AgentIndex icon
AgentIndex
ToolsCategoriesTrendingNewCompareGuides
Submit Tool
ToolsCategoriesTrendingNewCompareGuides
Home/
Dev Tooling/
bomly-cli
bomly-cli logo

bomly-cli

Active·★ 14·Apache-2.0·Updated 2026-10-05
★ Hidden Gem

Bomly is a free, open-source CLI tool for dependency intelligence, designed to scan various sources like source trees, SBOMs, Git refs, and container images. It provides insights into package relationships, enriches them with vulnerability and license data, and evaluates security policies for CI/CD pipelines.

#Dependency Analysis#SBOM#Vulnerability Scanning#CLI Tool#CI/CD Integration
© 2026 AgentIndex.app|Built by a 10-year iOS Developer.
Best by use caseAboutContactAdvertisePrivacy PolicyTerms of UseQYSGitHubBuy me a coffee ☕

Browse by Category

Code AssistantWorkflow AutomationRAG / Knowledge BaseMulti-AgentBrowser AutomationLLM InfraDev ToolingObservability

Not affiliated with Anthropic, OpenAI or Microsoft.

#Supply Chain Security
#Open Source
$ Install
$ curl -fsSL https://bomly.dev/install.sh | sh
↗ Visit site★ GitHub
01

Features

01Generate comprehensive dependency graphs from diverse sources including source code, container images, and existing SBOMs.
02Enrich package data with real-time vulnerability, license, and scorecard information from public services.
03Evaluate custom security policies against enriched dependency data and enforce gates in CI/CD pipelines.
04Interactively explore dependency graphs in a terminal UI and trace the paths of specific packages.
05Generate machine-readable output in formats like JSON, SARIF, SPDX, and CycloneDX for CI/CD automation and integration.
02

Compatibility

macOS
OS
Verified via docs
Linux
OS
Verified via docs
Windows
OS
Verified via docs
Go
Ecosystem
Verified via docs
Python
Ecosystem
Verified via docs
npm
Ecosystem
Verified via docs
03

Quick start

1
$ curl -fsSL https://bomly.dev/install.sh | sh
04

Use cases

↳Create a complete inventory of software dependencies for any project, container image, or Git repository.
↳Review dependency changes between Git branches or pull requests to identify new or removed packages.
↳Automate security gating in CI/CD pipelines by failing builds on critical vulnerabilities or policy breaches.
↳Assess supply chain risks by auditing transitive dependencies and their associated vulnerabilities and licenses.
↳Serve dependency graph tools as a local MCP server for AI agents to call, enabling structured reasoning.
05

Alternatives

CopilotKit logo
CopilotKit★ 38.0k
React UI + elegant infrastructure for AI Copilots, AI chatbots, and in-app AI agents. The Agentic Frontend.
1Panel logo
1Panel★ 37.2k
🔥 1Panel provides an intuitive web interface and MCP Server to manage websites, files, containers, databases, and LLMs on a Linux server.
Scrapling logo
Scrapling★ 87.3k
🕷️ An adaptive Web Scraping framework that handles everything from a single request to a full-scale crawl!

Comments

Log in to leave a comment

No comments yet. Be the first!

On this page
01Features02Compatibility03Quick start04Use cases05Alternatives
Stats
GitHub Stars★ 14
Last commit
Activepieces logo
Activepieces★ 25.0k
Open source alternative to Zapier. AI Agents & MCPs & AI Workflow Automation.
OpenMetadata logo
OpenMetadata★ 15.5k
OpenMetadata is a unified metadata platform for data discovery, data observability, and data governance powered by a central metadata repository, in-depth column level lineage, and seamless team collaboration.
nanobrowser logo
nanobrowser★ 14.1k
Open-Source Chrome extension for AI-powered web automation. Run multi-agent workflows using your own LLM API key. Alternative to OpenAI Operator.
gptme logo
gptme★ 4.4k
Your agent in your terminal, equipped with local tools: writes code, uses the terminal, browses the web, vision.
openstatus logo
openstatus★ 9.2k
🫖 Status page with uptime monitoring & API monitoring as code 🫖
See all alternatives →
1w ago
StatusActive
LicenseApache-2.0
CategoryDev Tooling
Trend (30d)
+0.5↑ 1.3%
Links
Documentation↗Discussion↗Issues↗Releases↗

Deploy on DigitalOcean — Get $200 Free Credit

Ad