# Bomly MCP server

> Lets an AI agent scan source trees, SBOMs, and container images to analyze dependency graphs, explain package origins, and audit vulnerabilities.

- Repository: https://github.com/bomly-dev/bomly-cli
- Page: https://hostedmcp.org/servers/bomly-dev/bomly-cli
- Transport: stdio
- Stars: 14
- License: Apache-2.0
- Latest version: 0.30.1

## Install

### Claude Code

```sh
claude mcp add bomly-cli -- npx -y bomly-mcp
```

### Cursor (`~/.cursor/mcp.json`)

```json
{
  "mcpServers": {
    "bomly-cli": {
      "command": "npx",
      "args": [
        "-y",
        "bomly-mcp"
      ]
    }
  }
}
```

### VS Code (`.vscode/mcp.json`)

```json
{
  "servers": {
    "bomly-cli": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "bomly-mcp"
      ]
    }
  }
}
```

### VS Code CLI

```sh
code --add-mcp '{"name":"bomly-cli","type":"stdio","command":"npx","args":["-y","bomly-mcp"]}'
```

### Claude Desktop (`claude_desktop_config.json`)

```json
{
  "mcpServers": {
    "bomly-cli": {
      "command": "npx",
      "args": [
        "-y",
        "bomly-mcp"
      ]
    }
  }
}
```

### Codex

```sh
codex mcp add bomly-cli -- npx -y bomly-mcp
```

### Codex config.toml (`~/.codex/config.toml`)

```toml
[mcp_servers.bomly-cli]
command = "npx"
args = ["-y", "bomly-mcp"]
```

### Gemini CLI

```sh
gemini mcp add -s user bomly-cli npx -- -y bomly-mcp
```

### Gemini settings.json (`~/.gemini/settings.json`)

```json
{
  "mcpServers": {
    "bomly-cli": {
      "command": "npx",
      "args": [
        "-y",
        "bomly-mcp"
      ]
    }
  }
}
```

## FAQ

### Does Bomly require an account or login?

No, Bomly requires no account, no login, and has no service to host.

### Can Bomly be used with AI agents?

Yes, Bomly can run as a local server for the Model Context Protocol (MCP), allowing AI coding agents to use its scan, explain, and diff tools.

### What kind of outputs does Bomly support?

Bomly can write output in JSON, SARIF, SPDX, and CycloneDX formats.

### Does Bomly contact external services for vulnerability data?

It only contacts vulnerability or license services if you explicitly pass the --enrich flag.