# Bomly [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/bomly-dev/bomly-cli  
**GitHub Stars:** 14  
**npm Downloads (last month):** 1517  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/bomly

## Description
Give your coding agent the dependency graph it is about to change: scan, diff, explain, audit

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "bomly": {
    "command": "npx",
    "args": ["-y","bomly-mcp"]
  }
}
```

## Documentation

## What Bomly does

The Bomly MCP server connects an MCP-aware coding agent to Bomly’s local dependency-intelligence workflow. It lets an agent work with a normalized dependency graph assembled from project manifests, lockfiles, package-manager output, container layers, or existing SPDX and CycloneDX SBOMs.

The available workflow covers four main questions: what a project depends on, what changed between two references or SBOMs, why a package appears in the graph, and which enriched findings violate policy. Bomly supports native detection for Go, npm, pnpm, Yarn, Maven, Gradle, Python, Composer, Bundler, GitHub Actions, and other project types; Syft provides broader coverage, including container images.

This places the Bomly MCP server in the Developer Tools category for agents that need repository and supply-chain context during coding, pull-request review, upgrade work, or security triage.

## How it works

Run Bomly as a local MCP process with `bomly mcp serve`, or start the equivalent server through `npx -y bomly-mcp`. An MCP-aware client invokes the dependency operations, and Bomly returns structured JSON for the agent to inspect or explain.

The underlying CLI can scan the current directory, another path, a container image, a remote Git reference, or an existing SBOM. Dependency changes can be compared across Git refs or between two SBOM files. Package explanations show how a transitive dependency entered the graph. Interactive terminal exploration is available from the CLI, but the MCP workflow is intended to provide structured results to an agent.

Enrichment is opt-in. With enrichment enabled, Bomly can obtain vulnerability and license information; optional matchers include OSV with the CISA KEV signal and OpenSSF Scorecard. Auditing evaluates available vulnerability and license data against policy, while experimental reachability analysis can help prioritize findings.

## Setup and configuration

Install the Bomly CLI using Homebrew, the Linux or macOS install script, Windows WinGet, or a release package. Verify it with `bomly version`, then register or launch `bomly mcp serve` in the MCP client of your choice. The npm wrapper is an alternative when the CLI is not already installed.

Bomly reads user configuration from `~/.bomly/config.yaml`, an explicitly selected file, `BOMLY_*` environment variables, and command-line flags, in that precedence order. Repository configuration is not loaded automatically; a project configuration must be selected explicitly with `--config` or `BOMLY_CONFIG`.

## Tools and capabilities

The Bomly MCP server supports agent workflows for:

- Scanning source projects, container images, Git refs, and SPDX or CycloneDX SBOMs.
- Comparing dependency state between Git refs or SBOM files.
- Explaining the path by which a package entered a project.
- Enriching packages with vulnerability and license data when requested.
- Auditing findings against policy and producing results suitable for automation.
- Returning structured JSON that agents can summarize or use for reasoning.

Bomly’s CLI can also emit JSON, SARIF, SPDX 2.3, and CycloneDX 1.7, with stable exit codes for automation.

## Limitations and notes

The Bomly MCP server is local and does not require an account, login, hosted service, or telemetry. Bomly does not make outbound matcher calls unless enrichment is requested. Network behavior is documented by the project for auditing.

Reachability analysis is experimental, and an “unreachable” result is not a guarantee that a finding is safe. Enrichment and audit should therefore be enabled deliberately, especially when an agent is being used to make security or CI decisions.

_Full upstream README: https://allmcps.com/mcp/bomly/readme_