Bomly CLI
Bomly CLI scans source trees, SBOMs, Git refs, and container images to build dependency graphs and explain why packages are present.
What Bomly CLI is
Bomly CLI scans source trees, SBOMs, Git refs, and container images to build dependency graphs and explain why packages are present. Its scan, explain, and diff commands analyze dependencies and compare changes. The free, open-source tool runs locally or in CI on Linux, macOS, and Windows, with no account or subscription required. It reads and generates SPDX and CycloneDX SBOMs, using native detectors for major ecosystems and Syft-based detectors for broader coverage. Optional enrichment queries OSV, CISA KEV, deps.dev, ClearlyDefined, and endoflife.date for vulnerability and license information; those requests go directly from the user's machine to public APIs. Bomly has no telemetry or default outbound traffic. It can output SARIF and documents CI recipes for GitHub Actions, GitLab, Jenkins, Azure DevOps, and CircleCI. Its stdio MCP server exposes scan, explain, and diff tools to compatible agents including Claude Code and Cursor. Separate Go binaries can extend detection, matching, auditing, and analysis through its gRPC contract. Reachability analysis is marked beta, with different analysis tiers for Go versus npm, Python, and JVM.
Good
- Free and open source
- Reads and generates SPDX and CycloneDX
- No telemetry or default outbound traffic
- Supports several documented CI recipes
Watch out
- Reachability analysis is marked beta
- Enrichment requires opt-in public API calls
- Analysis tiers differ by ecosystem
Who it suits
Bomly CLI suits developers who want local or CI dependency analysis, SBOM generation, and pull request scanning. Its MCP server may also suit people working with MCP-aware coding agents.
Verdict
Bomly CLI brings dependency explanation, SBOM handling, and CI-oriented outputs to a free local tool. Note that reachability analysis is beta and its documented tiers vary across ecosystems.
Plans and prices
From Bomly CLI's own pricing page, checked 8 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Bomly CLI | Free | Free and open source · runs locally or in CI · Free; no account or subscription required |
The facts
Each one read from Bomly CLI's own pages, with the date it was checked.
What it does
- AI agents
- Its stdio MCP server exposes scan, explain, and diff tools for MCP-aware agents including Claude Code and Cursor.checked 8 Oct 2026
- Checksums
- Release archives and packages include SHA256SUMS for checksum verification.checked 8 Oct 2026
- CI integration
- Bomly supports SARIF output for code scanning and documents CI recipes for GitHub Actions, GitLab, Jenkins, Azure DevOps, and CircleCI.checked 8 Oct 2026
- Core commands
- Its core commands are scan, explain, and diff for analyzing dependencies and comparing changes.checked 8 Oct 2026
- Ecosystems
- It has native detectors for major ecosystems and uses Syft-based detectors for the long tail.checked 8 Oct 2026
- Experimental feature
- Reachability analysis is marked beta, with different analysis tiers documented for Go versus npm, Python, and JVM.checked 8 Oct 2026
- Extensibility
- Separate Go binaries can extend detection, matching, auditing, and analysis through Bomly's gRPC contract.checked 8 Oct 2026
- Intended users
- Bomly describes itself as built for developers and the AI agents they work with.checked 8 Oct 2026
- Privacy
- The CLI has no telemetry or default outbound traffic; enrichment calls are opt-in and go directly from the user's machine to public APIs.checked 8 Oct 2026
- Purpose
- Bomly scans source trees, SBOMs, Git refs, and container images to build dependency graphs and explain why packages are present.checked 8 Oct 2026
- SBOM formats
- It reads SPDX and CycloneDX SBOMs and can generate SPDX and CycloneDX output.checked 8 Oct 2026
- Support
- The project directs users to GitHub issues for bugs, discussions for questions and feedback, and its repository security policy for security reports.checked 8 Oct 2026
- Vulnerability enrichment
- Opt-in enrichment queries OSV, CISA KEV, deps.dev, ClearlyDefined, and endoflife.date for vulnerability and license data.checked 8 Oct 2026
Alternatives to Bomly CLI
- 1
DeepFilterNet
Free planOpen sourceAPILinuxmacOSSelf-hosted7.6Free plan - 2
Endor Labs
Free planWebAPIExtensionLinux7.4Free plan - 3
Grype
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.4Free plan - 4
Scantist
Free planWebAPISelf-hosted7.3$200 one-time - 5
Snyk Open Source
Free planWebAPILinuxmacOS7.3From $25 a month - 6
Socket
Free planWebAPIExtensionLinux7.2From $25 a month