Bumblebee
Read-only supply chain scanner for developer machines
About Bumblebee
Bumblebee is a scanner from Perplexity that answers one operational question: which of our developer machines has a compromised package on it. It reads what is already sitting on disk, lockfiles, package manager metadata and configuration manifests, and emits an NDJSON inventory of everything it finds. The design constraint is the interesting part. It never invokes a package manager and never reads source files, which means the act of scanning for a malicious package cannot trigger that package's install script. Scanners that shell out to npm or pip to enumerate dependencies have exactly that problem, and it is not theoretical.
The reason it belongs in a directory of AI tools rather than a general security list is what it covers beyond the usual ecosystems. Alongside npm, pnpm, Yarn, Bun, PyPI, Go modules, RubyGems, Composer and Homebrew, it inventories MCP host configurations, editor extensions, browser extensions and agent skills. An MCP configuration decides which external services an AI assistant is allowed to reach, which in practice can mean mail, databases and code repositories, so a malicious connector quietly added to that file is a credential exfiltration path that no conventional dependency scanner is looking at. Bumblebee parses those configs but deliberately does not emit any credentials it finds inside them. Apache-2.0, written in Go, with nothing outside the standard library.
You install it with the Go toolchain and run it as a one-shot command. There is no daemon and no agent to deploy. Three profiles control the blast radius. The baseline profile sweeps the common global and user package roots, language toolchains, editor extensions, browser extensions and MCP configs, and is what you would run across a fleet. The project profile targets configured development directories. The deep profile sweeps operator-supplied roots, typically a whole home directory, and is meant for an active incident rather than routine use. Output goes to stdout as NDJSON, one record per finding, so it pipes straight into whatever already collects your inventory. A built-in selftest command validates the scanner against embedded fixtures, and the repository carries a threat intelligence directory of exposure catalogs built from public reporting on known supply-chain campaigns.
- •Read-Only By Design - No package manager execution and no source-file reads, so scanning for a malicious package cannot run it
- •Ten Package Ecosystems - npm, pnpm, Yarn, Bun, PyPI, Go modules, RubyGems, Composer and Homebrew
- •MCP Configuration Coverage - Treats MCP host configs as a security surface, parsing them without emitting the credentials they hold
- •Agent and Editor Surfaces - Inventories agent skills, browser extensions, and editor extensions for VS Code, Cursor and Windsurf
- •Three Scan Profiles - baseline for fleet inventory, project for development directories, deep for incident response
- •NDJSON Output - One record per finding, ready to pipe into whatever collects inventory today
- •Zero Dependencies - A single Go binary with nothing outside the standard library
Whoever has to answer the question the morning after a package compromise makes the news: are we exposed, and on which machines. It is aimed at security and platform teams running it across a fleet more than at an individual developer, although a single run on your own laptop is a reasonable use of five minutes, given how much an editor and an MCP config quietly accumulate over a year. Two things to weigh. It is an inventory tool and not a remediation tool: it tells you what you have, and the fixing is still yours. And it is early and it has been quiet. The latest release is v0.1.2 from June 2026 and the most recent commit is from early August 2026, which matters more than usual for a tool whose value depends on a current threat-intelligence catalog, because a stale catalog reports clean. Check how fresh that catalog is before you trust a green result. Go 1.25 or later is required, and there are no prebuilt binaries in the documented install path.
Pricing
No pricing page found
Free and Apache-2.0 licensed, with no paid tier and no pricing page. Installed with the Go toolchain. Requires Go 1.25 or later and has no non-stdlib dependencies.
From the vendor pricing page, 2026-10-08
