Bomly — Claude Code MCP server: what it does, how to install
Supplies AI coding agents with local dependency graphs to inspect package trees, run security audits, and verify changes.
claude mcp add bomly-cli -- npx -y bomly-mcpWhat Bomly does
Bomly converts lockfiles, container layers, and software bills of materials into a single dependency structure. Acting as an MCP server, it exposes operations like scan, explain, and diff directly to the coding agent. Native parsers handle Go and npm packages on your machine.
Privacy is built into the workflow. The utility runs locally without accounts or background telemetry. It avoids external network lookups for vulnerability or license records unless you pass the --enrich flag. Output formats include CycloneDX, SPDX, SARIF, and plain JSON.
What it helps with
- inspect why an indirect dependency exists in the build
- audit project dependencies for vulnerabilities before merging
- compare dependency changes between two Git revisions
- produce an SBOM in SPDX or CycloneDX format
Example prompts for the agent
- Run Bomly to explain why lodash is in our dependency tree
- Scan our project with
--enrichand report any high-severity findings - Diff dependency changes against the main branch using Bomly
How to install Bomly
Platform CLI
claude mcp add bomly-cli -- npx -y bomly-mcpPlatform CLI
codex mcp add bomly -- npx -y bomly-mcpConfig file
{
"mcpServers": {
"bomly": {
"command": "npx",
"args": [
"-y",
"bomly-mcp"
]
}
}
}Config file
{
"servers": {
"bomly": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"bomly-mcp"
]
}
}
}Platform CLI
gemini mcp add bomly npx -y bomly-mcpStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Bomly
How to install Bomly in Claude Code?
Run claude mcp add bomly -- npx -y bomly-mcp in your terminal.
What does Bomly do?
It provides inspection tools that let your agent evaluate dependency trees, track package diffs, and generate SBOM data.
Does Bomly require an internet connection?
Local graph parsing works completely offline. Network traffic only occurs when fetching advisory or license records with the --enrich parameter.
