Bomly
About
Give your coding agent the dependency graph it is about to change: scan a source tree, SBOM, Git ref, or container image; explain why a package is present; diff two graphs; check findings against policy.
Details
- Author
- bomly-dev
- Categories
- Developer Tools, Security, Infrastructure
Jump to
Setup
Install Bomly in your MCP client (Claude Desktop, Cursor, Windsurf, and others).
Repository: https://github.com/bomly-dev/bomly-cli
Follow the installation instructions in the repository README, then restart your MCP client.
Bomly is a free, open-source CLI for dependency intelligence. It scans source trees, SBOMs, Git refs, and container images; explains why dependencies are present; enriches packages with vulnerability and license data when you ask for it; evaluates policy; and writes automation-friendly output for CI.
Free and open source, no account, no login. One binary. No service to host. No telemetry. No outbound matcher calls unless you opt in with--enrich.Network and Privacydocuments every network trigger so you can audit that claim instead of taking it on faith.
# macOS / Linuxbrew brew install bomly-dev/tap/bomly # Linux / macOS install script curl -fsSL https://bomly.dev/install.sh | sh # Windows winget install Bomly.BomlyCLI
Prebuilt archives and Linux packages are published fromGitHub Releases. Releases includebomly(full binary with builtin Syft and Grype) andbomly-lite(smaller binary that shells out to externalsyftandgrype).
For Linux packages, Scoop, Go install, checksums, pinned versions, upgrades, and uninstall instructions, seeInstallation.
# Scan the current project bomly scan # Scan a specific directory bomly scan --path ./services/api # Scan a container image bomly scan --image ghcr.io/example/app:latest # Scan a remote Git ref bomly scan --url https://github.com/owner/repo --ref v1.2.3 # Read an existing SPDX or CycloneDX SBOM bomly scan --sbom --path ./sbom.cdx.json
Bomly reads manifests, lockfiles, package-manager output, container layers, or existing SBOMs and turns them into one dependency graph. Native detectors cover Go, npm, pnpm, Yarn, Maven, Gradle, Python, Composer, Bundler, GitHub Actions, SBOM ingest, and more. Syft fills the long tail, including container images. See theSupport MatrixandScan Targets.
For more recipes, seeGetting StartedandUse Cases. To review the public inputs, commands, expected results, and limitations behind important behavior claims, seeReproducible Evidence.
Open the terminal UI when you want to inspect a graph by hand:
Use it to fuzzy-find packages, inspect versions and scopes, pivot through findings, and see how a dependency entered the graph without writing a report to disk. SeeInteractive TUI.
By default, Bomly does not call vulnerability, license, lifecycle, or scorecard services. Add--enrichwhen you want external package intelligence:
# Fetch vulnerability and license data bomly scan --enrich # Evaluate policy against enriched package data bomly scan --enrich --audit --fail-on high # Add experimental reachability analysis bomly scan --enrich --audit --analyze --fail-on high --fail-on reachable
Built-in enrichment uses public services such as OSV, CISA KEV, deps.dev, and OpenSSF Scorecard.--auditevaluates the vulnerability and license data already present on packages; use--enrich --auditwhen you want to fetch and evaluate in one run.
Reachability is experimental. It is useful for triage, but "unreachable" is not a guarantee of safety. ReadReachabilitybefore using--fail-on reachableas a CI gate.
Useexplainwhen a transitive package shows up and you need the path:
bomly explain requests bomly explain lodash --path ./web
Usediffwhen you need to review dependency changes across Git refs or SBOMs:
# Compare Git refs bomly diff --base main --head HEAD # Compare two SBOM files bomly diff --sbom --base ./old.spdx.json --head ./new.spdx.json
SeeGetting Startedfor the first-run walkthrough andUse Casesfor PR review, upgrade review, and incident triage recipes.
Bomly can write human-readable text, JSON, SARIF, SPDX 2.3, and CycloneDX 1.7:
# Structured JSON for automation bomly scan --json # SARIF for security tabs and code-scanning integrations bomly scan --enrich --audit --fail-on high --format sarif # Write SBOM artifacts (add --format text to also print the report) bomly scan -o spdx=sbom.spdx.json -o cyclonedx=sbom.cdx.json # Emit one SBOM to stdout bomly scan --format cyclonedx
Exit codes are stable for scripts:0for clean results,2for policy violations, and separate values for usage, runtime, and no-supported-project failures. SeeOutput Formats,SBOM Formats, andExit Codes.
