{ "markdown": "

\n \"Bomly\n

\n\n

\n Analyze Your Software DNA.\n

\n\n

\n \"CI\"\n \"OpenSSF\n \"Latest\n \"GitHub\n \"License:\n \"Go\n

\n\nBomly is a free, open-source CLI for dependency intelligence. It scans source trees, SBOMs, Git refs, and container images; explains why dependencies are present; enriches packages with vulnerability and license data when you ask for it; evaluates policy; and writes automation-friendly output for CI.\n\nFree and open source, no account, no login. One binary. No service to host. No telemetry. No outbound matcher calls unless you opt in with `--enrich`. [Network and Privacy](docs/NETWORK.md) documents every network trigger so you can audit that claim instead of taking it on faith.\n\n## Install Bomly\n\n```bash\n# macOS / Linuxbrew\nbrew install bomly-dev/tap/bomly\n\n# Linux / macOS install script\ncurl -fsSL https://bomly.dev/install.sh | sh\n\n# Windows\nwinget install Bomly.BomlyCLI\n```\n\nPrebuilt archives and Linux packages are published from [GitHub Releases](https://github.com/bomly-dev/bomly-cli/releases). Releases include `bomly` (full binary with builtin Syft and Grype) and `bomly-lite` (smaller binary that shells out to external `syft` and `grype`).\n\nVerify the install:\n\n```bash\nbomly version\n```\n\nFor Linux packages, Scoop, Go install, checksums, pinned versions, upgrades, and uninstall instructions, see [Installation](docs/INSTALLATION.md).\n\n## Start With a Scan\n\n```bash\n# Scan the current project\nbomly scan\n\n# Scan a specific directory\nbomly scan --path ./services/api\n\n# Scan a container image\nbomly scan --image ghcr.io/example/app:latest\n\n# Scan a remote Git ref\nbomly scan --url https://github.com/owner/repo --ref v1.2.3\n\n# Read an existing SPDX or CycloneDX SBOM\nbomly scan --sbom --path ./sbom.cdx.json\n```\n\nBomly reads manifests, lockfiles, package-manager output, container layers, or existing SBOMs and turns them into one dependency graph. Native detectors cover Go, npm, pnpm, Yarn, Maven, Gradle, Python, Composer, Bundler, GitHub Actions, SBOM ingest, and more. Syft fills the long tail, including container images. See the [Support Matrix](docs/SUPPORT_MATRIX.md) and [Scan Targets](docs/SCAN_TARGETS.md).\n\n

\n \"Bomly\n

\n\n## What Bomly Can Answer\n\n| Question | Command |\n| --- | --- |\n| What do we depend on? | `bomly scan` |\n| What changed in this PR or branch? | `bomly diff --base main --head HEAD` |\n| Why is this package here? | `bomly explain lodash` |\n| Which findings matter to policy? | `bomly scan --enrich --audit --fail-on high` |\n| Can CI fail on high-severity findings? | `bomly scan --enrich --audit --fail-on high --format sarif` |\n| Can I triage reachable findings first? | `bomly scan --enrich --audit --analyze --fail-on high --fail-on reachable` |\n\nFor more recipes, see [Getting Started](docs/GETTING_STARTED.md) and\n[Use Cases](docs/USE_CASES.md). To review the public inputs, commands, expected\nresults, and limitations behind important behavior claims, see\n[Reproducible Evidence](docs/EVIDENCE.md).\n\n## Explore Interactively\n\nOpen the terminal UI when you want to inspect a graph by hand:\n\n```bash\nbomly scan --interactive\n```\n\nUse it to fuzzy-find packages, inspect versions and scopes, pivot through findings, and see how a dependency entered the graph without writing a report to disk. See [Interactive TUI](docs/TUI.md).\n\n

\n \"Bomly\n

\n\n## Enrich and Audit\n\nBy default, Bomly does not call vulnerability, license, lifecycle, or scorecard services. Add `--enrich` when you want external package intelligence:\n\n```bash\n# Fetch vulnerability and license data\nbomly scan --enrich\n\n# Evaluate policy against enriched package data\nbomly scan --enrich --audit --fail-on high\n\n# Add experimental reachability analysis\nbomly scan --enrich --audit --analyze --fail-on high --fail-on reachable\n```\n\nBuilt-in enrichment uses public services such as OSV, CISA KEV, deps.dev, and OpenSSF Scorecard. `--audit` evaluates the vulnerability and license data already present on packages; use `--enrich --audit` when you want to fetch and evaluate in one run.\n\nReachability is experimental. It is useful for triage, but \"unreachable\" is not a guarantee of safety. Read [Reachability](docs/REACHABILITY.md) before using `--fail-on reachable` as a CI gate.\n\n## Explain and Diff\n\nUse `explain` when a transitive package shows up and you need the path:\n\n```bash\nbomly explain requests\nbomly explain lodash --path ./web\n```\n\nUse `diff` when you need to review dependency changes across Git refs or SBOMs:\n\n```bash\n# Compare Git refs\nbomly diff --base main --head HEAD\n\n# Compare two SBOM files\nbomly diff --sbom --base ./old.spdx.json --head ./new.spdx.json\n```\n\nSee [Getting Started](docs/GETTING_STARTED.md) for the first-run walkthrough and [Use Cases](docs/USE_CASES.md) for PR review, upgrade review, and incident triage recipes.\n\n## Generate Output for CI\n\nBomly can write human-readable text, JSON, SARIF, SPDX 2.3, and CycloneDX 1.7:\n\n```bash\n# Structured JSON for automation\nbomly scan --json\n\n# SARIF for security tabs and code-scanning integrations\nbomly scan --enrich --audit --fail-on high --format sarif\n\n# Write SBOM artifacts (add --format text to also print the report)\nbomly scan -o spdx=sbom.spdx.json -o cyclonedx=sbom.cdx.json\n\n# Emit one SBOM to stdout\nbomly scan --format cyclonedx\n```\n\nExit codes are stable for scripts: `0` for clean results, `2` for policy violations, and separate values for usage, runtime, and no-supported-project failures. See [Output Formats](docs/OUTPUT_FORMATS.md), [SBOM Formats](docs/SBOM.md), and [Exit Codes](docs/EXIT_CODES.md).\n\nTo gate pull requests, use the [Bomly Guard action](https://github.com/bomly-dev/bomly-guard) or call the CLI directly from your workflow:\n\n```yaml\n# .github/workflows/bomly.yml\n- uses: actions/checkout@v5\n with:\n fetch-depth: 0\n- uses: bomly-dev/bomly-guard@v1\n with:\n fail-on: high\n```\n\nSee [Bomly Guard](docs/BOMLY_GUARD.md) and [CI Integration](docs/CI_INTEGRATION.md).\n\n

