What your agent can ask
The server exposes four tools. Results come back as JSON the agent can reason over — the same answers the CLI gives you.
bomly_scan
Scan a path, container image, Git URL, or SBOM and get the resolved dependency graph.
bomly_explain
Dependency paths, advisories, and fix context for one package — why it is present and how to fix it.
bomly_diff
Compare dependency state across refs or SBOMs and list what a change adds, removes, or bumps.
bomly_plugins
List the detector, matcher, and auditor plugins registered in your installation.
Every CLI flag — scope filters, output formats, audit policy, opt-in --enrich enrichment — is reachable from the agent.
From install to a checked commit
Four steps. The first three are setup you do once per machine and repo; the fourth is what your agent does on every dependency change.
brew install bomly-dev/tap/bomlyThe MCP server is built into the same binary, and prebuilt binaries with checksums are on the install section.
Does dependency context change what agents catch?
We had two leading coding agents remediate the known-vulnerable dependencies of a large open-source project, with and without Bomly's MCP server connected. Read the case study or reproduce it from the companion repo.
Completeness
98–100%
every run with Bomly MCP connected1
without the server, runs ranged 14–100%
Efficiency
1.7×
faster to full remediation2
runs went from 13 min without the server to 7.5 min with it
Hallucinations
50% fewer
wrong fix claims3
runs with a wrong claim fell from 4 of 5 to 2 of 5
1 Share of the project's fixable advisories resolved, across ten MCP-connected runs by two leading agents on a large multi-module Maven project.
2 One of the two agents, average wall-clock across five runs (13 min → 7.5 min). The other agent's time was unchanged — it spent the savings finishing more completely instead.
3 For the agent that made the most wrong claims: runs containing a hallucinated or wrongly-declined fix fell from 4 of 5 (9 packages) to 2 of 5 (4 packages) with the server connected.
All numbers are “in our setup” results from the study — full methodology, limitations, raw transcripts, and scoring code in the companion repo.