To gate pull requests, use theBomly Guard actionor call the CLI directly from your workflow:
# .github/workflows/bomly.yml - uses: actions/checkout@v5 with: fetch-depth: 0 - uses: bomly-dev/bomly-guard@v1 with: fail-on: high
Bomly can run as a local MCP server so AI agents can call the same dependency graph tools you use on the command line:
If you have not installed the CLI, thebomly-mcpnpm wrapper starts the same server:
Add Bomly to an MCP-aware agent such as Claude Code, Cursor, VS Code, or a custom tool, and the agent receives structured JSON it can summarize or reason over. SeeMCP Serverfor setup recipes and the tool reference.
Bomly reads configuration from your user config, an explicitly selected config file,BOMLY_environment variables, and CLI flags, with later sources taking precedence:
- ~/.bomly/config.yaml
- --config <path>orBOMLY_CONFIG
- BOMLY_environment variables
- CLI flags
Repository config files are never loaded automatically. A project may keep its shared configuration at.bomly/config.yaml, but you must trust it explicitly with--config .bomly/config.yamlorBOMLY_CONFIG. See the generatedConfig Reference.
Managed plugins let you add detectors, matchers, and auditors without forking Bomly:
bomly plugins install github:bomly-dev/bomly-plugin-bun-lock-detector@v0.1.0 bomly plugins enable bomly.examples.detector.bun-lock bomly plugins verify bomly.examples.detector.bun-lock
SeePluginsfor install, trust, and authoring guidance.
- Getting Started- install Bomly and run your first scan
- Tutorial- from first scan to a CI gate on a real project
- FAQ- quick answers on privacy, accounts, and tool differences
- Installation- install methods, checksums, upgrades, uninstall
- Use Cases- practical recipes for PR gates, SBOMs, triage, and offline scans
- Scan Targets- directories, Git repos, containers, and SBOMs
- Output Formats- text, JSON, SARIF, SPDX, CycloneDX
- SBOM Formats- SPDX 2.3 and CycloneDX 1.7, ingest, and conversion recipes
- CI Integration- GitHub Actions, GitLab, Jenkins, Azure, CircleCI
- Bomly Guard- turnkey GitHub Action for PR dependency review
- MCP Server- connect Bomly to Claude Code, Cursor, VS Code, or another MCP client
- Reachability- experimental reachable-vulnerability triage
- Plugins- managed external detectors, matchers, and auditors
- Release Notes- what changed in each version
- All Documentation- full docs index
Contributor setup lives inCONTRIBUTING.md. Architecture details live indocs/ARCHITECTURE.md.
For questions, ideas, and general support, please useBomly Discussions.
Use this repository's issues only for confirmed bugs, regressions, or actionable implementation work.
Bomly is an open-source project. If you find it useful, you can support the project by starring the repository, sharing feedback, opening issues, contributing improvements, or sponsoring ongoing maintenance.
Bomly CLI is licensed under theApache License 2.0.
This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.
Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.
Enable AI agents to secure code with Semgrep.
An engineering governance and safety control plane for AI coding agents to enforce strict SDLC discipline, quality gates, and security branch protections.
AI-powered security scanning. Scans code, files, and git diffs for vulnerabilities in real-time using the Armis scanning API.
MCP server that vets LLM-emitted shell commands BEFORE execution. 30 detection rules across destructive file ops, package managers, system, database, git, network, exfiltration, privilege escalation. Sub-second, local, free.
BoostSecurity MCP acts as a safeguard preventing agents from adding vulnerable packages into projects. It analyzes every package an AI agent introduces, flags unsafe dependencies, and recommends secure, maintained alternatives to keep projects protected.
A secure MCP server for executing controlled command-line operations with comprehensive security features.
Access the Codacy API to analyze code quality, coverage, and security for your repositories.
Execute pre-approved shell commands securely on a server.
A secure MCP server for executing terminal commands with controlled directory access and command permissions.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
