Bumblebee is a read-only inventory scanner for developer endpoints that collects package, extension, and developer-tool metadata to identify exposure to known software supply-chain compromises.
The tool addresses a specific gap in supply-chain response workflows. While SBOMs show what shipped and EDR tools show what ran, responders often need to quickly check whether specific vulnerable packages or versions exist in the messy local state of developer machines. Bumblebee scans on-disk lockfiles, package-manager metadata, extension manifests, and supported developer-tool configurations, converting scattered state into structured NDJSON records. When given an exposure catalog, it performs fast, read-only matching against known compromises without executing package managers or reading source files.
Teams should adopt this tool when they need rapid supply-chain response capabilities focused on developer endpoint inventory. It suits organizations that want to answer narrow, specific questions like "which machines have this vulnerable package installed" without the overhead of full SBOM generation or EDR integration. The tool covers a broad range of ecosystems including npm, pnpm, Yarn, Bun, PyPI, Go modules, RubyGems, Composer, MCP configurations, agent skills, and browser and editor extensions. It runs as a single static binary with no external dependencies, making deployment straightforward across macOS and Linux endpoints. Three scan profiles—baseline, project, and deep—allow tuning for different populations and scanning cadences.
The project maintains a narrow, focused scope: it reads only documented inventory sources and explicitly avoids executing package managers or parsing source files. The tool does not emit sensitive values from MCP host configuration environment blocks, even though it parses those configs to extract server inventory. Development activity shows attention to completeness across ecosystem coverage, with detailed documentation of all supported sources and their specific file locations. The codebase prioritizes simplicity through a single static binary and zero non-stdlib dependencies, reflecting a deliberate choice to minimize operational complexity.
