# Dino

> The deterministic verification layer for APIs. Dino gives coding agents and CI an independent, machine-readable verdict on an API: the same evidence and policy always produce the same result. You drive local scans through the published CLI (`@dino-hq/cli`), no account needed. Agents set up a Dino Organization and its APIs through the hosted MCP server at https://api.usedino.dev/mcp (a remote URL you connect over OAuth, not an npm package: there is no `@dino-hq/mcp-server` to install); the human verifies their email, chooses or creates the Organization, confirms its residency, and approves access in the browser. Authorizing a Target Connection is decided only by the human, signed in to Dino on its approval page (the `approvalUrl` the agent hands over); Dino refuses that decision from an agent. Other human work (an OAuth2 connect journey, stopping access, Dino service keys) happens on Dino's task page: the agent starts or requests it (`start_connect_journey`, `request_operator_action`), hands the human the `taskUrl`, and reads the outcome; Dino service keys are issued only by a human, and `list_service_keys` never returns key material.

This site is static content on usedino.dev. The canonical URL for this file is **https://usedino.dev/llms.txt** (the short paths `/llms` and `/llm.txt` redirect here). For the complete documentation in a single file, see llms-full.txt below.

## For coding agents: how to set up and run Dino

You (the agent) drive the `dino` CLI. A human supplies values you do not have (API URL, secrets) when Dino asks. The canonical, version-matched copy of this skill ships inside the CLI (run `dino skill`); this is a snapshot so you can start from a cold workspace. `dino schema` prints every command, flag and exit code of the installed version as JSON.

The loop: set up, verify, read, fix, reverify.

1. Install: `curl -fsSL https://usedino.dev/install.sh | sh` (standalone binary, no Node.js on macOS and most Linux; where no binary fits (e.g. Alpine/musl) it falls back to npm, which needs Node.js 22+; in scripts and agents run it under `bash -o pipefail -c '…'` and pin a version with `sh -s <version>`), or `brew install dino-hq/tap/dino`, or `npm install -g @dino-hq/cli` (Node 22+), or run pinned with no install: `npx -y @dino-hq/cli@<version>`. No account is needed for local scans.
2. Set up (once per project): `dino init --endpoint <API_URL> --protocol <graphql|rest> --auth <none|header|oauth2>` writes a flat `.dino.yml`. Add `--yes` for non-interactive / agent use.
   - `--protocol rest` also needs `--spec-url <openapi-url-or-path>`.
   - `--auth header` also needs `--auth-header <HeaderName>` and `--auth-value-env <ENV_VAR_NAME>`.
   - `--auth oauth2` also needs `--oauth2-token-endpoint`, `--oauth2-client-id-env`, `--oauth2-client-secret-env`.
3. Verify: `dino scan --fail-on-high --format json --quiet` runs the checks and returns findings plus a verdict.
4. Read: the exit code is your pass / not-pass signal; the JSON carries the detail and the next step.
5. Fix the API or its config, then reverify. Repeat until it passes at your gate.

Secret rule (important): you pass the NAME of an environment variable, never the secret value. Ask the human to set that env var themselves. Never put a token, password, or client secret into a command, a file, or your own message.

Missing input (human-agent resume): if `dino init` (or `dino scan` with no resolvable endpoint) is missing a value, it exits non-zero and prints a JSON envelope on stderr whose `nextAction` is `{ "type": "ask_user", "inputs": [...], "resume": { "type": "run_command", "bin": "dino", "args": [...] } }`. Each input carries `field`, `flag`, `envVar`, `secret`, plus `reason` (why Dino needs it) and `example` (format; for `secret: true`, shape + where to set it, never a value). Ask the human for each input, then re-run `resume.bin` with `resume.args`, appending each collected input by its `flag`. Do not guess values.

Exit codes: `0` clean or below threshold (pass); `2` usage error (fix the flags, read the envelope suggestion); `3` policy failure (findings exceeded the gate); `4` transient (retry later); `5` config error (fix `.dino.yml`); `6` partial (some checks did not complete, NOT a full pass); `70` crash.

The rule that matters most: anything that is not a substantiated pass is not a pass. Dino reports UNTESTED, INCOMPLETE, or partial honestly, so never read a missing, degraded, or partial result as if it passed.

## Documentation

- [Quickstart](https://usedino.dev/docs): Install in one line, then get a deterministic verdict on an API in one command — the agent path to a machine-readable result first, then `dino init` for the terminal.
- [Install](https://usedino.dev/docs/install): One-command install on macOS and Linux (no Node.js where a standalone binary fits), pinned versions, safe installs from CI and AI agents, Homebrew, npm, direct downloads and verification.
- [CI](https://usedino.dev/docs/ci): Run Dino in CI: the GitHub Action (pinned by commit, with `cli-version`), credentials, failing a build on exit codes, partial coverage, keeping the `DinoResult`, breaking changes, and the same pattern for any CI.
- [For AI agents](https://usedino.dev/docs/for-agents): The independent verifier coding agents like Codex, Claude Code, and Cursor call before shipping an API change - a deterministic verdict over the CLI, and agent-led Organization onboarding over the hosted MCP server.
- [Machine contracts](https://usedino.dev/docs/contracts): Dino's machine interfaces — the exit-code contract (0/2/3/4/5/6/70), the versioned `DinoResult` JSON output, and the stderr error envelope.
- [CLI reference](https://usedino.dev/docs/cli-reference): Every `dino` command and flag — scan, watch, docs, diff, lint, changelog, validate, init, schema, skill, config, and the cloud commands — with global options and exit codes.
- [Configuration](https://usedino.dev/docs/configuration): The `.dino.yml` reference — endpoint, protocol, spec URL, and the auth union (none, header, oauth2). Secrets are referenced by env var, never written to the file.

## Full documentation

- [llms-full.txt](https://usedino.dev/llms-full.txt): Complete product documentation in a single file, optimized for LLM context windows.

## Product

- [Home](https://usedino.dev/): Positioning, install command, and overview of the deterministic verification layer.
- [What's New](https://usedino.dev/whats-new): Release notes and thoughts from the team.
- [What's New RSS](https://usedino.dev/whats-new/rss.xml): Machine-readable feed of releases.
- [Open Source](https://usedino.dev/open-source): Dino's open-source posture and the public repositories.
- [Telemetry](https://usedino.dev/telemetry): Exactly what the Dino CLI collects (anonymous), and how to turn it off.

## Packages and source

- [npm package @dino-hq/cli](https://www.npmjs.com/package/@dino-hq/cli): Install coordinates and package metadata.
- [GitHub organization Dino-HQ](https://github.com/Dino-HQ): Source repositories and issues.

## Company

- [Contact](https://usedino.dev/contact): How to reach the team.
- [Privacy](https://usedino.dev/privacy): Data handling, boundaries, and safety posture.
- [Terms](https://usedino.dev/terms): Terms of service.