Install

There is nothing to wire into your project: no plugin to register, no ESLint config to extend. The analysis is a single static binary: about 7 MB on disk and under 2 MB to download, with every language built in.

npx

npx bonsai-lint src/

Installs nothing permanently and needs no Node runtime for the analysis itself; Node only launches the binary. This is the cheapest way to try it, and a perfectly reasonable way to run it in CI.

npm

npm install -D bonsai-lint

Pins a version in the project. The package fetches the prebuilt binary for your platform on install; nothing is compiled.

PyPI

pip install bonsai-lint           # or: uv tool install bonsai-lint, pipx install bonsai-lint
uvx bonsai-lint src/              # run it without installing anything

Each wheel holds the release’s own binary, with no Python code around it: macOS on Apple silicon and Intel, Linux on x86_64 and arm64 (glibc 2.17 or newer, or musl), and Windows on x64. There is no source distribution, so any other platform gets pip’s “no matching distribution”. That includes an ARM64 Python on Windows, where an x64 Python works under emulation, and so does cargo install bonsai-lint.

Composer

composer require --dev bonsai-lint/bonsai-lint
vendor/bin/bonsai-lint src/

Pins a version in the project and needs PHP 7.4 or newer. The first run fetches the prebuilt binary for your platform.

Homebrew

brew install ryckakas/tap/bonsai-lint

macOS and Linux. It lives in a personal tap because homebrew-core does not accept prebuilt binaries.

Go

go install bonsai.kauneckas.dev/bonsai-lint@latest

Or pin it in a Go module with go get -tool bonsai.kauneckas.dev/bonsai-lint@latest and run it as go tool bonsai-lint (Go 1.24+). The module is a small launcher with no dependencies. The first run of each version downloads that release’s binary, checks it against a checksum recorded in the module, and caches it.

Cargo

cargo install bonsai-lint

Builds from source. Needs a Rust toolchain; everything else here does not.

Script

curl -LsSf https://github.com/ryckakas/bonsai-lint/releases/latest/download/bonsai-lint-installer.sh | sh

Downloads the release binary directly. There is a PowerShell equivalent for Windows.

Linux has two builds. One links glibc 2.35 or newer. The other is static and runs on any Linux, which covers Alpine and other musl systems as well as older glibc. The installer script, the npm package and the Go module each pick the right one for you. The PyPI wheels and the Composer package always use the static one.

There is no Maven or Gradle plugin yet. On a Java project, use Homebrew, the installer script or npx bonsai-lint.

As a pre-commit hook

From v0.4.2, the repository is also a pre-commit hook:

repos:
  - repo: https://github.com/ryckakas/bonsai-lint
    rev: v0.4.2
    hooks:
      - id: bonsai-lint
        # args: [--over, "10"]

pre-commit installs the matching wheel from PyPI itself and runs the hook on the staged files it can score. The hook judges each file exactly as bonsai-lint run from the repository root does, so a bonsai-lint.toml below the root counts only when the root config declares it as a domain. A commit touching only files it skips, such as generated code, passes. pre-commit autoupdate moves rev to the latest release.

What you did not have to do

Worth stating plainly, because it is the main practical difference from the alternatives:

• No language runtime. Scanning TypeScript needs no tsc and no node_modules; scanning PHP needs no PHP, and the Composer package uses PHP only to start the binary. The parsers are compiled in.
• No plugin versions to keep in step. It is not an ESLint plugin or a PHPStan extension, so there is no compatibility matrix between it and anything else.
• Your code is never executed. Analysis is syntax-only: no autoloader, no reflection, no module resolution. That is why it is safe to point at third-party or untrusted source.

Next: your first run.