A short piece of fiction, written by API Evangelist. The reader is imagined; the post, and every number and quotation from it, is real: "Two Front Doors for Agents in One Week," Kin Lane, October 12, 2026, https://apievangelist.com/2026/10/12/two-front-doors-for-agents-in-one-week/
Jonah's CTO sent a link on Tuesday with one line: "Do we need a poppy.json?" Jonah was the only developer at a twelve-person booking company, so the answer was going to be his.
The post he found put the week side by side. On October 6, MCP finalized Server Cards and pointed discovery at an AI Catalog at /.well-known/ai-catalog.json. The same day, Sierra and Meta announced the Personal Agent Protocol, Poppy, whose draft says a company MUST publish /.well-known/poppy.json. "Same week. Same question," the post said, "how does an agent find out what a company offers before it does anything? Two different front doors."
Jonah read the part about what Poppy is for, and it fit his company uncomfortably well. A person's own agent, reaching a business on their behalf. Any agent can search rooms, a signed-in agent can see your reservations, booking needs your approval. They took bookings. That was exactly them.
The author did not think Poppy was wrong to define its own file, because it does a different job: the sign-in half, OAuth issuer and scopes and sessions. But he counted what that leaves a company looking at: an AI Catalog, a Poppy document, an OpenAPI description underneath both, OAuth metadata, and more. Every additional well-known file, he wrote, is one more thing a provider has to know about, publish, keep current and secure.
One line settled the priority for Jonah. When a company lists its APIs in poppy.json, each one is typed openapi or mcp. "Your OpenAPI description is how a personal agent reaches you, without browsing your website."
They did not have one. He wrote back to the CTO: not yet. First the OpenAPI, because every door being proposed points at it. Then whichever front door is still standing in six months.