For developers · the curated directory
The curated directory is how everyday users find and install poppies — one click, verified packages, no terminal. Getting listed is free, there's no revenue share on anything you sell outside the platform, and your poppy stays yours: your brand, your repository, your releases. Sideloading from disk stays open forever; listing is for reach and trust.
Six rules — five are checked mechanically, the sixth by a human.
Every listing links its public repo. Your users — or their AI agents — can read exactly what your poppy does before installing. No open repo, no listing.
Every listing ships an app icon: your own mark, square PNG, legible at small sizes. It's what users recognise you by — on your card, in the sidebar, and top-left inside your poppy's own UI. The icon spec is short.
Your brand + the suffix: MailPoppy, Backup-Poppy. Letters and
digits only, single spaces or hyphens, capital-P Poppy. Names are unique — first
listed keeps it.
Your release ships the package zip built by pack-extension, pinned by its
sha256. The app verifies the hash on every user's machine before anything installs.
Cloud work survives navigation, destroying anything takes a real two-step confirmation, and errors speak plain language. (The same bar MailPoppy holds itself to.)
A listing is a real, working poppy in genuine use — names can't be reserved by placeholder apps. A listing that turns out to be a placeholder is delisted (with notice), and the name is freed.
Build it. Hand your coding agent the AgentsPoppy build guide (AGENTS.md + the extension SDK + the hello-poppy example) — it scaffolds a poppy that speaks the broker's protocol from the first commit.
Prove it leaves no trace. Run npm run certify — deploy, seed, tear
down, and assert your poppy cleans up completely. You'll be asked about it in review.
Publish. Make the repository public and create a release with the package zip —
pack-extension builds it and prints the sha256 plus a ready-to-paste catalog
entry.
Check your entry below. The same rules the directory enforces, answered here before you send anything.
Email it. Send the catalog entry. A human reviews it against the rules above and, if it passes, your poppy goes live for every AgentsPoppy user — usually within days.
One mark, three places: your listing card, the host's sidebar, and the top-left of your own UI.
Square PNG, transparency welcome. Keep a 512×512 source; the catalog entry embeds a 128×128 data URI (under 50KB). The host draws the rounded corners — don't pre-round.
Put the file inside your frontend directory and declare it in your manifest —
"icon": "frontend/icon.png". The host then shows it beside your poppy
everywhere: sidebar, approval screen, its tab.
Display the same icon at the top-left of your poppy's interface, next to your poppy's name. Every poppy follows this convention, so users always know which app they're inside — open MailPoppy to see it.
It must read at 24px: a bold, simple mark — not a screenshot, a photo, or a wall of text. And it must be your own; imitating another poppy's mark (or AgentsPoppy's) is grounds for delisting.
Runs entirely in your browser against the live catalog — nothing is sent anywhere.
// the same checks run again at listing time and on every deploy — this just saves you the round-trip
Submit your poppy from the developer dashboard — no email needed. Sign in, connect Stripe (that verifies your identity), and fill in the “List your poppy” form. It runs the exact same checks as above, then queues your listing for review.
Open the developer dashboardThe form also asks for your license (MIT encouraged), a short age-rating questionnaire, and a data-flow declaration — whether any data ever leaves the user's cloud. Full requirements live in the developer hub; listing means accepting the Developer Agreement.
// honest process: every submission is reviewed personally by the founder — the directory is young and curation is the security model. Expect a reply in days, not minutes.