CLI reference

Every dino CLI command and flag: scan, watch, diff, lint, changelog, init, config, login, runner, and more, with global options and exit codes.

The dino CLI runs the same verification pipeline locally that CI and agents use. Every command exits with the documented codes and can emit machine-readable JSON with --format json.

Install once, or run ad-hoc with npx:

npm install -g @dino-hq/cli    # then: dino <command>
npx @dino-hq/cli <command>     # no install

Global options

Available on every command:

Option	Effect
`--tenant <id>`	Tenant config to use (or `--endpoint` for an ad-hoc scan).
`--env <name>`	Target environment (default: the tenant's default).
`--format <markdown\|json>`	Output format. `json` is the machine contract.
`--quiet`	Suppress non-essential output.
`--verbose`	Show applied defaults and internal diagnostics.
`--debug`	Show full stack traces on errors.
`--no-color`	Disable color (also respects the `NO_COLOR` env var).
`--help`, `-h`	Show help for a command.
`--version`, `-v`	Show the version.

scan

Run the full verification pass against an API: security, correctness, contracts, and documentation.

dino scan --endpoint https://your-api.com/graphql
dino scan --endpoint https://your-api.com --protocol rest --spec-url https://your-api.com/openapi.json
dino scan                      # uses .dino.yml

Option	Effect
`--endpoint <url>`	Ad-hoc scan target (no `.dino.yml` needed).
`--protocol <graphql\|rest>`	`graphql` (default) or `rest`.
`--spec-url <url\|path>`	OpenAPI spec, required when `--protocol rest`.
`--header <"Name: Value">`	Send a static header (repeatable).
`--token <token>`	Shortcut for `--header "Authorization: Bearer <token>"`.
`--fail-on-high`	Exit `3` if HIGH or CRITICAL findings exist.
`--tools <list>`	Comma-separated quality tools to run (default: all).
`--modules <list>`	Comma-separated modules to scan (default: all).
`--reasoning`	Enable AI reasoning (requires an Anthropic API key).
`--accept-partial`	Treat a reduced-coverage (partial) scan as success: exit `0` instead of `6`.

Exit codes: 0 clean, 3 gate failed (--fail-on-high), 6 partial, plus 2/4/5/70 errors. --tools and --modules select which quality tools run; they are not operation filters.

watch

Run scheduled scans with Shadow Mode: observe (report only) or enforce (gate).

dino watch --tenant my-api --autonomy enforce --interval 600

Option	Effect
`--autonomy <observe\|enforce>`	`observe` (default) reports; `enforce` exits `3` on a gate failure.
`--once`	Run a single scan and exit (alias for `--iterations 1`).
`--interval <sec>`	Seconds between scans (default: `300`).
`--iterations <n>`	Maximum number of scan iterations.

docs

Generate API documentation from live introspection.

dino docs --tenant my-api --format markdown
dino docs --tenant my-api --format json      # dino-api-docs document

--format json emits a dino-api-docs document (distinct from a scan result; see JSON output).

diff

Compare the current schema against a saved snapshot.

dino diff --tenant my-api --fail-on-breaking

--fail-on-breaking exits 3 if breaking changes are detected.

lint

Check schema descriptions; fails on new undocumented operations.

dino lint --tenant my-api --fail-on-undocumented

--fail-on-undocumented exits 3 if new undocumented operations are found.

changelog

Generate a changelog from schema snapshot diffs.

dino changelog --tenant my-api --from <snapshotId> --fail-on-breaking

Option	Effect
`--fail-on-breaking`	Exit `3` if breaking changes are detected.
`--from <id>`	Compare against a specific snapshot ID.

validate

Validate .dino.yml with helpful error messages. Exits 5 on invalid config, 0 when valid.

dino validate

init

Set up your project: generates .dino.yml interactively.

dino init            # writes .dino.yml in the current directory
dino init --force    # overwrite an existing file

config

Configure CLI preferences.

dino config telemetry            # show the current level
dino config telemetry off        # off | crash | all

Telemetry also respects the DO_NOT_TRACK and DINO_TELEMETRY_DISABLED env vars.

Cloud & auth

These commands use the Dino cloud.

Command	What it does
`dino login [--api-url <url>]`	Authenticate via browser (Connected Apps + PKCE); stores a token in `~/.dino/credentials.json`.
`dino logout`	Clear stored credentials (best-effort server revoke).
`dino whoami`	Show the active tenant for the current login.
`dino runner <register\|start>`	Register this machine as a cloud runner, then poll for scan jobs.
`dino verify --cloud-endpoint <url> --token <token>`	Verify a scan's result against its Sigstore attestation.