bomly-cli
Active·★ 14·Apache-2.0·Updated 2026-10-05
★ Hidden Gem
Bomly is a free, open-source CLI tool for dependency intelligence, designed to scan various sources like source trees, SBOMs, Git refs, and container images. It provides insights into package relationships, enriches them with vulnerability and license data, and evaluates security policies for CI/CD pipelines.
#Dependency Analysis#SBOM#Vulnerability Scanning#CLI Tool#CI/CD Integration#Supply Chain Security#Open Source
01
Features
01Generate comprehensive dependency graphs from diverse sources including source code, container images, and existing SBOMs.
02Enrich package data with real-time vulnerability, license, and scorecard information from public services.
03Evaluate custom security policies against enriched dependency data and enforce gates in CI/CD pipelines.
04Interactively explore dependency graphs in a terminal UI and trace the paths of specific packages.
05Generate machine-readable output in formats like JSON, SARIF, SPDX, and CycloneDX for CI/CD automation and integration.
02
Compatibility
macOS
OS
Verified via docs
Linux
OS
Verified via docs
Windows
OS
Verified via docs
Go
Ecosystem
Verified via docs
Python
Ecosystem
Verified via docs
npm
Ecosystem
Verified via docs
03
Quick start
1
$ curl -fsSL https://bomly.dev/install.sh | sh
04
Use cases
↳Create a complete inventory of software dependencies for any project, container image, or Git repository.
↳Review dependency changes between Git branches or pull requests to identify new or removed packages.
↳Automate security gating in CI/CD pipelines by failing builds on critical vulnerabilities or policy breaches.
↳Assess supply chain risks by auditing transitive dependencies and their associated vulnerabilities and licenses.
↳Serve dependency graph tools as a local MCP server for AI agents to call, enabling structured reasoning.
05
Alternatives
Comments
Log in to leave a comment
No comments yet. Be the first!