FAQ

Is AuthRight Harness an IdP or IAM SaaS?

No. It is a decision layer for AI software engineering. It does not run login, host users, or replace PingAM / Entra / Keycloak / Auth0.

Does it write my application code?

No. Coding agents and OpenSpec own implementation. AuthRight Harness records context, decisions, contracts, and review.

Do I need to clone the AuthRight Harness repo?

No. Install the published CLI:

npm install -g @authright/cli@latest

See Installation.

Why doesn't /auth:scan work in my terminal?

Slash commands run in AI chat, not the shell. Use authright scan in the terminal.

In Cursor chat the registered form is /auth-scan (from the filename). Claude Code uses /auth:scan from .claude/commands/auth/. If a slash is missing after an upgrade, run authright update. How commands work.

What are the primary product commands?

User intents: /auth:scan, /auth:explore, /auth:change, /auth:request-match, /auth:review, /auth:doctor.
Also: /auth:doc writes a decisions summary (not a code risk scan).
Handoff: pick /auth:to-openspec (OpenSpec CLI required) or /auth:to-plan (host Plan mode)—two handoff commands, same locked change. Not Decide commands. Commands.

Explore or change — pick one command

• /auth:explore — HITL command (Brief slice, then Agenda native HITL). Recommended is a label, not a default.
• /auth:change — auto-plan command: same Brief/slice gate, apply recommended where possible, show all resolved/unresolved, batch --set, then confirm-plan → ready → request-match → export.

Pick one. Later change <id> flags are follow-up on the Auth Change record either command created.

How do I record a decision?

On explore, after a Brief slice is accepted, the skill maps remaining slice picks into decisions.yaml (slice-accept itself is not accepted), continues Agenda HITL, then --ready, then request-match (the locked plan must still match what you asked). On change, the CLI writes auto-plan.yaml; you override with --set, --confirm-plan, then --ready and request-match. You can still edit decisions.yaml and contract.md directly. /auth:to-openspec and /auth:to-plan intercept unfinished explore HITL or unresolved/pending auto-plan rather than requiring a new Decide slash when a gap is already actionable.

Which AI tools are supported?

Supported hosts today: Cursor, Codex, and Claude Code (+ CLI always). Agents.

Which languages and stacks are supported?

Java and Node.js / TypeScript have the strongest scan and pack-idiomatic landing coverage today. Python and Go are also supported and being strengthened. More languages and stacks will follow.

The CLI itself runs on Node.js regardless of the application stack. Installation · Concepts.

Is OpenSpec required?

OpenSpec and Agent Plan-mode are the two supported ways to hand off for implementation. OpenSpec needs the separate openspec tool; without it use Plan mode + /auth:to-plan. Implementation · OpenSpec · Agent Plan-mode.

Is authright review a security audit?

No. Review checks that implementation still matches what you locked—it is not a pen-test.

What’s the difference between /auth:doctor and /auth:doc?

• /auth:doctor — reads your app source and writes a risk report at .authright/diagnosis/report.md (open APIs, missing login, secrets/debug exposure, etc.). It does not change code or lock a new design.
• /auth:doc — writes a document of decisions already recorded (and locked changes when present) under .authright/docs/. It does not scan your app for vulnerabilities.

Use doctor to see what’s risky in the code today; use doc to explain the plan you already chose.

Where do I read the doctor result?

Open .authright/diagnosis/report.md. Files under .authright/findings/ are machine helpers from the CLI—not the main report.