Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

Bomly CLI review

Free#21 of 65 in Software Composition Analysis Software

A broad, self-hosted SCA CLI for open-source scanning, SBOMs, policies, and CI workflows.

7.2/10Editor score
Visit Bomly
Bomly CLI7.2 Visit Bomly

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Bomly CLI is an open-source, self-hosted command-line tool for software composition analysis. It is designed for teams that want local or CI-based dependency intelligence across source projects, Git references, container images, and existing SBOMs. Supported platforms include Linux, macOS, and Windows, while supported ecosystems span languages and package managers including C++, Go, JavaScript and TypeScript, Java, Python, Ruby, Rust, Swift, and others.

Its strongest area is breadth. Bomly CLI can generate SBOMs in SPDX 2.3 and CycloneDX 1.7, enrich packages with vulnerability, license, lifecycle, package metadata, and scorecard information, then export results as SARIF, JSON, Markdown, text, SPDX, or CycloneDX. Configurable severity gates and CI exit codes support policy enforcement. Reachability analysis is available for Go, JavaScript/TypeScript, Python, and JVM projects, while dependency explanation and comparison work across Git refs, container images, and SBOMs.

The ecosystem fit is practical for existing delivery pipelines: integrations include GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CircleCI, and MCP-compatible clients. The plugin system extends the tool with external detectors, matchers, and auditors, and the MCP server connects it with AI agents and editor integrations. Pull-request dependency review is handled through Bomly Guard. Bomly CLI suits teams seeking a free, open-source SCA workflow with broad output and integration options. Teams wanting a hosted service rather than self-hosted deployment, or reachability coverage outside the listed ecosystems, should consider a different approach.

Bomly CLI pros and cons

  • Where it wins
    • Scans source trees, Git repositories, container images, and existing SBOMs
    • Generates SPDX 2.3 and CycloneDX 1.7 SBOMs
    • Supports policy gates, reachability analysis, plugins, and PR review
  • Where it doesn't
    • Self-hosted deployment places operation with the adopting team
    • Reachability analysis covers selected ecosystems rather than every supported format
    • Pull-request review is provided through the separate Bomly Guard action

Bomly CLI fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update