from the [PAP spec](https://personalagentprotocol.org/docs/spec) , with its outcome, its severity (P0 blocks every agent or is a security MUST, P1 is a MUST that breaks one feature, P2 is a SHOULD or one of Ora's own consistency checks, Advisory never counts against a site) and the section it tests. The full list is in the check catalog , and what Ora's scanner sends is on its own page. ## Tier 0: the public files Plain reads of poppy.json and the documents it points to. None of these requests carries a credential. 8 pass, 22 N/A T0-01 Document exists Outcome: Pass Severity: P0 [§3](https://personalagentprotocol.org/docs/spec) served at https://fin.ai/.well-known/poppy.json T0-02 Redirects safe Outcome: Pass Severity: P0 [§3](https://personalagentprotocol.org/docs/spec) no redirects T0-03 Valid JSON object Outcome: Pass Severity: P0 [§3](https://personalagentprotocol.org/docs/spec) a JSON object T0-04 Supported protocol_version Outcome: Pass Severity: P0 [§3.1](https://personalagentprotocol.org/docs/spec) protocol_version 0.1 T0-05 Organization matches the requested host Outcome: Pass Severity: P0 [§3.1](https://personalagentprotocol.org/docs/spec) organization.domain fin.ai T0-06 Has an interface Outcome: Pass Severity: P0 [§3.1](https://personalagentprotocol.org/docs/spec) interfaces: web T0-07 auth.issuer when needed Outcome: N/A Severity: P0 [§3.1](https://personalagentprotocol.org/docs/spec) no interface needs sign-in T0-08 All URLs HTTPS Outcome: Pass Severity: P0 [§3](https://personalagentprotocol.org/docs/spec) every URL is https T0-SIB Published on the requested host Outcome: Pass Severity: P2 [§3.1](https://personalagentprotocol.org/docs/spec) published on fin.ai T0-09 Issuer metadata reachable Outcome: N/A Severity: P0 [§3.2](https://personalagentprotocol.org/docs/spec) poppy.json names no auth.issuer T0-10 Issuer match Outcome: N/A Severity: P0 [§3.2](https://personalagentprotocol.org/docs/spec) poppy.json names no auth.issuer T0-11 Domain binding Outcome: N/A Severity: P0 [§3.2](https://personalagentprotocol.org/docs/spec) poppy.json names no auth.issuer T0-12 Required endpoints Outcome: N/A Severity: P0 [§3.2](https://personalagentprotocol.org/docs/spec) poppy.json names no auth.issuer T0-21 Cache headers Outcome: N/A Severity: P2 [§3.2](https://personalagentprotocol.org/docs/spec) poppy.json names no auth.issuer ADV-PKCE No plain PKCE Outcome: N/A Severity: Advisory [guides](https://personalagentprotocol.org/docs/guides) poppy.json names no auth.issuer T0-13 Scopes defined Outcome: N/A Severity: P1 [§3.1](https://personalagentprotocol.org/docs/spec) no sign-in type or custom scope T0-14 Mediated sign-in well formed Outcome: N/A Severity: P1 [§4.7](https://personalagentprotocol.org/docs/spec) no mediated sign-in T0-19 Extensions named correctly Outcome: N/A Severity: P1 [§3.3](https://personalagentprotocol.org/docs/spec) no extensions T0-20 Operations advertised fully Outcome: N/A Severity: P1 [Ops §2](https://personalagentprotocol.org/docs/extensions/operations) operations extension not advertised T0-15 Conversation entries Outcome: N/A Severity: P1 [§3.1](https://personalagentprotocol.org/docs/spec) no agent block T0-16 API entries Outcome: N/A Severity: P1 [§3.1](https://personalagentprotocol.org/docs/spec) no apis T0-17 OpenAPI parses Outcome: N/A Severity: P1 [§6](https://personalagentprotocol.org/docs/spec) no openapi entries T0-18 MCP resource metadata Outcome: N/A Severity: P1 [§6](https://personalagentprotocol.org/docs/spec) no mcp entries X-01 Same MCP server everywhere Outcome: N/A Severity: P2 [§6](https://personalagentprotocol.org/docs/spec) poppy.json lists no MCP server X-02 Same organization Outcome: N/A Severity: P2 [§3.1](https://personalagentprotocol.org/docs/spec) no ARD catalog host to compare X-04 Domains covered Outcome: N/A Severity: P2 [§3.2](https://personalagentprotocol.org/docs/spec) poppy_domains lists no other domain X-07 One issuer Outcome: N/A Severity: P2 [§3.2](https://personalagentprotocol.org/docs/spec) poppy.json names no issuer X-08 One metadata document Outcome: N/A Severity: Advisory [§3.2](https://personalagentprotocol.org/docs/spec) no other authorization server metadata X-10 Shared token endpoint lists both protocols' grants Outcome: N/A Severity: P2 [§3.2](https://personalagentprotocol.org/docs/spec) no other protocol shares the PAP issuer's token endpoint X-12 Consistent 401s Outcome: N/A Severity: P2 [§6](https://personalagentprotocol.org/docs/spec) no recorded 401 challenge from a PAP MCP server ## Tier 1: junk requests to the listed endpoints Requests with no valid credential, which a correct site refuses. They run only when the scan asks for them, at most once per domain every 6 hours. No Tier 1 probe result from the last 30 days. 7 N/A T1-01 Token endpoint rejects a junk JWT bearer request Outcome: N/A Severity: P1 [§4.2](https://personalagentprotocol.org/docs/spec) poppy.json names no issuer T1-02 Error bodies leak nothing Outcome: N/A Severity: Advisory [guides](https://personalagentprotocol.org/docs/guides) no probe answered T1-03 Conversation endpoint requires DPoP Outcome: N/A Severity: P0 [§4.3](https://personalagentprotocol.org/docs/spec) no poppy conversation endpoint T1-05 MCP server challenges unauthenticated initialize Outcome: N/A Severity: P1 [§6](https://personalagentprotocol.org/docs/spec) no MCP server listed T1-07 Browser endpoint rejects a junk assertion Outcome: N/A Severity: P0 [§5](https://personalagentprotocol.org/docs/spec) no web.browser_session_endpoint T1-09 Operations endpoint requires a token Outcome: N/A Severity: P2 [Ops §2](https://personalagentprotocol.org/docs/extensions/operations) operations extension not advertised ADV-REDIRECT Endpoint answers without a redirect Outcome: N/A Severity: Advisory [guides](https://personalagentprotocol.org/docs/guides) no probe sent ## Tier 2a: coming soon Valid requests with a real client, once Ora publishes its own client metadata and signs real requests. Not measured yet. 10 not measured ### Show the 10 planned checks T2-M1 Call each read-only OpenAPI GET with no token, then with a valid signed-out token Outcome: Not measured Severity: P1 coming soon [§6](https://personalagentprotocol.org/docs/spec) T2-M5 Load the consent page for Ora's real client_id from a valid S256 request and inspect headers; never sign in Outcome: Not measured Severity: Advisory coming soon [guides](https://personalagentprotocol.org/docs/guides) T2-01 Start a Session for U1 Outcome: Not measured Severity: P0 coming soon [§4.2](https://personalagentprotocol.org/docs/spec) T2-02 Token lifetime Outcome: Not measured Severity: P2 coming soon [§4.2](https://personalagentprotocol.org/docs/spec) T2-05 Renew with session_id Outcome: Not measured Severity: P1 coming soon [§4.2](https://personalagentprotocol.org/docs/spec) T2-14 Nonce challenge Outcome: Not measured Severity: P1 coming soon [§4.3](https://personalagentprotocol.org/docs/spec) T2-16 Bearer token request for an MCP server (no DPoP, resource = MCP url) Outcome: Not measured Severity: P1 coming soon [§4.3, §6](https://personalagentprotocol.org/docs/spec) T2-18 Token accepted without cookies Outcome: Not measured Severity: P1 coming soon [§4.3](https://personalagentprotocol.org/docs/spec) T2-19 Valid browser assertion, form POST Outcome: Not measured Severity: P0 coming soon [§5](https://personalagentprotocol.org/docs/spec) T2-25 Cookie scope Outcome: Not measured Severity: Advisory coming soon [guides](https://personalagentprotocol.org/docs/guides) ## Tier 2b: requires opt-in Checks that run only for a verified owner who opts in. Not measured yet. 36 not measured ### Show the 36 planned checks T2-M2 Send a valid Session Token in ?access_token= instead of the header Outcome: Not measured Severity: P0 requires opt-in [§4.3](https://personalagentprotocol.org/docs/spec) T2-M3 Send a valid browser assertion in the URL instead of the form body Outcome: Not measured Severity: P1 requires opt-in [§5](https://personalagentprotocol.org/docs/spec) T2-M4 Start Direct Sign-In with code_challenge_method=plain and Ora's real client_id; stop at the authorization endpoint Outcome: Not measured Severity: Advisory requires opt-in [guides](https://personalagentprotocol.org/docs/guides) T1-12 