Door
Local per-device relay
Inspects and transforms requests on the user’s host, then routes them through stable loopback listeners.
The Meaning of Geumjul
Geumjul is a sacred braided straw rope originating from traditional Korea, hung across entryways to ward off impurities and strictly preserve a protected boundary between the interior and the untrusted exterior.
GEUM
Denotes prohibition, taboo, and sacred restriction—marking an inviolable boundary forbidden to casual or unvetted intrusion.
JUL
Means rope or woven cord—the tangible line of demarcation physically separating the protected sanctuary from the outside world.
Those who encountered a Geumjul recognized an immediate obligation of mindfulness and reverence: one had to compose themselves and ensure their body, attire, and conduct were pure and devout before crossing. If unprepared or carrying impurities, they understood they must never rashly or heedlessly cross that sacred line.
In historical Korea, families hung it across main gates to shield mother and child from outside contamination during childbirth, and wound it around sacred village shrines and altars when offering solemn communal prayers for protection.
Just as historical Geumjul demanded reverence and halted unprepared intrusion at sacred thresholds, modern gjl guards the policy boundary between autonomous coding agents and LLM providers.
Three boundaries
Door, Gate, and Vault are concurrent capabilities, not mutually exclusive editions.
Gate
Shared request gateway
Applies organization policy and injects the credential fixed to the selected route at the shared egress boundary.
Vault
Paired credential broker
Owns refresh operations and returns bounded access credentials to paired Doors without receiving normal request data.
Local usage, separate estimates
Provider-facing Door or Gate records token metadata by default, independently of audit bodies. The connected daemon keeps API estimates, subscription API equivalents, and unknown-plan API equivalents as separate USD figures. Non-token charges are excluded; these figures are not invoices. Door-to-Gate and Vault do not duplicate provider usage.
Usage and audit have independent Route switches and explicit manual deletion. Enabled audit bodies remain in owner-only local storage until deletion. Local traffic recordings also include received and forwarded HTTP headers, with authentication tokens, API keys, and cookie values masked before storage. Inspect headers and bodies in Desktop Activity or the local CLI; WebSocket headers describe the connection handshake. The usage ledger contains no bodies or credentials and is not automatically sent to remote audit. Remote audit never contains bodies or header recordings.
Choose where the boundary lives.
Explore how request data, regex masking, and provider credentials flow across four interactive deployment architectures.
SCENARIO 01 · CASE 1/4
Rule Replacement
Live simulation active
Sensitive content masking (Replace mode)
Codex transmits a request on the user’s host containing sensitive values (JWTs, API keys, etc.). Door detects them with regex masking rules, replaces them with the user-configured replacement string (in this case, [YOUR_CUSTOM_REPLACEMENT]), and relays the sanitized request to OpenAI. The provider response is returned verbatim to the client.