# Bomly

Supplies AI coding agents with local dependency graphs to inspect package trees, run security audits, and verify changes.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 14
- Author: bomly-dev
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/bomly-dev/bomly-cli
- Updated: 2026-10-21
- HTML: https://affpapa.org/en/nevibecode/mcp/bomly

## What it does

Bomly converts lockfiles, container layers, and software bills of materials into a single dependency structure. Acting as an MCP server, it exposes operations like `scan`, `explain`, and `diff` directly to the coding agent. Native parsers handle Go and npm packages on your machine.

Privacy is built into the workflow. The utility runs locally without accounts or background telemetry. It avoids external network lookups for vulnerability or license records unless you pass the `--enrich` flag. Output formats include CycloneDX, SPDX, SARIF, and plain JSON.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add bomly-cli -- npx -y bomly-mcp
```

### Codex

**Platform CLI**
```bash
codex mcp add bomly -- npx -y bomly-mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "bomly": {
            "command": "npx",
            "args": [
                "-y",
                "bomly-mcp"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "bomly": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "bomly-mcp"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add bomly npx -y bomly-mcp
```

## When to use it
- inspect why an indirect dependency exists in the build
- audit project dependencies for vulnerabilities before merging
- compare dependency changes between two Git revisions
- produce an SBOM in SPDX or CycloneDX format

## Example prompts
- Run Bomly to explain why lodash is in our dependency tree
- Scan our project with `--enrich` and report any high-severity findings
- Diff dependency changes against the main branch using Bomly

## Similar
- [analyzing-sbom-for-supply-chain-vulnerabilities](https://affpapa.org/en/nevibecode/skills/analyzing-sbom-for-supply-chain-vulnerabilities.md) — skill · 444 installs
- [agent-bom](https://affpapa.org/en/nevibecode/mcp/agent-bom.md) — MCP server · ★ 35
- [EchelonGraph CVE & Exposure](https://affpapa.org/en/nevibecode/mcp/echelongraph-cve-exposure.md) — MCP server · ★ 8
- [security-dependencies](https://affpapa.org/en/nevibecode/commands/security-dependencies.md) — command · ★ 41823
- [agentic-security-scanner](https://affpapa.org/en/nevibecode/skills/agentic-security-scanner.md) — skill · 462 installs
- [vulnerability-scanner](https://affpapa.org/en/nevibecode/skills/vulnerability-scanner.md) — skill · 1300 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md