Bomly is an open-source command-line tool designed to provide dependency intelligence for modern software projects. It addresses the challenges of understanding, auditing, and managing software dependencies by scanning projects, software bills of materials (SBOMs), and container images. Bomly explains the origin of each dependency and surfaces relevant vulnerability and license data on demand, helping developers and teams take dependencies seriously.
The tool supports scanning source trees, container images (including OCI and Docker), Git references (such as branches, tags, or commits), and existing SBOMs in SPDX or CycloneDX formats. Bomly can generate SBOMs for any project by reading manifests, lock files, container layers, or existing SBOMs, and annotates each package with information such as its source, license, and known vulnerabilities. It features native parsers for major ecosystems including Go, npm, pnpm, yarn, Maven, Gradle, Python (pip, Pipenv, Poetry, uv), Ruby, PHP, NuGet, and Cargo, with Syft integration to support additional ecosystems. The tool resolves transitive dependencies and tags them by scope, such as runtime or development/test.
Bomly offers three primary commands—scan, explain, and diff—providing consistent results across all supported input types. Its interactive mode opens a text user interface (TUI) for manual exploration of the dependency graph, allowing users to search for packages, trace their introduction paths, and navigate findings without generating disk reports. 6. date, with no outbound calls unless explicitly requested. 0, enabling vulnerability findings to appear natively in platforms like GitHub, GitLab, and Azure DevOps, and provides stable exit codes for scripting.
The platform is extensible via plugins, with detectors, matchers, and auditors communicating over a gRPC contract. Bomly is delivered as a single binary, requiring no hosting, and can be run locally, in CI environments, or as an MCP tool for AI agents such as Claude and Cursor. Every CLI flag is available to agents, and results are returned in structured JSON. 0, is free to use, and does not include telemetry.
In the CLI tools & terminal space, Bomly takes a focused approach. Understanding, auditing, and explaining software dependencies and vulnerabilities in projects. It is built as an open-source project for software developers. Bomly is open source under the Apache-2.0 license. It runs on the command line, and it can be self-hosted.
Behind Bomly is Open Source Maintainers, and the product first shipped in 2026. Development happens publicly on GitHub with 281 commits in the last 90 days. PulseGate's similarity index finds few close equivalents — Bomly occupies a relatively distinct niche. Key capabilities include dependency scanning, SBOM analysis, and vulnerability audit. It exposes integrations via an MCP server.
Latest indexed changes and source events
Why Is This Dependency Here? discovered by the PulseGate indexer
Other apps tracked under the same category.
