Documentation

Bomly docs

These pages are synced from the bomly-cli repository. If this is your first time, start with Getting started.

Last updated October 25, 2026bomly-cli v0.30.0 release notes

Getting started

Install Bomly and run your first scan.

Getting started

First scan, enrich, audit, diff — all in five minutes.

Installation

Install methods, `bomly` vs `bomly-lite`, checksum verification, upgrade, uninstall.

Tutorial

From first scan to a CI gate on a real project, with representative output from the workflow.

Use cases

Recipes for PR gates, SBOMs, triage, and license and offline scans.

Scan targets

Local directories, Git repositories, container images, and existing SBOMs.

Monorepos

Recursive discovery, nested subprojects, and workspace modules in one scan.

Output formats

Text, JSON, SARIF, and SBOM artifacts — when to use each and how to combine them.

SBOM formats

Write, read, convert, and compare SPDX 2.3 and CycloneDX 1.7 SBOMs.

How it works

What Bomly does, and why each piece exists.

Commands

Per-command reference for scan, explain, and diff, plus the shared option surface.

Detectors

How Bomly discovers projects and turns evidence into a dependency graph.

Matchers

How Bomly enriches packages with vulnerability, license, and lifecycle data.

Auditors

How Bomly turns vulnerability data into actionable findings.

Plugins

Install, enable, verify, and build external detectors, matchers, auditors, and analyzers.

MCP server

Connect Bomly's dependency graph tools to Claude Code, Cursor, VS Code, or another MCP client.

Bomly Guard

The turnkey GitHub Action that gates pull requests on dependency changes via `bomly diff`.

Operations

Running Bomly in CI and keeping pipelines healthy.

Integrations

CI actions, AI agents, code scanning, install channels, and plugins Bomly connects to.

CI integration

Drop-in recipes for GitHub Actions, GitLab, Jenkins, Azure DevOps, and CircleCI.

CI-readiness warnings

Spot package-manager, lockfile-format, and install-policy mismatches that fail CI regardless of findings.

Finding baselines

Keep accepted package findings visible without failing audits.

Troubleshooting

Common errors and how to fix them, organized by exit code and symptom.

Reference

Specifications, matrices, and design deep dives.

Support matrix

Every ecosystem and package manager Bomly can identify today.

Config reference

All config keys, environment variables, and defaults.

Exit codes

Process exit values and what each one means for scripts and CI.

Interactive TUI

Keybindings, tabs, and filters for the --interactive terminal UI.

JSON schemas

Per-command JSON output schema references for scan, explain, and diff.

Architecture

How the scan pipeline is structured: targets, detectors, matchers, auditors.

Network and privacy

Every network trigger, what it contacts and transmits, and how to keep a run offline.

Security and trust boundaries

Permissions, network behavior, plugins, input limits, and residual risks.

Release assurance

The checks every release goes through, what they prove, and where to read the results.

SBOM field reference

How every SBOM field is written, read, and converted between SPDX and CycloneDX.

Glossary

Every Bomly term, one sentence each.

Experimental

Features that are still maturing.

Reachability

beta

Check whether your code can reach a vulnerable package. Experimental.