Skip to content
SPECIFICTION
Get listed

Bomly CLI

bomly.dev

Free plan WindowsmacOSLinuxAPI
Visit bomly.dev
Spec score 8.2 #11 of 65 in Software Composition Analysis Software

Spec sheet

Purpose
Bomly scans source trees, SBOMs, Git refs, and container images to build dependency graphs and explain why packages are present.Read 8 Oct 2026 · bomly.dev
Intended users
Bomly describes itself as built for developers and the AI agents they work with.Read 8 Oct 2026 · bomly.dev
Privacy
The CLI has no telemetry or default outbound traffic; enrichment calls are opt-in and go directly from the user's machine to public APIs.Read 8 Oct 2026 · bomly.dev
Support
The project directs users to GitHub issues for bugs, discussions for questions and feedback, and its repository security policy for security reports.Read 8 Oct 2026 · bomly.dev
AI agents
Its stdio MCP server exposes scan, explain, and diff tools for MCP-aware agents including Claude Code and Cursor.Read 8 Oct 2026 · bomly.dev
Checksums
Release archives and packages include SHA256SUMS for checksum verification.Read 8 Oct 2026 · bomly.dev
CI integration
Bomly supports SARIF output for code scanning and documents CI recipes for GitHub Actions, GitLab, Jenkins, Azure DevOps, and CircleCI.Read 8 Oct 2026 · bomly.dev
Core commands
Its core commands are scan, explain, and diff for analyzing dependencies and comparing changes.Read 8 Oct 2026 · bomly.dev
Ecosystems
It has native detectors for major ecosystems and uses Syft-based detectors for the long tail.Read 8 Oct 2026 · bomly.dev
Experimental feature
Reachability analysis is marked beta, with different analysis tiers documented for Go versus npm, Python, and JVM.Read 8 Oct 2026 · bomly.dev
Extensibility
Separate Go binaries can extend detection, matching, auditing, and analysis through Bomly's gRPC contract.Read 8 Oct 2026 · bomly.dev
SBOM formats
It reads SPDX and CycloneDX SBOMs and can generate SPDX and CycloneDX output.Read 8 Oct 2026 · bomly.dev
Vulnerability enrichment
Opt-in enrichment queries OSV, CISA KEV, deps.dev, ClearlyDefined, and endoflife.date for vulnerability and license data.Read 8 Oct 2026 · bomly.dev

Plans and prices

Bomly CLI Free Free; no account or subscription required Free and open source · runs locally or in CI Read 8 Oct 2026 · bomly.dev

Every Bomly CLI plan and price →

Where Specifiction places it

Alternatives to Bomly CLIAll alternatives →