The agent SDK where humans drive the state.
ONTO is the open-source agent SDK for Python, TypeScript, and Rust. The agent reads state and proposes actions. The human writes state and approves. Plan Mode, typed memory, and per-call consent scopes are built into the runtime — not bolted on.
- SDKs
- Py · TS · Rust
- License
- MIT / Apache-2.0
- Default model
- Open-weight
from onto import Onto, Models, BuiltinTools
onto = Onto(model=Models.GPT_OSS_20B,
builtin_tools=BuiltinTools.STANDARD)
# 1. Extract typed facts from prose
result = onto.run_sync(
"I'm Alice. UTC, mornings. Plan a trip to Lyon.",
user_id="alice",
consent_scopes=["memory:write"],
extract=True,
)
# 2. Plan (no side-effect tools fire yet)
plan = onto.run_sync("Plan the trip.",
user_id="alice",
mode="plan_only")
# 3. Human approves → execute
if approve(plan):
onto.run_sync("Run the plan.",
user_id="alice",
consent_scopes=["tools:web.fetch"])
- Python · TypeScript · Rust
- MCP-compatible
- Claude Skills compatible
- OpenTelemetry
- On-prem ready
- MIT / Apache-2.0
Most agent SDKs collapse two responsibilities into one autonomous loop.
In a typical agent loop the model decides what to do and the model does it. State changes — memory writes, tool side effects — happen implicitly, inside reasoning.
That works fine for short, low-stakes tasks. It fails for long-running personal assistants that need durable memory, multi-tenant SaaS where each customer's data must stay scoped, regulated industries that need audit trails, and on-premise deployments that can't send data to external APIs.
ONTO inverts the paradigm. Humans own memory, consent, and approval. Agents are stateless workers that operate against state you control.
Built for humans who need to stay in the loop.
Most agent SDKs collapse two responsibilities into one autonomous loop: the model decides what to do and the model does it. ONTO separates them. Four primitives enforce the split.
Plan Mode
Approve before anything moves.
A first-class runtime mode that halts after the agent proposes tasks — no side-effectful tool fires until you say yes. Built in, not prompt-engineered.
How Plan Mode worksTyped Memory
Facts, not embeddings.
UPO + SMO model with provenance, confidence, decay, and consent scopes. Memory that answers "is this true right now" instead of "what looks similar."
Read the memory modelPolicy Guard
Per-call consent scopes.
Every tool declares its required scopes. Every run carries the scopes you grant. The runtime refuses tools whose scopes you did not authorize, with a structured error you can audit.
See consent scopesOpen-Weight Defaults
No API key to start.
Ships pointing at Ollama Cloud free models. Swap to Anthropic or OpenAI with one env var. On-prem ready — Sled or Postgres + pgvector, local embeddings, Helm recipes.
See provider modelSame four steps. Three languages. Identical semantics.
Extract typed facts. Plan with no side effects. Get human approval. Execute under scoped consent. Pick the SDK your team already writes in — the runtime is the same.
from onto import Onto, Models, BuiltinTools
onto = Onto(model=Models.GPT_OSS_20B,
builtin_tools=BuiltinTools.STANDARD)
# 1. Extract typed facts from a single sentence.
result = onto.run_sync(
"Hi, I'm Alice. UTC, mornings. Plan a Lyon trip.",
user_id="alice",
consent_scopes=["memory:write"],
extract=True,
)
# 2. Plan only — no side-effectful tools fire.
plan = onto.run_sync(
"Plan the trip.",
user_id="alice",
mode="plan_only",
consent_scopes=["tasks:write"],
)
# 3. Human approves, then we execute.
if human_approves(plan):
onto.run_sync(
"Run the approved plan.",
user_id="alice",
consent_scopes=["tasks:read", "tools:web.fetch"],
) import { Onto, Models, BuiltinTools } from "@onto/core";
const onto = new Onto({
model: Models.GPT_OSS_20B,
builtinTools: BuiltinTools.STANDARD,
});
// 1. Extract typed facts from a single sentence.
await onto.run("Hi, I'm Alice. UTC, mornings. Plan a Lyon trip.", {
userId: "alice",
consentScopes: ["memory:write"],
extract: true,
});
// 2. Plan only — no side-effectful tools fire.
const plan = await onto.run("Plan the trip.", {
userId: "alice",
mode: "plan_only",
consentScopes: ["tasks:write"],
});
// 3. Human approves, then we execute.
if (await humanApproves(plan)) {
await onto.run("Run the approved plan.", {
userId: "alice",
consentScopes: ["tasks:read", "tools:web.fetch"],
});
} use onto_runtime::{Onto, Models, BuiltinTools, RunOpts, Mode};
let onto = Onto::builder()
.model(Models::GPT_OSS_20B)
.builtin_tools(BuiltinTools::STANDARD)
.build()
.await?;
// 1. Extract typed facts from a single sentence.
onto.run("Hi, I'm Alice. UTC, mornings. Plan a Lyon trip.",
RunOpts::new("alice")
.consent_scopes(["memory:write"])
.extract(true),
).await?;
// 2. Plan only — no side-effectful tools fire.
let plan = onto.run("Plan the trip.",
RunOpts::new("alice")
.mode(Mode::PlanOnly)
.consent_scopes(["tasks:write"]),
).await?;
// 3. Human approves, then we execute.
if human_approves(&plan) {
onto.run("Run the approved plan.",
RunOpts::new("alice")
.consent_scopes(["tasks:read", "tools:web.fetch"]),
).await?;
} One flag routes natural language to the right level: session, profile, domain, or tool.
