# Bomly

> Bomly is a free, open-source dependency intelligence CLI. It scans software projects, SBOMs, and container images across 30+ package ecosystems to discover dependencies, explain packages, audit vulnerabilities, and generate SBOMs. AI agents can drive Bomly over Model Context Protocol (MCP).

Bomly is built for developers and security engineers who need to understand, audit, and manage software dependencies. Network enrichment is opt-in via `--enrich`; scans run offline by default.

## Key capabilities

- Scan local directories, Git repositories, container images, and existing SBOM files
- Support for 30+ ecosystems: Go, npm, PyPI, RubyGems, Rust (Cargo), Maven, Gradle, NuGet, Hex, Composer, and more
- Generate SBOMs in CycloneDX 1.6 and SPDX 2.3 formats
- Audit dependencies against vulnerability databases
- Explain individual packages with context and provenance
- Output in text, JSON, SARIF, and SBOM artifact formats
- Serve analysis tools to AI agents over MCP (`bomly mcp serve`)
- Plugin system for extending detectors, matchers, and auditors

## Documentation

- [Getting Started](https://bomly.dev/docs/getting-started): First scan, enrich, audit, diff — all in five minutes
- [Installation](https://bomly.dev/docs/installation): Install methods, bomly vs bomly-lite, upgrade, uninstall
- [Scan targets](https://bomly.dev/docs/scan-targets): Local directories, Git repos, container images, and existing SBOMs
- [Output formats](https://bomly.dev/docs/output-formats): Text, JSON, SARIF, and SBOM artifacts
- [SBOM formats](https://bomly.dev/docs/sbom): SPDX 2.3 vs CycloneDX 1.6 comparison and conversion
- [Architecture](https://bomly.dev/docs/architecture): How the scan pipeline works: targets, detectors, matchers, auditors
- [Detectors](https://bomly.dev/docs/detectors): How Bomly discovers projects and builds a dependency graph
- [Matchers](https://bomly.dev/docs/matchers): How packages are matched to known vulnerabilities
- [Auditors](https://bomly.dev/docs/auditors): Vulnerability and license audit sources
- [Config reference](https://bomly.dev/docs/config-reference): All configuration options
- [CI integration](https://bomly.dev/docs/ci-integration): Running Bomly in GitHub Actions, GitLab CI, and similar
- [Plugins](https://bomly.dev/docs/plugins): Extending Bomly with custom detectors, matchers, and auditors
- [Use cases](https://bomly.dev/docs/use-cases): PR gates, SBOM workflows, license scans, offline scans
- [Support matrix](https://bomly.dev/docs/support-matrix): Full ecosystem and format coverage table
- [Exit codes](https://bomly.dev/docs/exit-codes): Machine-readable exit codes for scripting
- [Glossary](https://bomly.dev/docs/glossary): Key terms defined

## Links

- [Homepage](https://bomly.dev)
- [CLI source](https://github.com/bomly-dev/bomly-cli)
- [Releases](https://github.com/bomly-dev/bomly-cli/releases)
- [Documentation](https://bomly.dev/docs)
- [Blog](https://bomly.dev/blog)