Bumblebee
Your laptop probably has hundreds of npm packages, PyPI libraries, VS Code extensions and MCP servers installed — Bumblebee is a free scanner from Perplexity that checks all of them at once against known supply-chain threats, without running or modifying
🔗 Visit Bumblebee
Description
Modern developers install code from dozens of sources — package managers, editor extensions, AI tool plugins — and any one of them could be a supply-chain attack in disguise. Most security tools focus on scanning your project's build artifacts or watching runtime behavior, but few actually check what's sitting on your machine right now: the lockfiles, extension manifests and MCP server configs that could reveal you're already exposed to a known malicious package.
Bumblebee, open-sourced by Perplexity AI, is a read-only scanner covering npm, PyPI, Go modules, RubyGems, Composer, MCP servers, agent skills, and editor/browser extensions in a single pass. It ships as a single static Go binary with zero external dependencies, offers three scan profiles (baseline, project, deep) for different use cases, and outputs structured NDJSON with confidence levels and content-addressed hashing for deduplication. It never executes package managers or install scripts, so scanning itself can't trigger an attack, and it includes a built-in selftest to validate detection before you rely on it in an incident.
💬 Our review
The short version: for security and incident-response teams who need to know fast whether a developer's machine has a known-malicious package, extension, or MCP server installed, Bumblebee fills a specific and currently underserved gap — most tools don't check this particular surface.
Against Snyk or Dependabot (focused on scanning project dependencies for known vulnerabilities, not endpoint inventory) or Trivy (broader vulnerability/misconfiguration scanner), Bumblebee's edge is its narrow, read-only focus on what's actually installed on a developer's machine across package managers and AI tooling, which is a newer and less-covered attack surface. It's entirely free, single-binary, and safe to run without side effects, but it's a point tool, not a full security platform — you'll still want Snyk/Dependabot-style dependency scanning for your actual codebases. Worth it for any DevSecOps or incident-response team building endpoint inventory; not a replacement for standard dependency vulnerability scanning.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Entièrement gratuit et open-source (Apache 2.0)
Pros
Scanne 8+ écosystèmes en un seul passage (npm, PyPI, Go, RubyGems, Composer, MCP, extensions…)
Binaire Go statique unique, zéro dépendance externe
Lecture seule — n'exécute jamais de gestionnaire de paquets
Sortie structurée NDJSON avec niveaux de confiance
Cons
Outil pointu, pas une plateforme de sécurité complète
Ne remplace pas un scanner de vulnérabilités de dépendances classique (Snyk, Dependabot)
Public principalement expert (DevSecOps / réponse à incident)