Bomly

Bomly is a free, open-source CLI for software dependency intelligence. It scans projects, SBOMs, and container images, explains where each dependency came from, and surfaces vulnerability and license data on request.

It builds software bills of materials on demand by reading manifests, lock files, container layers, or existing SBOMs. The command set is limited to scan, explain, and diff, and the same answers are returned across different input shapes. Bomly also has an interactive mode that opens a TUI for walking the dependency graph by hand, including fuzzy-finding a package, tracing how it entered a build, and moving through findings without writing a report to disk.

The tool supports source trees, container images in OCI or Docker form, Git refs such as branches, tags, or commits, and SBOMs in SPDX or CycloneDX. Its native parsers cover Go, npm/pnpm/yarn, Maven, Gradle, Python packages managed with pip, Pipenv, Poetry, or uv, Ruby, PHP, NuGet, and Cargo, with Syft filling in additional ecosystems. Bomly can produce SPDX 2.3 and CycloneDX 1.6 JSON, enrich results with OSV, CISA KEV, deps.dev, ClearlyDefined, and endoflife.date, and emit SARIF 2.1.0 for CI systems. It also includes a beta reachability mode that narrows findings to advisories the application actually calls, and it uses stable exit codes for scripting.

Bomly is delivered as a single binary and can run on a laptop, in CI, or as an MCP tool for an AI agent. It is free and released under the Apache 2.0 license, with no telemetry.