Bomly

Name: Bomly
Author: bomly-dev

by bomly-devversion 0.30.1i★ –iRuns on your computer

Registry nameio.github.bomly-dev/bomly-cli

Install

Overview

Description from the maker (original English)

Give your coding agent the dependency graph it is about to change: scan, diff, explain, audit

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Other

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
The registry lists no key to fill in.

You need

npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "bomly-cli": {
      "command": "npx",
      "args": [
        "-y",
        "bomly-mcp"
      ]
    }
  }
}

Run this in your terminal

claude mcp add bomly-cli -- npx -y bomly-mcp

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "bomly-cli": {
      "command": "npx",
      "args": [
        "-y",
        "bomly-mcp"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "bomly-cli": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "bomly-mcp"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 6, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account bomly-dev, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Otheri

More stars than 0% of the other 32461 servers in this category
Published to the registry more recently than 82% of the other 32461 servers in this category
Basic checks equal to or better than 100% of the other 32461 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Bomly safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.30.1) reached the registry 7 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, dotnet-mcp

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago

Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated yesterday

Install

dotnet-mcp

by Skymly

MCP server for .NET symbols, XAML, source generators, and restricted workspace edit

Runs on your computerUpdated today

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

Analyze Your Software DNA.

Bomly is a free, open-source command-line tool for understanding what your software depends on. It is built for developers, security engineers, and CI pipelines. Bomly:

scans source trees, SBOMs, Git refs, and container images into one dependency graph;
explains why a package is present;
adds vulnerability and license data when you ask for it with --enrich;
checks the result against your policy and exits with a code CI can act on;
writes JSON, SARIF, SPDX, and CycloneDX output.

No account, no login, no service to host, no telemetry. One binary. Bomly contacts no vulnerability or license service unless you pass --enrich. Network and privacy lists every network trigger so you can check that claim yourself.

Install

# macOS / Linuxbrew

brew install bomly-dev/tap/bomly

Linux / macOS install script

curl -fsSL https://bomly.dev/install.sh | sh

Windows

winget install Bomly.BomlyCLI

Check the install with bomly version. Installation covers Linux packages, Scoop, go install, the smaller bomly-lite binary that uses your own Syft and Grype, checksums, and uninstalling.

Start with a scan

# Scan the current project

bomly scan

Scan a specific directory

bomly scan --path ./services/api

Scan a container image

bomly scan --image ghcr.io/example/app:latest

Scan a remote Git ref

bomly scan --url https://github.com/owner/repo --ref v1.2.3

Read an existing SPDX or CycloneDX SBOM

bomly scan --sbom --path ./sbom.cdx.json

Bomly reads manifests, lockfiles, package-manager output, container layers, or existing SBOMs and turns them into one dependency graph. Native detectors cover Go, npm, pnpm, Yarn, Maven, Gradle, Python, Composer, Bundler, GitHub Actions, and more. Syft covers the remaining ecosystems and container images. See the Support matrix and Scan targets.

What Bomly can answer

Question	Command	Read more
What do we depend on?	`bomly scan`	Getting started
Which packages have known vulnerabilities, and is there a fix?	`bomly scan --enrich`	Matchers
Should this build fail?	`bomly scan --enrich --audit --fail-on high`	Auditors, Exit codes
Which findings can my code reach? (experimental)	`bomly scan --enrich --audit --analyze --fail-on high --fail-on reachable`	Reachability
Why is this package here?	`bomly explain lodash`	explain
What changed in this PR?	`bomly diff --base main --head HEAD --enrich --audit`	diff
Give me an SBOM	`bomly scan -o spdx=sbom.spdx.json -o cyclonedx=sbom.cdx.json`	SBOM formats
Give me something CI can read	`bomly scan --json`, `--format sarif`	Output formats

Reachability is experimental: "unreachable" is not a guarantee of safety. Use cases has more recipes, and Release assurance lists the checks every release goes through.

Explore interactively

Open the terminal UI when you want to inspect a graph by hand:

bomly scan --interactive

Use it to fuzzy-find packages, inspect versions and scopes, pivot through findings, and see how a dependency entered the graph without writing a report to disk. See Interactive TUI.

Gate pull requests

The Bomly Guard action runs bomly diff against a pull request's merge base and posts the result as a check and a PR comment. Only the packages the PR changed are audited, so existing findings elsewhere never block a PR:

# .github/workflows/bomly.yml

uses: actions/checkout@v5 with: fetch-depth: 0
uses: bomly-dev/bomly-guard@v1 with: fail-on: high

See Bomly Guard. CI integration has recipes for GitLab, Jenkins, Azure DevOps, and CircleCI.

Use Bomly with AI agents

Bomly can run as a local server for the Model Context Protocol (MCP), so an AI coding agent can call the same scan, explain, and diff tools you use on the command line:

bomly mcp serve

If you have not installed the CLI, the bomly-mcp npm wrapper starts the same server:

npx -y bomly-mcp

See MCP server for the Claude Code, Cursor, and VS Code setup and the tool reference.

Configure and extend

Bomly reads settings from ~/.bomly/config.yaml, then from the file named by --config or BOMLY_CONFIG, then from BOMLY_* environment variables, then from flags. Later sources win. A config file inside a repository is never loaded on its own: pass --config .bomly/config.yaml to use one. See the Config reference.

Plugins add detectors, matchers, auditors, and analyzers without forking Bomly:

bomly plugins install github:bomly-dev/bomly-plugin-bun-lock-detector@v0.1.0

bomly plugins enable bomly.examples.detector.bun-lock bomly plugins verify bomly.examples.detector.bun-lock

See Plugins to install and trust plugins, and Plugin authoring to write one.

Documentation

Getting started — install Bomly and run your first scan
Tutorial — from first scan to a CI gate on a real project
Use cases — recipes for PR gates, SBOMs, triage, licenses, and offline scans
FAQ — quick answers on privacy, accounts, and tool differences
Scan targets and Monorepos — what Bomly can scan
Output formats and SBOM formats — text, JSON, SARIF, SPDX, CycloneDX
CI integration and Bomly Guard — pipelines and the GitHub Action
MCP server — connect Bomly to Claude Code, Cursor, VS Code, or another MCP client
Reachability — experimental triage by whether your code can reach a vulnerability
Plugins — external detectors, matchers, auditors, and analyzers
Release notes — what changed in each version
All documentation — the full index

Contributor setup lives in CONTRIBUTING.md. Architecture details live in docs/ARCHITECTURE.md.

Questions and sponsorship

For questions, ideas, and help, use Bomly Discussions. Use this repository's issues for confirmed bugs, regressions, and concrete implementation work.

If Bomly is useful to you, star the repository, share feedback, contribute, or sponsor ongoing maintenance.

License

Bomly CLI is licensed under the Apache License 2.0.

Bomly

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

dotnet-mcp

README from the maker

Install

Linux / macOS install script

Windows

Start with a scan

Scan a specific directory

Scan a container image

Scan a remote Git ref

Read an existing SPDX or CycloneDX SBOM

What Bomly can answer

Explore interactively

Gate pull requests

Use Bomly with AI agents

Configure and extend

Documentation

Questions and sponsorship

License