Mediated endpoint, only if the company opts in: two bad-credential attempts Outcome: Not measured Severity: P1 requires opt-in [§4.7, guides](https://personalagentprotocol.org/docs/spec) T2-03 Replay the same assertion jti Outcome: Not measured Severity: P0 requires opt-in [§4.2](https://personalagentprotocol.org/docs/spec) T2-04 Assertion with aud as an array or another endpoint Outcome: Not measured Severity: P1 requires opt-in [§4.2](https://personalagentprotocol.org/docs/spec) T2-06 Renew U1's Session with a U2 assertion Outcome: Not measured Severity: P0 requires opt-in [§4.2](https://personalagentprotocol.org/docs/spec) T2-07 Assertion signed with a key not in Ora's JWKS Outcome: Not measured Severity: P0 requires opt-in [§4.1](https://personalagentprotocol.org/docs/spec) T2-08 alg: none or HS256 assertion Outcome: Not measured Severity: Advisory requires opt-in [guides](https://personalagentprotocol.org/docs/guides) T2-09 Valid token, reused proof jti Outcome: Not measured Severity: P0 requires opt-in [§4.3](https://personalagentprotocol.org/docs/spec) T2-10 Proof with wrong htu or htm Outcome: Not measured Severity: P0 requires opt-in [§4.3](https://personalagentprotocol.org/docs/spec) T2-11 Proof with wrong ath Outcome: Not measured Severity: P0 requires opt-in [§4.3](https://personalagentprotocol.org/docs/spec) T2-12 Proof signed by a different key than the token's binding Outcome: Not measured Severity: P0 requires opt-in [§4.3](https://personalagentprotocol.org/docs/spec) T2-13 Stale iat (beyond ~1 min) Outcome: Not measured Severity: P1 requires opt-in [§4.3](https://personalagentprotocol.org/docs/spec) T2-15 Token sent as Authorization: Bearer to a non-MCP endpoint Outcome: Not measured Severity: P0 requires opt-in [§4.3](https://personalagentprotocol.org/docs/spec) T2-17 That Bearer token at another MCP server or an OpenAPI endpoint Outcome: Not measured Severity: P0 requires opt-in [§4.3](https://personalagentprotocol.org/docs/spec) T2-20 Replay the same browser assertion Outcome: Not measured Severity: P0 requires opt-in [§5](https://personalagentprotocol.org/docs/spec) T2-21 exp more than 60 s after iat Outcome: Not measured Severity: P1 requires opt-in [§5](https://personalagentprotocol.org/docs/spec) T2-22 return_to on a foreign domain Outcome: Not measured Severity: P0 requires opt-in [§5](https://personalagentprotocol.org/docs/spec) T2-23 Session assertion (wrong typ) at the browser endpoint Outcome: Not measured Severity: P1 requires opt-in [§5](https://personalagentprotocol.org/docs/spec) T2-24 Browser assertion at the token endpoint Outcome: Not measured Severity: P1 requires opt-in [§5](https://personalagentprotocol.org/docs/spec) T2-26 Start with a general question Outcome: Not measured Severity: P0 requires opt-in [§7.3](https://personalagentprotocol.org/docs/spec) T2-27 Retry the same message id and content Outcome: Not measured Severity: P1 requires opt-in [§7.3](https://personalagentprotocol.org/docs/spec) T2-28 Same id, different content Outcome: Not measured Severity: P1 requires opt-in [§7.3](https://personalagentprotocol.org/docs/spec) T2-29 Read events with and without wait Outcome: Not measured Severity: P1 requires opt-in [§7.5, §7.7](https://personalagentprotocol.org/docs/spec) T2-30 POST …/messages?wait=10 Outcome: Not measured Severity: P2 requires opt-in [§7.3](https://personalagentprotocol.org/docs/spec) T2-31 Junk cursor Outcome: Not measured Severity: P1 requires opt-in [§7.13](https://personalagentprotocol.org/docs/spec) T2-32 U2 reads U1's conversation Outcome: Not measured Severity: P0 requires opt-in [§7.2](https://personalagentprotocol.org/docs/spec) T2-33 Stream with Accept: text/event-stream Outcome: Not measured Severity: P2 requires opt-in [§7.6](https://personalagentprotocol.org/docs/spec) T2-34 Ask about the account while signed out Outcome: Not measured Severity: P1 requires opt-in [§7.11](https://personalagentprotocol.org/docs/spec) T2-35 Message with only context Outcome: Not measured Severity: P2 requires opt-in [§7.4](https://personalagentprotocol.org/docs/spec) T2-36 Close, then send a message