> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enfors.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Network & TLS

> Connection paths and network requirements for the watcher and the gateway.

## Connection paths

| Client                               | Path                                                                   | Mechanism |
| ------------------------------------ | ---------------------------------------------------------------------- | --------- |
| Claude Code (CLI) and Claude Desktop | Watcher reads the local transcript → `data.enfors.ai` (ingest + queue) | Watcher   |
| Agent SDKs (e.g. OpenAI SDK)         | Call the Enfors gateway (`llm.enfors.ai`) directly                     | Gateway   |

The **watcher** captures coding assistants by reading their transcript files and uploading
completed turns — it does **not** intercept traffic. **Agent SDKs** send their calls to the
gateway directly.

<Note>
  The watcher **replaces the earlier mitmproxy approach** — there is no local proxy, no TLS
  interception, and no CA certificate to trust.
</Note>

## Network requirements

| Direction            | Source            | Destination      | Port | Protocol  | Used by                         |
| -------------------- | ----------------- | ---------------- | ---- | --------- | ------------------------------- |
| Outbound             | Developer machine | `data.enfors.ai` | 443  | HTTPS/TLS | Watcher (transcript upload)     |
| Outbound             | Developer machine | `auth.enfors.ai` | 443  | HTTPS/TLS | Cognito sign-in / token refresh |
| Outbound             | Developer machine | `llm.enfors.ai`  | 443  | HTTPS/TLS | Agent SDKs (gateway)            |
| Local (sign-in only) | Browser → watcher | `localhost:8765` | —    | HTTP      | OAuth PKCE callback             |

**No inbound connections are required. No firewall rules to open.**

## Ingest

The watcher uploads to `data.enfors.ai`; the gateway enqueues its captured calls via its own
callback. Both land on the same ingest queue, where a backend worker reconstructs each turn
into a decision — internal backend processing, not a client connection.