How commands work

The one thing to know: AuthRight Harness has two kinds of commands, and they run in two different places.

• authright ... commands run in your terminal. (Example: authright init.)
• Product slash names use colon form in docs (/auth:scan, /auth:explore, /auth:change, /auth:request-match, /auth:to-openspec, /auth:to-plan, /auth:review, /auth:doc, /auth:doctor). What you type in chat depends on the host — see the file-shape table below. /auth:explore and /auth:change are two Decide commands — pick one. /auth:to-openspec and /auth:to-plan are two handoff commands — pick one.

If you type /auth:scan into your terminal and nothing useful happens, this page is why. If Cursor does not register /auth:scan, type /auth-scan instead.

authright init writes .authright/AGENTS.md (a managed playbook). Generated skills and commands tell the agent to read that file first. AuthRight does not create /auth:agents and does not edit repository-root AGENTS.md / CLAUDE.md.

Public vs agent vs internal (same authright binary)

File shape → what you type

Invoke spelling is a function of the file that was written, not a single colon string for every host. authright init / update print the installed hosts’ rows from this table.

Examples: Claude /auth:scan, Cursor /auth-scan, Codex $authright-scan. If you chose --delivery skills on Cursor, there is no /auth-scan command file — use the skill authright-scan.

The two halves

The CLI (terminal half). Install from npm and run from your shell for init, scan, explore, change, export, review, and doctor.

authright init
authright scan
authright explore -- "…"
authright change AUTH-YYYY-NNNN

The agent half (chat). After init, slash commands / skills drive user-intent workflows. Type the host form, not a generic colon string on every tool.

Cursor:       /auth-scan  /auth-explore  /auth-change  /auth-to-openspec  /auth-to-plan  /auth-doc  /auth-doctor
Claude Code:  /auth:scan  /auth:explore  /auth:change  /auth:to-openspec  /auth:to-plan  /auth:doc  /auth:doctor
Codex:        $authright-scan  $authright-explore  $authright-change  $authright-to-openspec  $authright-to-plan  $authright-doc  $authright-doctor

/auth-doc, /auth:doc, and $authright-doc write a readable summary of identity decisions already on disk (and locked changes when they exist). They do not change your app or configuration, and there is no authright doc terminal command. Omitting an Auth Change id covers every change under .authright/docs/. Naming an id writes under that change's docs/ directory. Earlier documents are left in place.

/auth-doctor, /auth:doctor, and $authright-doctor read your application source and write a risk report to .authright/diagnosis/report.md. That is different from /auth:doc (decisions write-up vs code risk report).

        YOUR TERMINAL                         YOUR AI ASSISTANT'S CHAT
   ┌──────────────────────┐               ┌──────────────────────────────┐
   │  $ authright init    │   installs    │  Cursor  /auth-scan          │
   │  $ authright scan    │  ──────────►  │  Claude  /auth:scan          │
   │  $ authright review  │   commands    │  Codex   $authright-doctor   │
   └──────────────────────┘    & skills   └──────────────────────────────┘

There is no separate “interactive mode”

Open your assistant in the project and type the host command in chat.

Host spelling table

Stale Claude flat files (.claude/commands/auth-scan.md) from older CLIs register /auth-scan, not /auth:scan. Run authright update, then type /auth:scan on Claude Code.

See Commands and Agents.