Log inSubmit server
Bomly logo

Bomly

Local MCP server for scanning, comparing, explaining, enriching, and auditing software dependencies.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Bomly

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "bomly": {
      "command": "npx",
      "args": [
        "-y",
        "bomly-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

The install command started, but didn't respond the way we expected when we tried to talk to it.

npx -y bomly-mcp

initialize succeeded but no response to tools/list.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked Today.

Overview

The Bomly MCP server gives AI agents structured access to Bomly’s dependency graph for source trees, SBOMs, Git refs, and container images. It runs locally through the Bomly CLI or the bomly-mcp npm wrapper, returning JSON that an agent can summarize or reason over. Use it when an agent needs dependency scans, change comparisons, package provenance, vulnerability and license enrichment, or policy checks.

Use cases

  • Scan a repository before changing dependencies
  • Compare dependency changes between pull-request refs
  • Explain why a transitive package is present
  • Audit enriched findings against CI policy
  • Review dependencies in a container image or SBOM

Key features

  • Dependency graph scanning
  • Git ref and SBOM comparison
  • Transitive dependency explanations
  • Optional vulnerability and license enrichment
  • Policy auditing and experimental reachability analysis
  • Structured JSON results for agents

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 3d ago

Recent health check succeeded.

7/7 checks healthy over the last 40d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 15d ago via OSV.dev · bomly-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars14Stargazers on the source repository.
npm downloads1.5kPackage downloads in the last 30 days.
Last commit3d agoMost recent push to the default branch.
Install checkInconclusiveStarted but did not complete the MCP handshake in our test.
Directory activity1 viewsConfig copies, upvotes, and views on AllMCPs.

How Bomly works

What Bomly does

The Bomly MCP server connects an MCP-aware coding agent to Bomly’s local dependency-intelligence workflow. It lets an agent work with a normalized dependency graph assembled from project manifests, lockfiles, package-manager output, container layers, or existing SPDX and CycloneDX SBOMs.

The available workflow covers four main questions: what a project depends on, what changed between two references or SBOMs, why a package appears in the graph, and which enriched findings violate policy. Bomly supports native detection for Go, npm, pnpm, Yarn, Maven, Gradle, Python, Composer, Bundler, GitHub Actions, and other project types; Syft provides broader coverage, including container images.

This places the Bomly MCP server in the Developer Tools category for agents that need repository and supply-chain context during coding, pull-request review, upgrade work, or security triage.

How it works

Run Bomly as a local MCP process with bomly mcp serve, or start the equivalent server through npx -y bomly-mcp. An MCP-aware client invokes the dependency operations, and Bomly returns structured JSON for the agent to inspect or explain.

The underlying CLI can scan the current directory, another path, a container image, a remote Git reference, or an existing SBOM. Dependency changes can be compared across Git refs or between two SBOM files. Package explanations show how a transitive dependency entered the graph. Interactive terminal exploration is available from the CLI, but the MCP workflow is intended to provide structured results to an agent.

Enrichment is opt-in. With enrichment enabled, Bomly can obtain vulnerability and license information; optional matchers include OSV with the CISA KEV signal and OpenSSF Scorecard. Auditing evaluates available vulnerability and license data against policy, while experimental reachability analysis can help prioritize findings.

Setup and configuration

Install the Bomly CLI using Homebrew, the Linux or macOS install script, Windows WinGet, or a release package. Verify it with bomly version, then register or launch bomly mcp serve in the MCP client of your choice. The npm wrapper is an alternative when the CLI is not already installed.

Bomly reads user configuration from ~/.bomly/config.yaml, an explicitly selected file, BOMLY_* environment variables, and command-line flags, in that precedence order. Repository configuration is not loaded automatically; a project configuration must be selected explicitly with --config or BOMLY_CONFIG.

Tools and capabilities

The Bomly MCP server supports agent workflows for:

  • Scanning source projects, container images, Git refs, and SPDX or CycloneDX SBOMs.
  • Comparing dependency state between Git refs or SBOM files.
  • Explaining the path by which a package entered a project.
  • Enriching packages with vulnerability and license data when requested.
  • Auditing findings against policy and producing results suitable for automation.
  • Returning structured JSON that agents can summarize or use for reasoning.

Bomly’s CLI can also emit JSON, SARIF, SPDX 2.3, and CycloneDX 1.7, with stable exit codes for automation.

Limitations and notes

The Bomly MCP server is local and does not require an account, login, hosted service, or telemetry. Bomly does not make outbound matcher calls unless enrichment is requested. Network behavior is documented by the project for auditing.

Reachability analysis is experimental, and an “unreachable” result is not a guarantee that a finding is safe. Enrichment and audit should therefore be enabled deliberately, especially when an agent is being used to make security or CI decisions.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Bomly

Bomly is an MCP server that connects AI agents to the Bomly CLI’s dependency graph tools. Its main capabilities are scanning source trees, SBOMs, Git refs, and container images; comparing dependency changes; explaining package paths; and optionally enriching or auditing vulnerability and license data. It runs locally through `bomly mcp serve` or `bomly-mcp`.

Install the Bomly CLI and run `bomly mcp serve`, or use `npx -y bomly-mcp` to start the npm wrapper. The CLI is distributed through Homebrew, an install script, Windows WinGet, and GitHub release packages. Confirm a CLI installation with `bomly version`.

Yes, Bomly works with Cursor because the README names Cursor as an MCP-aware client. Configure Cursor to launch the local `bomly mcp serve` process, or use the `bomly-mcp` npm wrapper. The server returns structured JSON for the agent.

Yes, Bomly can audit enriched vulnerability and license data and apply failure thresholds such as high severity. Use enrichment before auditing when data must be fetched, and select SARIF or another supported output for automation. Reachability gating is experimental.

Related MCP servers

All in Developer Tools All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewBomly AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/bomly?style=directory)](https://allmcps.com/mcp/bomly)
HTML Embed
<a href="https://allmcps.com/mcp/bomly"><img src="https://allmcps.com/api/badge/bomly?style=directory" alt="Bomly on AllMCPs" /></a>