Install

One command (macOS and Linux)

curl -fsSL https://usedino.dev/install.sh | sh

No curl? Use wget:

wget -qO- https://usedino.dev/install.sh | sh

Then check it. If the installer said the folder it used isn't on your PATH, run the export line it printed first; an installer piped into sh can't change the shell you ran it from. For the standalone binary that's:

export PATH="$HOME/.local/bin:$PATH"
dino --version

This installs the standalone dino binary, so it needs no Node.js. The installer:

• picks the build for your OS and CPU (macOS or Linux, x64 or arm64)
• downloads it and SHA256SUMS from the GitHub release, and refuses to install if the checksum doesn't match
• installs to ~/.local/bin without sudo, and tells you if that folder isn't on your PATH
• never asks a question, so it's safe to run unattended

If no binary fits your machine (for example Alpine, which uses musl), it falls back to npm install -g @dino-hq/cli, which needs Node.js 22+. Read the script before running it with curl -fsSL https://usedino.dev/install.sh | less.

Pin a version

curl -fsSL https://usedino.dev/install.sh | sh -s 1.1.5

In CI, scripts and AI agents

Run it with pipefail and pin the version:

bash -o pipefail -c 'curl -fsSL https://usedino.dev/install.sh | sh -s 1.1.5'

Without pipefail, a pipe reports only the last command's exit code. If curl is missing, as it is in stock ubuntu and debian:*-slim images, or if the download fails, sh reads an empty script and the pipe exits 0 with nothing installed. Install curl first (apt-get update && apt-get install -y curl ca-certificates: slim images ship without package lists), or use wget, also under pipefail:

bash -o pipefail -c 'wget -qO- https://usedino.dev/install.sh | sh -s 1.1.5'

No bash? Download the script first, then run it. && stops at a failed download, so the exit code is always real:

curl -fsSLo install.sh https://usedino.dev/install.sh && sh install.sh 1.1.5

If Node.js is already there, you can skip installing entirely:

npx -y @dino-hq/cli@1.1.5 scan --endpoint https://your-api.com/graphql --format json

See For AI agents for how an agent reads the result and the exit code.

Homebrew (macOS and Linux)

brew install dino-hq/tap/dino

Installs the same standalone binary, checked against the release's SHA256SUMS, and brew upgrade dino keeps it current. No Node.js needed. The formula lives in Dino-HQ/homebrew-tap.

npm

npm install -g @dino-hq/cli    # Node.js 22+
npx @dino-hq/cli <command>     # no install

Windows

There's no PowerShell installer yet. Use npm install -g @dino-hq/cli, or download dino-windows-x64.exe from the latest release.

Download a binary directly

Every release has these files:

On macOS, use the install command rather than a browser download. The binaries aren't notarized by Apple yet, so Gatekeeper blocks a copy downloaded in a browser. The install command isn't affected.

Verify a download

Check the file against the release's SHA256SUMS:

grep ' dino-linux-x64$' SHA256SUMS | sha256sum -c -     # macOS: shasum -a 256 -c -

Each binary also has a keyless Sigstore bundle, <file>.sigstore.json, which proves it was built by Dino's release pipeline from a release tag:

cosign verify-blob ./dino-linux-x64 \
  --bundle ./dino-linux-x64.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/Dino-HQ/project-dino/\.github/workflows/release-sync\.yml@refs/tags/v' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'