Integrations

Tools and surfaces that Bomly plugs into. Entries are tagged Official (built and maintained by the Bomly project) or Community (maintained by their own authors — direct support questions to them). To suggest an addition, open a pull request that adds an entry in the same format.

CI / CD

Bomly Guard (Official)

The turnkey GitHub Action: runs bomly diff against a pull request's merge base and reports dependency changes, findings, and an updatable PR comment, with optional SARIF upload to code scanning. → bomly-dev/bomly-guard · Guard guide

Direct CLI recipes (Official)

Drop-in pipeline snippets for GitHub Actions, GitLab CI, Jenkins, Azure DevOps, and CircleCI, plus a pre-commit hook for local enforcement. → CI Integration

AI agents and editors

MCP server (Official)

bomly mcp serve is built into the binary and works with any MCP client that supports stdio transport. Documented host setups: Claude Code, Cursor, VS Code, GitHub Copilot, and Codex. → MCP Server

Agent guidance snippet (Official)

A ready-made instruction block for CLAUDE.md / AGENTS.md / copilot-instructions.md that has coding agents run a dependency diff before committing lockfile changes. → MCP Server → Agent workflows

GitHub code scanning

SARIF 2.1.0 output uploads to the GitHub Security tab (and any other SARIF-aware tool) either via Guard's upload-sarif input or directly from the CLI. → Output Formats → SARIF

Package managers and distribution

Official install channels: Homebrew tap (bomly-dev/tap), WinGet (Bomly.BomlyCLI), Scoop, install scripts (bomly.dev/install.sh), Linux packages, go install, and prebuilt release archives with checksums and SLSA provenance. → Installation

Plugins

External detectors, matchers, and auditors install as managed plugins (versioned, verified, disabled until enabled). Official plugin repositories:

• ClearlyDefined license matcher (Official) — license enrichment from clearlydefined.io. → bomly-plugin-clearlydefined-matcher
• EOL lifecycle matcher (Official) — end-of-life status from endoflife.date. → bomly-plugin-eol-matcher
• Bun lockfile detector (Official, example) — reference implementation for plugin authors. → bomly-plugin-bun-lock-detector
• Meme auditor (Official, example) — a deliberately silly auditor showing the minimal auditor contract. → bomly-plugin-meme-auditor

Write your own: Plugins and the per-role implementation guides.

Marketplace

The Bomly marketplace lists every component that can take part in a scan — detectors, matchers, auditors, and analyzers — filterable by kind and ecosystem. It covers built-in components alongside external plugins, so you can see what already runs before installing anything.

Each entry is labelled by origin, and the label tells you who wrote the code:

• Core — Bomly's own components, shipped in the binary.
• Bundled — third-party engines compiled in, such as Syft and Grype.
• External plugin — installed at runtime from its own repository.

External plugins run as separate processes and stay disabled until you enable them. Read Security and Trust Boundaries for what a plugin can and cannot reach, and Plugins for the install, verify, and enable workflow.

To get a plugin listed, open a submission from the marketplace page. Entries are reviewed and added by hand — there is no automatic index.

Community

No community integrations are listed yet — if you've built one (a CI orb, an IDE extension, a dashboard that reads Bomly JSON), open a pull request adding it here with a one-line description and a link.