/autoresearch

name: autoresearch
description: Autonomous Goal-directed Iteration. Apply Karpathy's autoresearch principles to ANY task. Loops autonomously — modify, verify, keep/discard, repeat. 9 subcommands: plan, debug, fix, security, ship, scenario, predict, learn.
version: 1.8.2
license: MIT
metadata:
  author: uditgoenka/autoresearch
  version: "1.8.2"

Claude Autoresearch — Autonomous Goal-directed Iteration

Inspired by [Karpathy's autoresearch](https://github.com/karpathy/autoresearch). Applies constraint-driven autonomous iteration to ANY work — not just ML research.

**Core idea:** You are an autonomous agent. Modify → Verify → Keep/Discard → Repeat.

MANDATORY: Interactive Setup Gate

**CRITICAL — READ THIS FIRST BEFORE ANY ACTION:**

For ALL commands (`/autoresearch`, `/autoresearch:plan`, `/autoresearch:debug`, `/autoresearch:fix`, `/autoresearch:security`, `/autoresearch:ship`, `/autoresearch:scenario`, `/autoresearch:predict`, `/autoresearch:learn`):

1. **Check if the user provided ALL required context inline** (Goal, Scope, Metric, flags, etc.) 2. **If ANY required context is missing → you MUST use `AskUserQuestion` to collect it BEFORE proceeding to any execution phase.** DO NOT skip this step. DO NOT proceed without user input. 3. Each subcommand's reference file has an "Interactive Setup" section — follow it exactly when context is missing.

| Command | Required Context | If Missing → Ask | |---------|-----------------|-----------------| | `/autoresearch` | Goal, Scope, Metric, Direction, Verify | Batch 1 (4 questions) + Batch 2 (3 questions) from Setup Phase below | | `/autoresearch:plan` | Goal | Ask via `AskUserQuestion` per `references/plan-workflow.md` | | `/autoresearch:debug` | Issue/Symptom, Scope | 4 batched questions per `references/debug-workflow.md` | | `/autoresearch:fix` | Target, Scope | 4 batched questions per `references/fix-workflow.md` | | `/autoresearch:security` | Scope, Depth | 3 batched questions per `references/security-workflow.md` | | `/autoresearch:ship` | What/Type, Mode | 3 batched questions per `references/ship-workflow.md` | | `/autoresearch:scenario` | Scenario, Domain | 4-8 adaptive questions per `references/scenario-workflow.md` | | `/autoresearch:predict` | Scope, Goal | 3-4 batched questions per `references/predict-workflow.md` | | `/autoresearch:learn` | Mode, Scope | 4 batched questions per `references/learn-workflow.md` |

**YOU MUST NOT start any loop, phase, or execution without completing interactive setup when context is missing. This is a BLOCKING prerequisite.**

Subcommands

| Subcommand | Purpose | |------------|---------| | `/autoresearch` | Run the autonomous loop (default) | | `/autoresearch:plan` | Interactive wizard to build Scope, Metric, Direction & Verify from a Goal | | `/autoresearch:security` | Autonomous security audit: STRIDE threat model + OWASP Top 10 + red-team (4 adversarial personas) | | `/autoresearch:ship` | Universal shipping workflow: ship code, content, marketing, sales, research, or anything | | `/autoresearch:debug` | Autonomous bug-hunting loop: scientific method + iterative investigation until codebase is clean | | `/autoresearch:fix` | Autonomous fix loop: iteratively repair errors (tests, types, lint, build) until zero remain | | `/autoresearch:scenario` | Scenario-driven use case generator: explore situations, edge cases, and derivative scenarios | | `/autoresearch:predict` | Multi-persona swarm prediction: pre-analyze code from multiple expert perspectives before acting | | `/autoresearch:learn` | Autonomous codebase documentation engine: scout, learn, generate/update docs with validation-fix loop |

/autoresearch:security — Autonomous Security Audit

Runs a comprehensive security audit using the autoresearch loop pattern. Generates a full STRIDE threat model, maps attack surfaces, then iteratively tests each vulnerability vector — logging findings with severity, OWASP category, and code evidence.

Load: `references/security-workflow.md` for full protocol.

**What it does:**

1. **Codebase Reconnaissance** — scans tech stack, dependencies, configs, API routes 2. **Asset Identification** — catalogs data stores, auth systems, external services, user inputs 3. **Trust Boundary Mapping** — browser↔server, public↔authenticated, user↔admin, CI/CD↔prod 4. **STRIDE Threat Model** — Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege 5. **Attack Surface Map** — entry points, data flows, abuse paths 6. **Autonomous Loop** — iteratively tests each vector, validates with code evidence, logs findings 7. **Final Report** — severity-ranked findings with mitigations, coverage matrix, iteration log

**Key behaviors:**

• Follows red-team adversarial mindset (Security Adversary, Supply Chain, Insider Threat, Infra Attacker)
• Every finding requires **code evidence** (file:line + attack scenario) — no theoretical fluff
• Tracks OWASP Top 10 + STRIDE coverage, prints coverage summary every 5 iterations
• Composite metric: `(owasp_tested/10)*50 + (stride_tested/6)*30 + min(findings, 20)` — higher is better
• Creates `security/{YYMMDD}-{HHMM}-{audit-slug}/` folder with structured reports:

`overview.md`, `threat-model.md`, `attack-surface-map.md`, `findings.md`, `owasp-coverage.md`, `dependency-audit.md`, `recommendations.md`, `security-audit-results.tsv`

**Flags:**

| Flag | Purpose | |------|---------| | `--diff` | Delta mode — only audit files changed since last audit | | `--fix` | After audit, auto-fix confirmed Critical/High findings using autoresearch loop | | `--fail-on {severity}` | Exit non-zero if findings meet threshold (for CI/CD gating) |

**Usage:**

# Unlimited — keep finding vulnerabilities until interrupted
/autoresearch:security

# Bounded — exactly 10 security sweep iterations
/autoresearch:security
Iterations: 10

# With focused scope
/autoresearch:security
Scope: src/api/**/*.ts, src/middleware/**/*.ts
Focus: authentication and authorization flows

# Delt