Skip to content

Add bomly-dev/bomly-cli under Dependency intelligence #88

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bomly-guy wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add bomly-dev/bomly-cli under Dependency intelligence #88

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ Using this lens we can identify a large group of "subjects" (dependencies), dist

* [picatz/deputy: Comprehensive dependency management tool for secure dependency lifecycle management covering vulnerability scans, diffs, fixes, SBOMs, sandboxed execution, and policy-as-code enforcement across repos, images, and registries](https://github.com/picatz/deputy). Read: [Introduction to Deputy](https://picatz.github.io/blog/2026/1/21/introduction-to-deputy)
* [trailofbits/deptective: Automatically determines native dependencies required to run arbitrary programs by observing file access attempts and iteratively installing missing dependencies](https://github.com/trailofbits/deptective)
* [bomly-dev/bomly-cli: Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates](https://github.com/bomly-dev/bomly-cli). Resolves a dependency graph from source trees, lockfiles, SBOMs, Git refs, or container images, explains why a package is present with its shortest path, diffs two graphs, and evaluates policy. External vulnerability and license lookups are opt-in per run via `--enrich`. Also runs as an MCP server so coding agents can query the same graph
* Read: [HyperRes: A Formal System for Cross-Ecosystem Dependency Resolution](https://arxiv.org/abs/2506.10803), addressing multi-lingual projects by enabling versioned dependency resolution across language ecosystems without requiring users to shift package managers
* [Open Source Insights](https://deps.dev/)
* [guacsec/guac: GUAC aggregates software security metadata into a high fidelity graph database.](https://github.com/guacsec/guac)
Expand Down