Bomly is a free, open-source CLI that scans your projects, SBOMs, and container images, explains where each dependency came from, and surfaces vulnerability and license data when you ask for it.
Publisher’s description
What is Bomly CLI?
Bomly CLI by Bomly is open-source Windows software in the terminals & cli tools category. It is written in Go.
Installation and requirements
The publisher provides Portable installers for 64-bit and ARM64 Windows. It runs without installation (portable).
Updates and version history
The current version is 0.29.0, released on October 21, 2026. The version history goes back to June 26, 2026: 36 releases, all linked to the official files. The last update is less than a month old.
Popularity and file types
The source code on GitHub (bomly-dev/bomly-cli) has 14 stars. Similar programs include PowerShell, QPDF and Oh My Posh.
Project description on GitHub: “Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates.”
Pros / Cons
Pros
- Open source: the code can be inspected and built by anyone
- Native ARM64 build for Windows on Arm
- Portable: runs without installation
- Updated in the last two months
In short: Bomly CLI is an open-source terminals & cli tool tool for 64-bit and ARM64 PCs.
Is Bomly CLI safe to download?
- The file is served by github.com, the publisher’s own domain
- The download link uses HTTPS
- A SHA256 hash is published, so you can verify the file:
41E6A5C9FE44871922110782E01B26D79BBDE8640993A54C314FC956DCEA20C0· Open the VirusTotal report for this hash - The link has not been checked yet
- The source code is public
- ExeAtlas does not host, wrap or modify installers
Related guide: How to check a file’s SHA256 hash on Windows
Security practices (OpenSSF Scorecard)
Automated checks of the bomly-dev/bomly-cli repository on GitHub by the Open Source Security Foundation, last run on October 21, 2026.
- Dependency update tool10
- Security policy10
- Actively maintained10
- No dangerous workflows10
- Restricted token permissions10
- Signed releases10
- Static code analysis10
- Licence declared10
- Published packages10
- Fuzzing10
- Tests in CI10
- No binaries in the repository9
- Pinned dependencies9
- No known vulnerabilities8
- Branch protection8
- Code review0
- OpenSSF Best Practices badge0
- Contributors from several organisations0
The score rates how the project is developed and released, not whether the program is safe to install. scorecard.dev
Recent versions
All 36 versions ›| Version | Date | Size | Files |
|---|---|---|---|
| 0.29.0Latest | October 21, 2026 | — | ARM64 ZIP64-bit ZIP |
| 0.28.3 | October 20, 2026 | — | 64-bit ZIPARM64 ZIP |
| 0.28.2 | October 4, 2026 | — | ARM64 ZIP64-bit ZIP |
| 0.28.1 | October 4, 2026 | — | 64-bit ZIPARM64 ZIP |
| 0.28.0 | October 4, 2026 | — | 64-bit ZIPARM64 ZIP |
| 0.27.1 | October 4, 2026 | — | 64-bit ZIPARM64 ZIP |
| 0.27.0 | October 3, 2026 | — | ARM64 ZIP64-bit ZIP |
| 0.26.0 | September 17, 2026 | — | ARM64 ZIP64-bit ZIP |
Install from the command line
Silent install ›winget install --id Bomly.BomlyCLI -eRelated guide: How to use winget: install and update apps
Information
- Publisher
- Bomly
- Category
- Terminals & CLI tools
- Licence
- Apache-2.0
- Price
- Free
- Source code
- github.com/bomly-dev/bomly-cli
- Written in
- Go
- Requires
- Windows 11 / 10
- Architecture
- 64-bit, ARM64
- Installer
- Portable
- Version
- 0.29.0
- Released
- October 21, 2026
- Added to the catalogue
- July 2, 2026
- Versions listed
- 36
- GitHub stars
- 14
- Website
- bomly.dev
- winget ID
- Bomly.BomlyCLI
Ratings and reviews
No reviews yet. Be the first to rate it.
Alternatives to Bomly CLI
See all ›-
PowerShell7.6.9.0PowerShell is a cross-platform task automation solution made up of a command-line shell, a scripting language, and a configuration management framework. PowerShell runs on Windows, Linux, and macOS.Open source689.6K ↓ -
QPDF12.4.2QPDF is a command-line tool and C++ library that performs content-preserving transformations on PDF files.Open source2.1M ↓ -
Open source820.8K ↓ -
Open source290.1K ↓ -
Open source1.5M ↓ -
Alacritty0.17.0Alacritty is a free and open-source GPU accelerated terminal emulator focused on performance and simplicity.Open source75.9K ↓ -
Free5.9M ↓ -
PuTTY0.85.0.0A free implementation of SSH and Telnet for Windows and Unix platforms, along with an xterm terminal emulator.Open source5.3M ↓
Frequently asked questions
Is Bomly CLI free?
Yes. Bomly CLI is open-source software under the Apache-2.0 licence.
Is Bomly CLI safe to download?
The download comes from github.com, which belongs to the publisher; ExeAtlas does not host or change the file. Compare its SHA256 hash with the one shown here, or open the VirusTotal report for that hash.
How do I install Bomly CLI with winget?
Open PowerShell or Windows Terminal and run the winget command shown on this page. winget downloads the official installer and checks its SHA256 hash before running it.
Does Bomly CLI run on ARM (Windows on Arm)?
Yes, there is a native ARM64 installer.
Where can I download an older version of Bomly CLI?
The versions page lists all 36 versions with links to their official installer files, back to June 26, 2026.
Can I use Bomly CLI without administrator rights?
Yes, it is portable: unpack and run it.
What are alternatives to Bomly CLI?
PowerShell, QPDF, Oh My Posh, fzf and yq. The alternatives page compares them.
