Documentation
Bomly docs
These pages are synced from the bomly-cli repository. If this is your first time, start with Getting started.
Last updated July 30, 2026bomly-cli v0.21.1 release notes
Getting started
Install Bomly and run your first scan.
Getting started
First scan, enrich, audit, diff — all in five minutes.
Installation
Install methods, `bomly` vs `bomly-lite`, checksum verification, upgrade, uninstall.
Tutorial
From first scan to a CI gate on a real project, with representative output from the workflow.
Use cases
Recipes for PR gates, SBOMs, triage, and license and offline scans.
Scan targets
Local directories, Git repositories, container images, and existing SBOMs.
Output formats
Text, JSON, SARIF, and SBOM artifacts — when to use each and how to combine them.
SBOM formats
SPDX 2.3 vs. CycloneDX 1.7, when to pick which, ingest and conversion recipes.
How it works
What Bomly does, and why each piece exists.
Commands
Per-command reference for scan, explain, and diff, plus the shared option surface.
Detectors
How Bomly discovers projects and turns evidence into a dependency graph.
Matchers
How Bomly enriches packages with vulnerability, license, and lifecycle data.
Auditors
How Bomly turns vulnerability data into actionable findings.
Plugins
Install, enable, verify, and build external detectors, matchers, and auditors.
MCP server
Connect Bomly's dependency graph tools to Claude Code, Cursor, VS Code, or another MCP client.
Bomly Guard
The turnkey GitHub Action that gates pull requests on dependency changes via `bomly diff`.
Operations
Running Bomly in CI and keeping pipelines healthy.
Integrations
CI actions, AI agents, code scanning, install channels, and plugins Bomly connects to.
CI integration
Drop-in recipes for GitHub Actions, GitLab, Jenkins, Azure DevOps, and CircleCI.
CI-readiness warnings
Spot package-manager, lockfile-format, and install-policy mismatches that fail CI regardless of findings.
Finding baselines
Keep accepted package findings visible without failing audits.
Troubleshooting
Common errors and how to fix them, organized by exit code and symptom.
Reference
Specifications, matrices, and design deep dives.
Glossary
Every Bomly term, one sentence each.
Support matrix
Every ecosystem and package manager Bomly can identify today.
Config reference
All config keys, environment variables, and defaults.
Exit codes
Process exit values and what each one means for scripts and CI.
Interactive TUI
Keybindings, tabs, and filters for the --interactive terminal UI.
JSON schemas
Per-command JSON output schema references for scan, explain, and diff.
Architecture
How the scan pipeline is structured: targets, detectors, matchers, auditors.
Network and privacy
Every network trigger, what it contacts and transmits, and how to keep a run offline.
Security and trust boundaries
Permissions, network behavior, plugins, input limits, and residual risks.
Reproducible evidence
Public inputs, commands, results, and limitations behind important behavior claims.
Experimental
Features that are still maturing.