Problem
--audit currently requires --enrich. This is a useful safety default because it prevents users from accidentally auditing with less vulnerability and license evidence than they expected.
Some audit policies, however, operate entirely on evidence already produced by detection or imported with the target. Dependency source-change policy is one example: it compares source information from the base and head dependency graphs and does not require matcher or registry calls.
Users currently cannot run those local policies without also enabling enrichment.
Suggested direction
Keep the existing safe default:
bomly scan --audit
# error: --audit requires --enrich
Add an explicit alternative mode for users who intentionally want to audit only the evidence already available:
bomly diff --audit-without-enrich
Possible semantics:
--audit-without-enrich implies --audit.- It conflicts with
--enrich.
- It runs auditors against detected, imported, or otherwise existing evidence.
- It performs no enrichment network calls.
- Text output and logs clearly state that external vulnerability and license evidence may be missing.
- Structured output records that auditing ran without enrichment.
- Findings, baselines, SARIF, Guard, MCP, and exit behavior continue through the existing audit path.
Example use case
bomly diff --base main --head HEAD \
--audit-without-enrich \
--fail-on source-change
This would enforce locally derived dependency source changes without implying that external vulnerability or license enrichment was attempted.
Design questions
- Should this be a standalone audit mode that implies
--audit, or a modifier used with --audit?
- Which structured metadata should distinguish enriched auditing from existing-evidence-only auditing?
- Should configuration and environment variables expose this mode, or should it require an explicit command/MCP argument to preserve the acknowledgement?
Problem
--auditcurrently requires--enrich. This is a useful safety default because it prevents users from accidentally auditing with less vulnerability and license evidence than they expected.Some audit policies, however, operate entirely on evidence already produced by detection or imported with the target. Dependency source-change policy is one example: it compares source information from the base and head dependency graphs and does not require matcher or registry calls.
Users currently cannot run those local policies without also enabling enrichment.
Suggested direction
Keep the existing safe default:
bomly scan --audit # error: --audit requires --enrichAdd an explicit alternative mode for users who intentionally want to audit only the evidence already available:
Possible semantics:
--audit-without-enrichimplies--audit.--enrich.Example use case
This would enforce locally derived dependency source changes without implying that external vulnerability or license enrichment was attempted.
Design questions
--audit, or a modifier used with--audit?