Bomly MCP Server

Analyze Your Software DNA. Bomly is a free, open-source CLI for dependency intelligence. It scans source trees, SBOMs, Git refs, and container images; explains why dependencies are present; enriches packages with vulnerability and license data when you ask for it; evaluates policy; and writes automation-friendly output for CI. It runs locally over stdio via the published package.

People connecting DevOps & monitoring tools to Claude, Cursor, VS Code, or another MCP client. The project is written in Go.

VERIFIED ACTIVE

LAST COMMIT 2026-08-24 · ★ 11 · #22 OF 101 MAINTAINED DEVOPS & MONITORING · VERIFIED 2026-08-25

Apache-2.0 · Go servers · how we verify → /methodology

01 · Install Bomly

Claude Code

claude mcp add bomly-dev-bomly-cli -- npx -y bomly-mcp

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "bomly-dev-bomly-cli": {
      "command": "npx",
      "args": [
        "-y",
        "bomly-mcp"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license Apache-2.0 - declared in the repository

npm package bomly-mcp - unscoped; check the name against the project README before installing

registry namespace io.github.bomly-dev is GitHub-verified and matches the repo owner

03 · What Bomly can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

Latest releases

v0.23.0 · 2026-08-13

Module-first plugin authoring guides · adopt bomly-sdk v0.3.0 helper packages · consume external component modules · treat syft-JSON SBOMs as any other unsupported format · --- · Release artifacts · Full builtin bomly…

v0.22.0 · 2026-08-11

make startup logo static by default, animate via BOMLY_LOGO opt-in · modular architecture - consume the SDK as Go module · bump the github-actions-patch group with 3 updates · bump dart-lang/setup-dart from 1.7.2 to…

v0.21.3 · 2026-08-08

npm upgrade needs sudo, and only when actually too old · bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 · --- · Release artifacts · Full builtin bomly archives for Linux, macOS, and Windows. · Alternate…

04 · Who maintains Bomly

Bomly is maintained by bomly-dev. It's the only MCP server we track from this author; the repo dates to Apr 2026.

05 · Facts

repository: github.com/bomly-dev/bomly-cli
website: https://bomly.dev/cli
category: DevOps & monitoring - ranked #22 of 101 actively-maintained DevOps & monitoring servers as of 2026-08-25.
release cadence: 10+ releases in the last 90 days (latest 2026-08-13)
registry: io.github.bomly-dev/bomly-cli (active, first published 2026-07-31 · 4 versions)
packages: npm:bomly-mcp

06 · Bomly FAQ

What is Bomly?

Is Bomly still maintained?

Yes - as of 2026-08-25, its last commit was 2026-08-24 and it shipped 10+ releases in the last 90 days. We re-verify nightly.

How do I install Bomly?

Run `npx -y bomly-mcp`. You can also paste the ready-made client config above.

Does Bomly run locally?

Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Bomly

Alternatives to Bomly

Maintained DevOps & monitoring servers if Bomly isn't the fit.

Pairs well with

Servers that cover what Bomly doesn't - only shown when the pairing reason fits the companion.

More DevOps & monitoring MCP servers · Foxhound · Uptimebolt MCP Server · Transfa · Opik MCP Server · ComparEdge Price Watch

More Go MCP servers · Dryrun · Email (IMAP/SMTP) (boutquin) · Frugal · Herald · Buildkite MCP Server · see all