\n \"GitHub\n

\n\n## Use Bomly With AI Agents\n\nBomly can run as a local MCP server so AI agents can call the same dependency graph tools you use on the command line:\n\n```bash\nbomly mcp serve\n```\n\nIf you have not installed the CLI, the `bomly-mcp` npm wrapper starts the same server:\n\n```bash\nnpx -y bomly-mcp\n```\n\nAdd Bomly to an MCP-aware agent such as Claude Code, Cursor, VS Code, or a custom tool, and the agent receives structured JSON it can summarize or reason over. See [MCP Server](docs/MCP.md) for setup recipes and the tool reference.\n\n## Configure and Extend\n\nBomly reads configuration from your user config, an explicitly selected\nconfig file, `BOMLY_*` environment variables, and CLI flags, with later\nsources taking precedence:\n\n1. `~/.bomly/config.yaml`\n2. `--config ` or `BOMLY_CONFIG`\n3. `BOMLY_*` environment variables\n4. CLI flags\n\nRepository config files are never loaded automatically. A project may keep\nits shared configuration at `.bomly/config.yaml`, but you must trust it\nexplicitly with `--config .bomly/config.yaml` or `BOMLY_CONFIG`. See the\ngenerated [Config Reference](docs/CONFIG_REFERENCE.md).\n\nManaged plugins let you add detectors, matchers, and auditors without forking Bomly:\n\n```bash\nbomly plugins install github:bomly-dev/bomly-plugin-bun-lock-detector@v0.1.0\nbomly plugins enable bomly.examples.detector.bun-lock\nbomly plugins verify bomly.examples.detector.bun-lock\n```\n\nSee [Plugins](docs/PLUGINS.md) for install, trust, and authoring guidance.\n\n## Documentation\n\n- [Getting Started](docs/GETTING_STARTED.md) - install Bomly and run your first scan\n- [Tutorial](docs/TUTORIAL.md) - from first scan to a CI gate on a real project\n- [FAQ](https://bomly.dev/faq) - quick answers on privacy, accounts, and tool differences\n- [Installation](docs/INSTALLATION.md) - install methods, checksums, upgrades, uninstall\n- [Use Cases](docs/USE_CASES.md) - practical recipes for PR gates, SBOMs, triage, and offline scans\n- [Scan Targets](docs/SCAN_TARGETS.md) - directories, Git repos, containers, and SBOMs\n- [Output Formats](docs/OUTPUT_FORMATS.md) - text, JSON, SARIF, SPDX, CycloneDX\n- [SBOM Formats](docs/SBOM.md) - SPDX 2.3 and CycloneDX 1.7, ingest, and conversion recipes\n- [CI Integration](docs/CI_INTEGRATION.md) - GitHub Actions, GitLab, Jenkins, Azure, CircleCI\n- [Bomly Guard](docs/BOMLY_GUARD.md) - turnkey GitHub Action for PR dependency review\n- [MCP Server](docs/MCP.md) - connect Bomly to Claude Code, Cursor, VS Code, or another MCP client\n- [Reachability](docs/REACHABILITY.md) - experimental reachable-vulnerability triage\n- [Plugins](docs/PLUGINS.md) - managed external detectors, matchers, and auditors\n- [Release Notes](https://github.com/bomly-dev/bomly-cli/releases) - what changed in each version\n- [All Documentation](docs/README.md) - full docs index\n\nContributor setup lives in [CONTRIBUTING.md](CONTRIBUTING.md). Architecture details live in [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md).\n\n## Questions\n\nFor questions, ideas, and general support, please use [Bomly Discussions](https://github.com/orgs/bomly-dev/discussions).\n\nUse this repository's issues only for confirmed bugs, regressions, or actionable implementation work.\n\n## Support\n\nBomly is an open-source project. If you find it useful, you can support the project by starring the repository, sharing feedback, opening issues, contributing improvements, or sponsoring ongoing maintenance.\n\nSee [Support Bomly](https://bomly.dev/support).\n\n## License\n\nBomly CLI is licensed under the [Apache License 2.0](LICENSE).\n", "bytes": 11041, "sha": "237b6edabebc92f9103329bc8c26bbf98784cb3032d34a7524b84821822e41c1", "repo_slug": "bomly-dev/bomly-cli", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/mcp_io_github_bomly_dev_bomly_cli_7757f338/readme" }