Bomly CLI vs cargo-audit
Bomly CLI
bomly.dev
cargo-audit
rustsec.orgSide by side
| Figure | Bomly CLI | cargo-audit |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | — |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | — |
| Plans published | 1 | 1 |
| Spec score · Software Composition Analysis Software | 8.2 (#11) | 7.9 (#25) |
| CI integration | Bomly supports SARIF output for code scanning and documents CI recipes for GitHub Actions, GitLab, Jenkins, Azure DevOps, and CircleCI. | The README recommends the audit-check GitHub Action for using cargo-audit on GitHub Actions. |
| Purpose | Bomly scans source trees, SBOMs, Git refs, and container images to build dependency graphs and explain why packages are present. | Audits Cargo.lock files for crates with security vulnerabilities reported to the RustSec Advisory Database. |
Plans
In their own words
cargo-audit
cargo-audit has no write-up on Specifiction yet; its figures are above.