Open Source
Verify, don't trust.
Dino's CLI, verification engine, and scan attestation system are public. Every scan result is cryptographically signed and independently verifiable. You don't have to take our word for it.
The CLI
The full Dino CLI is public on GitHub. Six packages: core engine, agents, plugins, reasoning, analytics, and the CLI itself. Read the code. Run it locally. Contribute.
github.com/Dino-HQ/dino →Verification Engine
The dino verifycommand lets you verify any scan result offline. Check the signature, confirm the digest, validate the signing identity. No access to Dino's systems required.
Attestation System
Every scan produces a Sigstore-signed, in-toto attestation in a DSSE envelope. Keyless signing tied to verifiable OIDC identities. Tamper-evident by design.
Every scan is cryptographically signed.
When a Dino runner finishes a scan, it signs the result and produces an attestation: a signed statement that binds the exact scan output to the runner that produced it and the time it was produced.
The cloud doesn't take the digest on faith. It recomputes the SHA-256 digestover the actual result and compares it to the digest inside the signed attestation. If they don't match, the submission is rejected.
A result that has been altered cannot be accepted with a valid attestation.
Standing on the shoulders
of open standards.
Dino doesn't invent its own trust model. We use the same supply-chain security standards trusted by npm, PyPI, Kubernetes, and the Linux Foundation.
What's in the box.
| Package | Description |
|---|---|
| @dino-hq/cli | Command-line interface |
| @dino-hq/core | Types, config, severity model, tenant isolation |
| @dino-hq/agents | Agent tools: fuzzer, RBAC, rate limits, error codes, deprecation, response validation |
| @dino-hq/plugins | Protocol plugins: GraphQL discovery, REST |
| @dino-hq/analytics | Event tracking adapter |
| @dino-hq/reasoning | AI reasoning layer (optional) |
Install: npm install -g @dino-hq/cli
Dino's CLI is source-available under a proprietary license. You can read, run, and verify the code. Commercial use requires a Dino subscription. See the LICENSE file on GitHub.
What you can prove.
Provenance
Which runner produced a result, and under what identity.
Integrity
The result has not been altered since it was signed.
Time
A signed record of when the scan was produced.
Independence
Anyone can verify a scan offline using open-source tooling.