Skip to content

@bomly-dev Bomly

All

    Repositories list

    50 repositories

    • bomly-cli

      Public
      Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates.
      mcpdependency-analysisdependency-graph
      mcpdependency-analysisdependency-graphci-cdspdxosvscasarifdevsecopsvulnerability-scanning
      Go
      •
      Apache License 2.0
      •0•11•11•8•Updated Sep 4, 2026Sep 4, 2026

    • bomly-sdk

      Public
      Bomly SDK: the contract module for building Bomly detectors, matchers, auditors, and analyzers
      Go
      •
      Apache License 2.0
      •0•0•11•3•Updated Sep 4, 2026Sep 4, 2026

    • bomly-plugin-syft-detector

      Public
      Syft-backed dependency detector plugin for Bomly (embedded in the CLI; standalone module + managed plugin binary)
      Go
      •
      Apache License 2.0
      •0•0•0•0•Updated Sep 1, 2026Sep 1, 2026

    • bomly-plugin-grype-matcher

      Public
      Grype vulnerability matcher plugin for Bomly (embedded in the CLI; standalone module + managed plugin binary)
      Go
      •
      Apache License 2.0
      •0•0•1•0•Updated Sep 1, 2026Sep 1, 2026

    • bomly-plugin-scorecard-matcher

      Public
      OpenSSF Scorecard matcher plugin for Bomly (embedded in the CLI; standalone module + managed plugin binary)
      Go
      •
      Apache License 2.0
      •0•0•0•0•Updated Sep 1, 2026Sep 1, 2026

    • bomly-plugin-jvmreach-analyzer

      Public
      jvmreach reachability analyzer for Bomly
      Go
      •
      Apache License 2.0
      •0•0•0•0•Updated Sep 1, 2026Sep 1, 2026

    • bomly-plugin-pyreach-analyzer

      Public
      pyreach reachability analyzer for Bomly
      Go
      •
      Apache License 2.0
      •0•0•0•0•Updated Sep 1, 2026Sep 1, 2026

    • bomly-plugin-osv-matcher

      Public
      OSV vulnerability matcher plugin for Bomly (embedded in the CLI; standalone module + managed plugin binary)
      Go
      •
      Apache License 2.0
      •0•0•0•0•Updated Sep 1, 2026Sep 1, 2026

    • bomly-plugin-govulncheck-analyzer

      Public
      govulncheck reachability analyzer for Bomly
      Go
      •
      Apache License 2.0
      •0•0•0•0•Updated Sep 1, 2026Sep 1, 2026

    • bomly-plugin-jsreach-analyzer

      Public
      jsreach reachability analyzer for Bomly
      Go
      •
      Apache License 2.0
      •0•0•0•0•Updated Sep 1, 2026Sep 1, 2026

    • bomly-plugin-depsdev-license-matcher

      Public
      deps.dev license matcher plugin for Bomly (embedded in the CLI; standalone module + managed plugin binary)
      Go
      •
      Apache License 2.0
      •0•0•0•0•Updated Sep 1, 2026Sep 1, 2026

    • scoop-bucket

      Public
      Scoop bucket for Bomly CLI releases
      0•0•0•0•Updated Aug 27, 2026Aug 27, 2026

    • homebrew-tap

      Public
      Homebrew tap for Bomly CLI releases
      Ruby
      •0•0•0•0•Updated Aug 27, 2026Aug 27, 2026

    • winget-pkgs

      Public
      The Microsoft community Windows Package Manager manifest repository
      MIT License
      •9.3k•0•0•0•Updated Aug 27, 2026Aug 27, 2026

    • bomly-plugin-clearlydefined-matcher

      Public
      Go
      •0•0•1•0•Updated Aug 12, 2026Aug 12, 2026

    • bomly-plugin-eol-matcher

      Public
      Go
      •0•0•0•0•Updated Aug 12, 2026Aug 12, 2026

    • bomly-plugin-meme-auditor

      Public
      Go
      •0•0•0•0•Updated Aug 12, 2026Aug 12, 2026

    • bomly-plugin-bun-lock-detector

      Public
      Go
      •0•0•0•0•Updated Aug 12, 2026Aug 12, 2026

    • bomly-plugin-template

      Public template
      Template repository for building Bomly plugins
      Go
      •
      Apache License 2.0
      •0•0•0•0•Updated Aug 11, 2026Aug 11, 2026

    • example-javascript-npm

      Public
      JavaScript
      •0•0•0•2•Updated Aug 1, 2026Aug 1, 2026

    • bomly-guard

      Public
      GitHub Action for reviewing dependency changes and policy findings in pull requests with Bomly CLI.
      dependency-analysisci-cdpull-request
      dependency-analysisci-cdpull-requestspdxosvscasarifdevsecopsvulnerability-scanningcode-scanning
      JavaScript
      •
      Apache License 2.0
      •0•0•0•0•Updated Jul 30, 2026Jul 30, 2026

    • .github

      Public
      Apache License 2.0
      •0•0•0•0•Updated Jul 25, 2026Jul 25, 2026

    • example-javascript-bun

      Public
      Controlled Bun workspace fixture for dependency detector tests
      0•0•0•0•Updated Jul 17, 2026Jul 17, 2026

    • example-java-gradle-multimodule

      Public
      Java
      •0•0•0•1•Updated Jul 17, 2026Jul 17, 2026

    • example-java-maven-multimodule

      Public
      Bomly smoke-test fixture (pinned; do not update dependencies)
      Java
      •0•0•0•1•Updated Jul 17, 2026Jul 17, 2026

    • example-rust-cargo-workspace

      Public
      Bomly smoke-test fixture (pinned; do not update dependencies)
      Rust
      •0•0•0•1•Updated Jul 17, 2026Jul 17, 2026

    • example-javascript-pnpm-workspaces

      Public
      Bomly smoke-test fixture (pinned; do not update dependencies)
      0•0•0•1•Updated Jul 17, 2026Jul 17, 2026

    • example-javascript-npm-workspaces

      Public
      Bomly smoke-test fixture (pinned; do not update dependencies)
      0•0•0•1•Updated Jul 17, 2026Jul 17, 2026

    • bomly-agent-study

      Public
      Reproducible study: AI coding agents remediating known-vulnerable dependencies, with and without a dependency-graph MCP server. Intentionally vulnerable fixture…
      intentionally-vulnerable
      intentionally-vulnerable
      Java
      •
      MIT License
      •0•0•0•0•Updated Jul 15, 2026Jul 15, 2026

    • example-javascript-yarn

      Public
      Bomly QA test repo
      JavaScript
      •0•0•0•1•Updated Jul 8, 2026Jul 8, 2026
    ProTip! When viewing an organization's repositories, you can use the props. filter to filter by custom property.