Outcome: Not measured Severity: P1 requires opt-in [§7.12](https://personalagentprotocol.org/docs/spec) T2-37 Handoff (opt-in only; may page staff) Outcome: Not measured Severity: P2 requires opt-in [§7.9](https://personalagentprotocol.org/docs/spec) T2-38 Ora client metadata without extensions.operations, trigger a proposing endpoint Outcome: Not measured Severity: P1 requires opt-in [Ops §2](https://personalagentprotocol.org/docs/extensions/operations) T2-39 U2 reads U1's signed-out operation Outcome: Not measured Severity: P0 requires opt-in [Ops §3.2](https://personalagentprotocol.org/docs/extensions/operations) T2-40 Confirm an old revision (if revisions can be triggered) Outcome: Not measured Severity: P1 requires opt-in [Ops §5.2](https://personalagentprotocol.org/docs/extensions/operations) ## Tier 3: needs a test account and a person Checks that need a test account from the company and a person at the keyboard. Ora does not run these on its own. 17 not measured ### Show the 17 planned checks T3-01 Direct sign-in Outcome: Not measured Severity: P0 needs a test account and a person [§4.5](https://personalagentprotocol.org/docs/spec) T3-02 Redirect URI not in Ora's redirect_uris Outcome: Not measured Severity: P0 needs a test account and a person [§4.5](https://personalagentprotocol.org/docs/spec) T3-03 User declines Outcome: Not measured Severity: P1 needs a test account and a person [§4.5](https://personalagentprotocol.org/docs/spec) T3-04 Device sign-in Outcome: Not measured Severity: P1 needs a test account and a person [§4.6](https://personalagentprotocol.org/docs/spec) T3-05 Mediated sign-in (if offered) Outcome: Not measured Severity: P1 needs a test account and a person [§4.7](https://personalagentprotocol.org/docs/spec) T3-06 Partial scope approval Outcome: Not measured Severity: P1 needs a test account and a person [§4.4](https://personalagentprotocol.org/docs/spec) T3-07 Request an unlisted scope Outcome: Not measured Severity: P1 needs a test account and a person [§4.4](https://personalagentprotocol.org/docs/spec) T3-08 Scope enforcement across channels Outcome: Not measured Severity: P0 needs a test account and a person [§4.4, guides](https://personalagentprotocol.org/docs/spec) T3-09 Account Token from another client_id or at an API Outcome: Not measured Severity: P0 needs a test account and a person [§4.8](https://personalagentprotocol.org/docs/spec) T3-10 Account Token with narrower and wider scope Outcome: Not measured Severity: P1 needs a test account and a person [§4.8](https://personalagentprotocol.org/docs/spec) T3-11 Sign a Session into account B after account A Outcome: Not measured Severity: P1 needs a test account and a person [§4.4](https://personalagentprotocol.org/docs/spec) T3-12 Revoke the Account Token Outcome: Not measured Severity: P0 needs a test account and a person [§4.9](https://personalagentprotocol.org/docs/spec) T3-13 Signed-out token on an account-using conversation Outcome: Not measured Severity: P1 needs a test account and a person [§7.11](https://personalagentprotocol.org/docs/spec) T3-14 Direct Conversation Outcome: Not measured Severity: P1 needs a test account and a person [§7.10](https://personalagentprotocol.org/docs/spec) T3-15 Operation end to end (sandbox action) Outcome: Not measured Severity: P0 needs a test account and a person [Ops §3, Ops §6](https://personalagentprotocol.org/docs/extensions/operations) T3-16 standing_permission on a user_approval_required operation Outcome: Not measured Severity: P1 needs a test account and a person [Ops §5.2](https://personalagentprotocol.org/docs/extensions/operations) T3-17 Account settings Outcome: Not measured Severity: Advisory needs a test account and a person [guides](https://personalagentprotocol.org/docs/guides) # Footer The standard for agent experience. © 2026 [era labs](https://eralabs.ai/) Product - Scan a site - [Journey](https://journey.ora.ai/) - [WebMCP audit](https://webmcp.ora.ai/) - [Directory](https://directory.ora.ai/) Resources - Methodology - Research - Blog - API Docs Company - About - Contact - Privacy - [@oradotai](https://x.com/oradotai)