On the recordRead 8 Oct 202613 facts
Bomly CLI
Plans and prices
Bomly CLI
Free
Free and open source · runs locally or in CI
Read 8 Oct 2026 · bomly.dev
On the record
- AI agents
- Its stdio MCP server exposes scan, explain, and diff tools for MCP-aware agents including Claude Code and Cursor.bomly.dev · read 8 Oct 2026
- Checksums
- Release archives and packages include SHA256SUMS for checksum verification.bomly.dev · read 8 Oct 2026
- CI integration
- Bomly supports SARIF output for code scanning and documents CI recipes for GitHub Actions, GitLab, Jenkins, Azure DevOps, and CircleCI.bomly.dev · read 8 Oct 2026
- Core commands
- Its core commands are scan, explain, and diff for analyzing dependencies and comparing changes.bomly.dev · read 8 Oct 2026
- Ecosystems
- It has native detectors for major ecosystems and uses Syft-based detectors for the long tail.bomly.dev · read 8 Oct 2026
- Experimental feature
- Reachability analysis is marked beta, with different analysis tiers documented for Go versus npm, Python, and JVM.bomly.dev · read 8 Oct 2026
- Extensibility
- Separate Go binaries can extend detection, matching, auditing, and analysis through Bomly's gRPC contract.bomly.dev · read 8 Oct 2026
- Intended users
- Bomly describes itself as built for developers and the AI agents they work with.bomly.dev · read 8 Oct 2026
- Privacy
- The CLI has no telemetry or default outbound traffic; enrichment calls are opt-in and go directly from the user's machine to public APIs.bomly.dev · read 8 Oct 2026
- Purpose
- Bomly scans source trees, SBOMs, Git refs, and container images to build dependency graphs and explain why packages are present.bomly.dev · read 8 Oct 2026
- SBOM formats
- It reads SPDX and CycloneDX SBOMs and can generate SPDX and CycloneDX output.bomly.dev · read 8 Oct 2026
- Support
- The project directs users to GitHub issues for bugs, discussions for questions and feedback, and its repository security policy for security reports.bomly.dev · read 8 Oct 2026
- Vulnerability enrichment
- Opt-in enrichment queries OSV, CISA KEV, deps.dev, ClearlyDefined, and endoflife.date for vulnerability and license data.bomly.dev · read 8 Oct 2026
