Agents

AuthRight supports Cursor, Codex, and Claude Code (plus the always-available CLI). Install agent files with:

authright init
# or: authright init --tools cursor
# later:
authright update

Omit --tools to pick the current agent. Pass --tools cursor (or claude / codex) when you already know. Use --tools none to skip agent delivery. See How commands work.

What init writes (same step)

Tool	Skills	Command files
Cursor	`.cursor/skills/authright-*/`	`.cursor/commands/auth-*.md` (registers `/auth-scan`, …)
Claude Code	`.claude/skills/authright-*/`	`.claude/commands/auth/<id>.md` (registers `/auth:scan`, …)
Codex	`.agents/skills/authright-*/` only	none (even with `--delivery commands`)

Workflows installed: scan, explore, change, request-match, to-openspec, to-plan, review, doc, doctor. /auth:explore and /auth:change are two commands — pick one.

Product commands (design)

Command	Intent
`/auth:scan`	What is identity here today?
`/auth:explore`	HITL command — design options / trade-offs interactively. Pick this or `/auth:change`
`/auth:change`	Auto-plan command — full plan, batch overrides, confirm then lock
`/auth:request-match`	Where does the locked plan differ from the original request?
`/auth:review`	Does implementation match decisions?
`/auth:doctor`	What’s risky in the app source today? Report → `.authright/diagnosis/report.md`

Engineering handoff (not Decide intents)—pick one: /auth:to-openspec → OpenSpec; /auth:to-plan → Agent Plan-mode (Implementation).

Public CLI loop (skills teach this)

scan → pick explore or change
  → on that Auth Change record: --analyze
     (explore: Agenda HITL | change: plan → --set → --confirm-plan)
  → --ready → request-match → to-openspec | to-plan → review
doctor

change <id> flags are follow-up on the record either command created. doctor can run anytime for a source risk report; it is not a required step between scan and the fork.

Host spelling

Product names stay colon-shaped (/auth:scan). Type the form your host registered:

Host	Where files land	How you invoke
Cursor	`.cursor/commands/auth-.md` + `.cursor/skills/authright-/`	`/auth-scan`, `/auth-explore`, `/auth-change`, …
Claude Code	`.claude/commands/auth/<id>.md` + `.claude/skills/authright-*/`	`/auth:scan`, `/auth:explore`, `/auth:change`, …
Codex	`.agents/skills/authright-*/`	`$authright-scan`, `$authright-explore`, …
CLI	—	`authright scan`, `explore`, `change`, `request-match`, `to-openspec`, `to-plan`, `review`, `doctor`

init also writes .authright/AGENTS.md. Skills tell the agent to read it first. AuthRight does not install /auth:agents and does not edit repository-root AGENTS.md.

Agent-facing CLI flags

Skills shell the same public verbs with program-global flags:

authright --invoke cursor scan --json
authright --invoke claude change --json -- <intent>

--invoke records the host in run logs; --json returns one snake_case object for agents. Humans can omit both. See CLI.

Advanced Internal CLI (omitted from the public site reference) lives in the product git repo under docs/internal/ — not a page on this docs site.

Rules for skills

Read .authright/AGENTS.md first (written by init / update)
Read .authright/context.yaml and still-valid accepted decisions before deciding. constitution.yaml is not project law
Prefer the public CLI loop
Do not invent accepted decisions without writing decisions.yaml
Do not edit application source during these AuthRight Harness workflows

Full list: Commands.