A runtime invariant. Side-effect tools never fire until the next call with execute scopes — even if the LLM tries.
Every tool declares what it needs. Every call says what you grant. Mismatch → structured refusal you can audit.
An honest matrix — including where ONTO is the wrong choice.
ONTO is not the right SDK for every job. The full table calls out where Claude, OpenAI, and Google ADK win.
| Capability | Claude SDK | OpenAI SDK | Google ADK | ONTO |
|---|---|---|---|---|
| Default model | Claude 4.5/4.6 | OpenAI Responses API | Gemini | Ollama Cloud (free open-weight) |
| Memory model | Conversation buffer | Conversation buffer | Conversation buffer | Typed UPO + SMO |
| Plan mode | Feature inside Claude Code | Pattern via handoffs | Workflow-as-plan | First-class runtime mode |
| Languages | Python, TypeScript | Python | Python, TS, Go, Java | Python, TypeScript, Rust |
| Policy / consent | Tool allowlist | Guardrails | Tool allowlist | Per-call consent scopes |
| Ontology extraction | DIY | DIY | DIY | Native, 4-level |
When the model can't be the one deciding.
ONTO is built for the four kinds of work where you can't ship an autonomous loop: regulated workflows, customer-facing copilots, long-running personal assistants, and knowledge work.
Healthcare
HIPAA-aligned audit trail, role-based consent scopes, Plan Mode before any order placement.
Read moreCustomer support
Per-account durable memory, tier-based auto-approval, Plan Mode for refunds and escalations.
Read morePersonal AI
Async memory writes and background summarization. The user, not the model, owns their facts.
Read moreResearch
Typed claim extraction across many documents with conflict resolution before commit.
Read moreGet started in 60 seconds.
No account needed. ONTO defaults to free open-weight models on Ollama Cloud, so you can run your first agent with a single pip install and an env var.
- No API key relationship needed to start — defaults to free open-weight models.
- Same primitives in Python, TypeScript, Rust, and over HTTP.
- On-prem path uses Sled or Postgres + pgvector. No data has to leave your network.
pip install onto-coreThen export OLLAMA_API_KEY to use the free open-weight default. Or set ANTHROPIC_API_KEY / OPENAI_API_KEY to swap providers.
Long-form pieces on agent SDK design.
Memory, Plan Mode, consent, on-prem deployment, vertical patterns — and honest comparisons against the alternatives.
Why Agent Memory Is Broken (And the Path to Fix It)
The standard agent loop has no idea who you are between sessions. Conversation buffers forget, embeddings retrieve the similar but not the true. Here is what typed memory looks like instead.
Plan Mode: Approving What Your AI Agent Does Before It Does It
How a first-class Plan Mode in your agent SDK turns hallucinated side effects into reviewable tasks — and why this is different from human-in-the-loop bolted on after the fact.
Typed Memory vs Vector Embeddings for AI Agents
Why storing 'Alice is in UTC' as an embedding and retrieving it later by cosine similarity is the wrong primitive — and what to use instead.
Common questions about ONTO.
What is ONTO?
ONTO is an open-source agent SDK for Python, TypeScript, and Rust. It puts humans in explicit control of agent memory, consent, and tool execution. Where most agent SDKs let the model decide what to do and do it, ONTO splits those: the agent reads state and proposes actions; the human writes state and approves. It is MIT or Apache-2.0 licensed.
How is ONTO different from Claude Agent SDK, OpenAI Agents SDK, or LangChain?
ONTO defaults to open-weight models (Ollama Cloud), ships typed UPO+SMO memory rather than only conversation buffers or vector embeddings, treats Plan Mode as a first-class runtime mode, and enforces per-call consent scopes through Policy Guard. It also ships three native SDKs — Python, TypeScript, and Rust — from a single Rust core.
Can I run ONTO on-premise without sending data to any third-party API?
Yes. ONTO ships with sled (local) or Postgres + pgvector storage, fastembed for local embeddings, and Helm recipes for Kubernetes. Use a local Ollama server or any OpenAI-compatible endpoint and no data leaves your network.
Is ONTO ready for production?
ONTO is pre-1.0 (current version 0.1.0) with 238 tests across the Rust core, Python, and TypeScript SDKs. Phases 0 through 20 have shipped — the runtime primitives are stable. Until 1.0 we will make breaking changes when they improve the SDK, tracked transparently in the roadmap.
Which language SDK should I use?
Pick the one your team already writes in. All three (Python via PyO3, TypeScript via napi-rs, Rust native) share the same Rust core, so semantics are identical. There is also an HTTP server (onto-cli serve) if you want to call ONTO from a language we don't bind to natively.
How much does ONTO cost?
The framework is free and open-source. Inference cost depends on the model provider you choose — Ollama Cloud has a generous free tier, OpenAI and Anthropic bill at their published rates. ONTO ships a cost meter that gives you per-user and per-tenant rollups for SaaS billing.
Ship an agent your auditor — and your users — will trust.
Open source under MIT or Apache-2.0. Free open-weight default. Three SDKs. On-prem path. Get the first agent running in under a minute.