Bomly CLI

What Bomly CLI is

Bomly CLI is a free, open-source command-line tool for inspecting software dependencies. It scans source trees, SBOMs, Git refs, and container images, then builds dependency graphs that explain why packages appear in a project. Its scan, explain, and diff commands cover dependency analysis and comparisons between changes.

It has native detectors for major ecosystems and Syft-based detectors for the long tail, including the listed C++, Dart, .NET/NuGet, Elixir, Go, JavaScript package managers, PHP/Composer, Python tools, Ruby/Bundler, Rust/Cargo, Scala/SBT, and Swift package managers. Bomly reads and generates SPDX and CycloneDX SBOMs. Optional enrichment requests vulnerability and license data from OSV, CISA KEV, deps.dev, ClearlyDefined, and endoflife.date. Those requests go from the user’s machine directly to public APIs; telemetry and default outbound traffic are absent.

For automated workflows, Bomly can produce SARIF and documents CI recipes for GitHub Actions, GitLab, Jenkins, Azure DevOps, and CircleCI. Its stdio MCP server exposes the core commands to compatible agents such as Claude Code and Cursor. Go binaries can extend detection, matching, auditing, and analysis through its gRPC contract. Reachability analysis is available as a beta feature, with documented tiers varying by ecosystem. Bomly runs locally or in CI on Linux, macOS, and Windows; it requires no account or subscription.

Who it suits

Bomly suits developers who need local or CI dependency analysis, SBOM generation, or pull request scanning across its supported ecosystems. It also fits teams using MCP-aware coding agents or extending analysis through the gRPC contract.

Limits

The free plan has no listed quota or seat limit. Reachability analysis is beta, with different documented analysis tiers for Go and for npm, Python, and JVM.

Getting started

1. Open the Bomly website or its project repository.
2. Choose Linux, macOS, or Windows for local use, or run it in CI.
3. Use the scan command to analyze source trees, SBOMs, Git refs, or container images.
4. Use explain to inspect why packages are present, or diff to compare changes.
5. Optionally enable enrichment or connect its MCP server to a compatible agent.

Verdict

Choose Bomly CLI if you want a free local or CI tool for dependency graphs, SBOM work, or pull request scanning. Teams needing reachability analysis should account for its beta status and ecosystem-specific analysis tiers.