Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

Bomly CLI

Free#21 of 65 in Software Composition Analysis Software

Bomly CLI: A broad, self-hosted SCA CLI for open-source scanning, SBOMs, policies, and CI workflows. Ranked #21 of 65 in Software Composition Analysis Software by our editors (7.2/10); pricing: Free plan; best for open-source CLI and CI users.

7.2/10Editor score
Visit Bomly
Bomly CLI7.2 Visit Bomly

At a glance

  • Editor score
    7.2 / 10
  • Pricing
    Free plan
  • Best for
    Open-source CLI and CI users
  • Free plan
    Yes
  • Paid from
    Free
  • SBOM generation
    Yes
  • Facts checked
    19 Sep 2026
Bomly CLI screenshot

  • Where it wins

    • Scans source trees, Git repositories, container images, and existing SBOMs
    • Generates SPDX 2.3 and CycloneDX 1.7 SBOMs
    • Supports policy gates, reachability analysis, plugins, and PR review

  • Where it doesn't

    • Self-hosted deployment places operation with the adopting team
    • Reachability analysis covers selected ecosystems rather than every supported format
    • Pull-request review is provided through the separate Bomly Guard action

Our verdict on Bomly CLI

Bomly CLI is an open-source, self-hosted command-line tool for software composition analysis. It is designed for teams that want local or CI-based dependency intelligence across source projects, Git references, container images, and existing SBOMs. Supported platforms include Linux, macOS, and Windows, while supported ecosystems span languages and package managers including C++, Go, JavaScript and TypeScript, Java, Python, Ruby, Rust, Swift, and others.

Its strongest area is breadth. Bomly CLI can generate SBOMs in SPDX 2.3 and CycloneDX 1.7, enrich packages with vulnerability, license, lifecycle, package metadata, and scorecard information, then export results as SARIF, JSON, Markdown, text, SPDX, or CycloneDX. Configurable severity gates and CI exit codes support policy enforcement. Reachability analysis is available for Go, JavaScript/TypeScript, Python, and JVM projects, while dependency explanation and comparison work across Git refs, container images, and SBOMs.

The ecosystem fit is practical for existing delivery pipelines: integrations include GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CircleCI, and MCP-compatible clients. The plugin system extends the tool with external detectors, matchers, and auditors, and the MCP server connects it with AI agents and editor integrations. Pull-request dependency review is handled through Bomly Guard. Bomly CLI suits teams seeking a free, open-source SCA workflow with broad output and integration options. Teams wanting a hosted service rather than self-hosted deployment, or reachability coverage outside the listed ecosystems, should consider a different approach.

Your product? Our editors can test Bomly CLI in depth and publish a review, labelled as paid · from $149/mo →

Bomly CLI pricing

Plans Free planFree Free to use — no paid tier required for the core job.
See plans on bomly.dev

Bomly CLI fact sheet

Free planYes
Paid fromFree
Supported ecosystemsC++, Dart, .NET/NuGet, Elixir, GitHub Actions, Go, Maven, Gradle, npm, pnpm, Yarn, Bun, PHP/Composer, Python/pip/Pipenv/Poetry/uv, Ruby/Bundler, Rust/Cargo, Scala/SBT, Swift/CocoaPods/SwiftPM, plus Syft-backed ecosystems
SBOM generationYes
Reachability analysisYes
Pull request scanningYes
Monitored projectsNot verified
Deployment optionsSelf_hosted
DeploymentDesktop
PlatformsLinux, macOS, Windows
Integrations6 integrations: GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CircleCI, MCP-compatible clients
PricingFree plan
Websitebomly.dev
Facts checked19 Sep 2026

Bomly CLI integrations

Bomly CLI lists 6 integrations on its own site.

  • GitHub Actions
  • GitLab CI
  • Jenkins
  • Azure DevOps
  • CircleCI
  • MCP-compatible clients

Alternatives to Bomly CLI

See all Bomly CLI alternatives →

Used Bomly CLI? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Bomly CLI for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

0 characters · at least 80, up to 3,000

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Featured on iTechGuides — Bomly CLI 7.2/10

Bomly CLI is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/bomly-cli/"><img src="https://www.itechguides.com/best/badge/bomly-cli.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update