Bomly MCP Server

Analyze Your Software DNA. Bomly is a free, open-source CLI for dependency intelligence. It scans source trees, SBOMs, Git refs, and container images; explains why dependencies are present; enriches packages with vulnerability and license data when you ask for it; evaluates policy; and writes automation-friendly output for CI. It runs locally over stdio via the published package.

People who work with dependency graph, license compliance and supply chain security and want it reachable from Claude, Cursor, VS Code, or another MCP client. The project is written in Go.

VERIFIED ACTIVE

LAST COMMIT 2026-09-17 · ★ 12 · #23 OF 120 MAINTAINED DEVOPS & MONITORING · VERIFIED 2026-09-18

Apache-2.0 · Go servers · how we verify → /methodology

01 · Install Bomly

Claude Code

claude mcp add bomly-dev-bomly-cli -- npx -y bomly-mcp

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "bomly-dev-bomly-cli": {
      "command": "npx",
      "args": [
        "-y",
        "bomly-mcp"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license Apache-2.0 - declared in the repository

npm package bomly-mcp - unscoped; check the name against the project README before installing

registry namespace io.github.bomly-dev is GitHub-verified and matches the repo owner

03 · What Bomly can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

Latest releases

v0.26.0 · 2026-09-17

bump github.com/containerd/containerd/v2 from 2.3.3 to 2.3.5 · adopt bomly-sdk v0.13.0's package split · --- · Release artifacts · Full builtin bomly archives for Linux, macOS, and Windows. · Alternate bomly-lite…

v0.25.0 · 2026-09-16

plan the SDK maturity program (ADR-0036 through ADR-0039) · require Go 1.27 · ADR-0041 - identity is the canonical PURL on typed graph nodes · ADR-0041 clarifications recorded at implementation · adopt the typed graph…

v0.24.2 · 2026-08-27

resolve code scanning alerts 228/229 by removing the source_ref input · validate license emission, complete the primary component · --- · Release artifacts · Full builtin bomly archives for Linux, macOS, and Windows.…

04 · Who maintains Bomly

Bomly is maintained by bomly-dev. It's the only MCP server we track from this author; the repo dates to Apr 2026.

05 · Facts

repository: github.com/bomly-dev/bomly-cli
website: https://bomly.dev/cli
category: DevOps & monitoring - ranked #23 of 120 actively-maintained DevOps & monitoring servers as of 2026-09-18.
release cadence: 10+ releases in the last 90 days (latest 2026-09-17)
registry: io.github.bomly-dev/bomly-cli (active, first published 2026-07-31 · 9 versions)
packages: npm:bomly-mcp

06 · Bomly FAQ

What is Bomly?

Is Bomly still maintained?

Yes - as of 2026-09-18, its last commit was 2026-09-17 and it shipped 10+ releases in the last 90 days. We re-verify nightly.

How do I install Bomly?

Run `npx -y bomly-mcp`. You can also paste the ready-made client config above.

Does Bomly run locally?

Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Bomly

Alternatives to Bomly

Maintained DevOps & monitoring servers if Bomly isn't the fit.

Pairs well with

Servers that cover what Bomly doesn't - only shown when the pairing reason fits the companion.

More DevOps & monitoring MCP servers · Uptimebolt MCP Server · Portkey Admin MCP · Transfa · Opik MCP Server · ComparEdge Price Watch

More Go MCP servers · Dryrun · Email (IMAP/SMTP) (boutquin) · Frugal · Buildkite MCP Server · Factcheck · see all