Interactive TUI

bomly scan --interactive opens a terminal UI for browsing scan results. Use it when the text report is too dense, or when you want to search and filter the results live. This page lists the tabs and keys.

bomly scan --enrich --audit --interactive

Requirements:

• a real terminal on both stdin and stderr. Bomly refuses to start the TUI when either is piped;
• a terminal with TrueColor support, for the best rendering.

--interactive forces --format text. It cannot be combined with --json, --format json, --format sarif, or an SBOM written to stdout (-o spdx without =<path>). SBOMs written to files still work alongside the TUI.

Tabs

Switch with the number keys or Tab (Shift+Tab goes backwards in terminals that support it):

The Components tree follows the project layout:

• manifests at the scan root sit directly under the project node;
• a subproject node holds the manifests of a nested directory found by --recursive;
• a module node holds a workspace or reactor member (an npm or pnpm workspace package, a Cargo workspace member, a Maven reactor module) that resolves under one root manifest.

A single-root scan keeps a plain project-to-manifests tree. Group nodes expand and collapse like any other row, and their details pane shows the directory, ecosystems, and manifest counts. Monorepos explains the terms.

Navigation

Search

Search matches the package name, version, ecosystem, vulnerability ID, and license expression.

Filters

Press a filter key, then pick a value from the popup. Press the same key again to clear that filter.

You can combine filters with each other and with a search. The header shows the active set.

Quit

The prompt prevents accidental exits. Press y to confirm, or any other key to stay.

Fix suggestions

When enrichment found fix information, select a package in the Components view. Its details pane shows a Remediation suggestion section below Vulnerabilities, with one of four fix states: Complete fix available, Partial fix available, No fix available, or Fix availability unknown. The section may also show a recommended version, suggested actions, and package-manager advice. A suggestion changes nothing on disk. Check compatibility and run your tests before you apply an upgrade.

Tips

• Run with --enrich to see vulnerability details, and add --audit to see policy findings.
• Search (/) narrows a large monorepo quickly: /api shows only packages with api in the name.
• Combine the severity filter (v) with the Findings tab to triage the most severe items first.

Limitations

• The TUI does not produce JSON or SARIF. Re-run without --interactive for machine-readable output.
• A plugin matcher that prints progress to stderr can corrupt the display. Debug plugins in a non-interactive run.
• SSH sessions work, and so do tmux and screen, including detaching and reattaching.