How it works

Looked up by its SHA-256 hash — Onto keeps the hash, never the key. Calls from the MCP connector carry a short-lived token Onto minted after your OAuth sign-in instead.

From your account's month, which resets at 00:00 UTC on the 1st, plus one of your concurrent slots. It's taken before the cache, so a cached read still counts; a failed read is refunded. Numbers per plan on Rate limits.

One hour, keyed on the deploy, the endpoint and the exact URL — so every deploy starts empty. "fresh": true skips the lookup.

• hit→answer from the cache and stop here
• miss→carry on

The host must resolve to a public address — checked again on every redirect. GitHub file links are rewritten to their raw version.

Fetched with a 5-second limit. If it can't be fetched, the read goes ahead; reading your own verified site skips the check.

• Disallow: /→for GPTBot or * → ROBOTS_BLOCKED, before the page is fetched

15 seconds for the whole fetch, up to 5 redirects, 10 MB at most, no JavaScript run. HTML pages also get two quick probes for a Markdown version the site already serves.

HTML goes through @ontosdk/core, after tables are normalised. PDFs are read as text; JSON, CSV and plain text pass through.

Every HTML read gets an AIO score. /v1/score and /v1/read-and-score return it; /v1/read doesn't.

The result is cached, usage is logged without waiting on it, and the slot is freed.

Every prerendered page under .next/server/app. Routes rendered per request get no .md.

The same @ontosdk/core cleaner the Read API uses — once per build, not once per request.

One .md per route in public/.onto/, and llms.txt from your onto.config.ts.

Posted to api.buildonto.dev/api/files with your site key — only when ONTO_API_KEY is set. That's what fills Serve → Routes.

A known AI crawler's User-Agent, an Accept: text/markdown header, or ?onto on the URL.

• anyone else→straight through to your page — the middleware does nothing
• agent→carry on

Sent to Onto without waiting on the reply, so it never slows the answer. Skipped when no site key is set.

The prebuilt /.onto/pricing.md, fetched from your own site — nothing is extracted now.

Only if you've written some for the route, and only on Serve Pro and above. This step does wait for Onto's reply.