Bomly brings dependency forensics to coding agents with local CLI and MCP
Pleasant-Ad192 · reddit · 2026-07-22
A small open-source CLI, Bomly, answers dependency questions that coding agents often waste tool calls on, such as:
- why a package exists in the tree
- which direct dependency pulled in a vulnerable transitive one
- what changed between two dependency states
The author shows a real bomly explain github.com/spf13/cobra --path . example, where the package is both a direct dependency and also pulled in transitively through Anchore packages. The tool exposes the same queries over MCP, runs locally, and can optionally enrich results via network access. The post is also a disclosure that the author built Bomly.
More from coding & agent
- Fractal runs entirely on git worktrees, tmux, and a local SQLite database — rohanpaul_ai · 2026-07-22
- Fractal adds root budgets, Markdown memory files, and hard caps for recursive agents — rohanpaul_ai · 2026-07-22
- Gemini CLI nightly hardens A2A server to block an RCE path — gemini-cli-robot · 2026-07-22
- Myers diff slows to quadratic on large agent rewrites, so one post uses edit spans to speed it up — _jzhao · 2026-07-22
- Do prompt caches meaningfully cut costs for production AI agents? — MembershipEmergency7 · 2026-07-22
- Production AI agents work better when models propose and code decides — Odd_Huckleberry4363 · 2026-07-22