bz

What is bz?

bz is a CLI tool for managing Bazel modules (Bzlmod). It helps you manage MODULE.bazel dependencies, query the Bazel Central Registry, analyze your dependency graph, and ensure security compliance.

# Quick start
bz init --name=my_project        # Initialize module
bz mod add rules_go@0.50.1       # Add dependencies
bz mod list                      # List dependencies
bz mod graph                     # Visualize dependency tree
bz audit                         # Scan for vulnerabilities

Features

Dependency Management

Add, remove, update, and search for Bazel modules. Check for outdated dependencies and update them with a single command.

Dependency Analysis

Visualize your dependency graph in ASCII, DOT, Mermaid, or JSON. Understand why modules are included with bz mod why.

Security & Compliance

Scan for vulnerabilities with OSV integration. Check license compliance. Generate SPDX and CycloneDX SBOMs.

Air-gap Support

Full offline mode with local cache. Download dependencies for air-gapped environments. Verify cache completeness.

Registry Sync

Mirror modules from BCR to internal registries. Starlark-based configuration for complex sync workflows.

Developer Experience

Shell completions, JSON output for scripting, environment diagnostics with bz doctor, colored output.

Quick Examples

Manage Dependencies

bz mod add rules_go@0.50.1 rules_python@0.35.0
bz mod rm rules_go
bz mod update
bz mod outdated

Analyze Dependencies

bz mod graph                     # ASCII tree
bz mod graph --format=dot | dot -Tpng -o deps.png
bz mod stats                     # Dependency statistics
bz mod why protobuf              # Why is protobuf included?

Security & Compliance

bz audit                         # Vulnerability scan
bz audit --severity=high         # Only high/critical
bz mod licenses                  # List all licenses
bz mod licenses --check --deny=GPL-3.0
bz sbom --format=cyclonedx       # Generate SBOM

Offline/Air-gapped Usage

bz cache download                # Download dependencies
bz cache verify                  # Verify cache
bz mod list --offline            # Use cache only

Command Reference

Command	Description
bz init	Initialize a new MODULE.bazel
bz mod add	Add dependencies
bz mod rm	Remove dependencies
bz mod list	List dependencies
bz mod info	Show module information
bz mod update	Update dependencies
bz mod outdated	Check for updates
bz mod search	Search registry
bz mod graph	Dependency graph
bz mod stats	Dependency statistics
bz mod why	Explain dependency path
bz mod licenses	License information
bz mod sync	Sync registries
bz audit	Vulnerability scan
bz sbom	Generate SBOM
bz cache download	Download to cache
bz cache verify	Verify cache
bz cache stats	Cache statistics
bz cache clear	Clear cache
bz doctor	Environment diagnostics
bz registry ping	Test connectivity
bz completion	Shell completions
bz version	Version info

Use Cases

Air-gapped Setup

Use bz in environments without internet access. Download dependencies, transfer them, and work offline.

Read guide

Security Pipeline

Integrate vulnerability scanning and license compliance into your CI/CD pipeline.

Read guide

Mirror BCR

Create a local mirror of Bazel Central Registry for faster builds and reliability.

Read guide