Start with Getting Started if you're new. Otherwise pick the section that matches what you're doing. The sections below follow the site navigation groups defined in manifest.json, plus links to a few site pages that live outside the versioned docs (such as the FAQ).
Install Bomly and run your first scan.
- Getting Started — first scan, enrich, audit, diff
- Installation — install methods,
bomlyvsbomly-lite, checksum verification, uninstall - Tutorial — from first scan to a CI gate on a real project, with representative output from the workflow
- Use Cases — recipes for PR gates, SBOMs, triage, license and offline scans
- Scan Targets — directories, Git repos, containers, SBOMs
- Output Formats — text, JSON, SARIF, SBOM
- SBOM Formats — SPDX vs. CycloneDX, write and ingest
- FAQ — quick answers on privacy, accounts, tool differences, and first-scan surprises (source:
faq.json)
What Bomly does, and why each piece exists.
- Commands — per-command reference for scan, explain, and diff
- Detectors — turning project evidence into a dependency graph
- Matchers — enriching the graph with vulnerability, license, lifecycle data
- Auditors — evaluating the graph against policy
- Plugins — install, trust, configure, and package external plugins
- Plugin implementation guides: detector, matcher, auditor
- Example plugin repos: Bun detector, ClearlyDefined matcher, EOL lifecycle matcher, Meme auditor
- MCP Server — connect Bomly to Claude Code, Cursor, VS Code, or another MCP client
- Bomly Guard — the turnkey GitHub Action for PR dependency review
Running Bomly in CI and keeping pipelines healthy.
- Integrations — CI actions, AI agents, code scanning, install channels, plugins, and the marketplace
- CI Integration — GitHub Actions, GitLab, Jenkins, Azure, CircleCI
- CI-Readiness Warnings — package-manager, lockfile-format, and install-policy mismatches that fail CI on their own
- Finding Baselines — keep accepted package findings visible without failing audits
- Troubleshooting — common errors and fixes
Specifications, matrices, and design deep dives. The generated pages are regenerated from code by make generate — treat those as authoritative.
- Support Matrix — every ecosystem and package manager
- Config Reference — every config key, env var, default, flag
- Exit Codes — what each process exit value means
- Interactive TUI — keybindings and tabs for
--interactive - JSON Schemas — scan, explain, diff output shapes
- Detector Reference — per-ecosystem detector pages, plus Syft fallback for everything else
- Matcher Reference — per-matcher behavior, cache, output
- Auditor Reference — per-auditor options, examples, limitations
- Architecture — the scan pipeline, domain model, and network behavior
- Network and Privacy — every network trigger, what it transmits, and how to stay offline
- Security and Trust Boundaries — permissions, network behavior, plugins, input limits, and residual risks
- Reproducible Evidence — public inputs, commands, results, and limitations behind important behavior claims
- Glossary — every term, one sentence each
Features that are still maturing.
- Reachability — narrowing findings to code your app actually calls
- Release Notes — what changed in each version
- Contributing — repository layout, docs conventions, release process