moth docs
Protocol The Mothpoint

The Mothpoint

Every call goes to one address and passes the same stages in the same order, so the balance is safe before a model runs and your identity is gone before anything leaves our servers.

The thesis draws the Mothpoint in seven stages. This page follows one chat call through the code itself and says what each stage checks and what it can refuse.

  1. Checked

    1. 01Size and shape
    2. 02Key check
    3. 03Rate limits
    4. 04Read the request
    5. 05Model and key rules

    A refusal here costs nothing

  2. Held

    1. 06Hold

    The worst case is reserved

  3. Sent as Moth

    1. 07Identity off
    2. 08Pooled key and queue

    Nothing that says who you are goes on

  4. Back to you

    1. 09Reply rewritten
    2. 10Settle and record

    You pay what it used

Every call passes these ten stages in order. From stage 07 on, nothing that leaves Moth carries who you are.

  1. Size and shape

    A body larger than its endpoint takes is refused before anything else is read, at 32 MB for chat and 64 KB for a media job. An upload sent in chunks with no Content-Length is refused here too.

  2. Key check

    The key or wallet session is looked up by its hash. A missing, revoked or expired key ends the call here with 401.

  3. Rate limits

    Each key may make 60 calls a minute and each account 120 across all its keys. A refusal carries retry-after in seconds.

  4. Read the request

    The body is checked against the endpoint's schema, and every field the schema doesn't name is dropped at every level. That is how fields such as user and metadata never travel on.

  5. Model and key rules

    The model must be in the catalog, allowed on this key and able to do what the request asks, such as tools, web search or a forced tool call. A conversation longer than the model's context is refused here, before anything is held.

  6. Hold

    The call's worst case is reserved on the balance, inside the key's spend cap. If either can't cover it, the call ends with 402 and nothing has reached a model.

  7. Identity off

    The call is rebuilt from the request alone. No header you sent goes on, so the host never sees your IP address, your user agent or your key, and the model's name becomes the host's own name for it.

  8. Pooled key and queue

    The call leaves under one shared key that every caller's calls use, through one queue that paces every new call, chat and media alike, and takes accounts in turn. A call that would wait more than about ten seconds in it is refused at once with 429 and gets its hold back. A host that is busy or briefly down is retried up to twice, after 0.7 and 1.8 seconds, and no new try starts once eight seconds have passed.

  9. Reply rewritten

    The reply gets a Moth id and the Moth model name back, its usage counts only your own input and output, and any cost figure or error text from the host is removed.

  10. Settle and record

    The hold is settled at what the call used, and the call is recorded by account, key, model, token counts, charge and time taken. The prompt and the reply are not recorded anywhere.

Refused early, charged nothing. Any stage before the hold can refuse a call, and a refusal there costs nothing. After the hold, a call that fails before any output gives the whole hold back, with one exception. If you close the connection, or your client stops waiting, after the call has gone on to the model, you pay for its input, because the model has already read it.

What is removed lists every field the Identity off and Reply stages take out, and Hold, then settle works through a charge to the last millionth of a dollar.