Commands

Install with authright init (prompts for the current agent) or authright init --tools cursor. Terminal twin: CLI. Orientation: How commands work.

Thin closed loop

scan → pick explore or change
  → on that Auth Change record: --analyze
     (explore: Agenda HITL | change: plan → --set → --confirm-plan)
  → --ready → request-match → to-openspec | to-plan → review
doctor

doctor checks your application source for identity/security risks and writes a readable report. You can run it anytime—including before explore or change. It is not a required step between scan and that fork. --analyze, --ready, and on the auto-plan path --plan / --set / --confirm-plan run on the Auth Change record either Decide command created. Handoff: OpenSpec (to-openspec) or Agent Plan-mode (to-plan)—pick one.

User-intent commands

Pick one of /auth:explore or /auth:change for the same request. Neither command is a mode of the other.

Product name	Purpose
`/auth:scan`	Identity Context Discovery
`/auth:explore`	HITL command — Brief slice, recommend-and-choose, Agenda native HITL
`/auth:change`	Auto-plan command — Brief slice, plan, batch `--set`, confirm, ready
`/auth:request-match`	After the plan is locked, check that it still matches what you asked. Export waits until this check passes
`/auth:review`	Verify implementation against decisions
`/auth:doctor`	Read your app’s source and write a security risk report (login, permissions, secrets, debug tools)

/auth:explore and /auth:change run their CLI loop when the opening text matches that command or the invoke has no extra text. A mismatched opening line is chat (hint the other of those two commands; do not auto-switch). /auth:to-openspec and /auth:to-plan still intercept unfinished work. /auth:doc writes a readable summary of what you decided. /auth:doctor writes a report of what’s risky in the code today. They are different commands—doctor does not rewrite your design document.

Greenfield and brownfield are paths, not commands—do not invent /auth:greenfield or /auth:brownfield. Either path may use /auth:explore (HITL) or /auth:change (auto-plan).

Engineering handoff

Pick one of /auth:to-openspec or /auth:to-plan for the same locked change. Neither command is a mode of the other. Same pattern as Decide (/auth:explore | /auth:change).

Product name	Purpose
`/auth:to-openspec`	Propose-first OpenSpec handoff (needs the OpenSpec tool). Feed/claims → OpenSpec propose → coverage. If Decide is unfinished, or request-match has not passed, it stays on that gap. Without OpenSpec, it stops and points to `/auth:to-plan`
`/auth:to-plan`	Export a decided change to `.authright/changes/<dir>/agent-plan/` for host Plan mode. Requires the session to already be in Plan mode (skill interrupts otherwise). Does not need OpenSpec CLI

After request-match is clear: OpenSpec present → pick either handoff command; OpenSpec absent → Plan mode + /auth:to-plan only. See Implementation.

Document

/auth:doc asks your AI assistant to write a clear markdown document about the identity decisions already recorded for this project (and locked changes when they exist)—things like target approach, identity model, how login should behave, and what to verify. It does not change your app code, decisions, or Design files. There is no authright doc terminal command.

Each run creates a new file and keeps older ones. With no Auth Change id, the file lands under .authright/docs/ and covers every change. With an id, it lands under that change’s docs/ folder. Host forms: Cursor /auth-doc, Claude Code /auth:doc, Codex $authright-doc.

Diagnose

/auth:doctor asks your AI assistant to read your application source (APIs, UI pages, config) and write a clear risk report: what’s open without login, where permissions are missing, secrets or debug tools exposed, and which issues to fix first—with file paths you can jump to. Open the report at .authright/diagnosis/report.md—that’s the file meant for people. Extra notes under .authright/findings/ are helpers; don’t treat those alone as the full report.

Doctor is not /auth:doc: it describes current code risks, not the design you chose. It does not edit app source; next steps are usually /auth:explore or /auth:change. A prior scan helps (doctor will nudge you if context is missing). Host forms: Cursor /auth-doctor, Claude Code /auth:doctor, Codex $authright-doctor.

Host invoke forms

Intent	Cursor	Claude Code	Codex
scan	`/auth-scan`	`/auth:scan`	`$authright-scan`
explore	`/auth-explore`	`/auth:explore`	`$authright-explore`
change	`/auth-change`	`/auth:change`	`$authright-change`
request-match	`/auth-request-match`	`/auth:request-match`	`$authright-request-match`
handoff (OpenSpec)	`/auth-to-openspec`	`/auth:to-openspec`	`$authright-to-openspec`
handoff (Plan-mode)	`/auth-to-plan`	`/auth:to-plan`	`$authright-to-plan`
review	`/auth-review`	`/auth:review`	`$authright-review`
document	`/auth-doc`	`/auth:doc`	`$authright-doc`
doctor	`/auth-doctor`	`/auth:doctor`	`$authright-doctor`

Cursor registers the filename (.cursor/commands/auth-scan.md → /auth-scan). Claude Code namespaces by directory (.claude/commands/auth/scan.md → /auth:scan). Codex is skills-only ($authright-scan). Product headings on this page keep the colon names. File-shape table: How commands work.

CLI mapping

Product	Terminal
`/auth:scan`	`authright scan`
`/auth:explore`	`authright explore …` (Brief slice, then HITL Agenda). Pick this or `/auth:change`
`/auth:change`	`authright change -- <intent>` for auto-plan intake. Later `change <id>` flags (`--analyze`, `--plan`, `--set`, `--confirm-plan`, `--ready`) are the Auth Change record, including after explore
`/auth:request-match`	`authright request-match <id>`
`/auth:to-openspec`	`authright to-openspec <id>`
`/auth:to-plan`	`authright to-plan <id>`
`/auth:review`	`authright review <id>`
`/auth:doctor`	`authright doctor`

Full table: CLI.

On this page