TL;DR: Bumblebee is Perplexity’s Apache 2.0 supply-chain scanner for developer machines, released May 2026 and sitting at roughly 5.1k GitHub stars as of October 2026. It is the first open-source scanner that reads MCP configuration files — claude_desktop_config.json, ~/.claude.json, and friends — as a security surface, alongside eight package ecosystems, editor extensions, and browser extensions. It is strictly read-only and runs on macOS and Linux only. It inventories what is installed; it does not look up CVEs, so it complements Trivy and Grype rather than replacing them.

	Bumblebee	Trivy	Grype
Best for	Dev endpoints: MCP configs, editor + browser extensions, installed packages	Containers, filesystems, IaC, CVE lookup	SBOM and image vulnerability matching
MCP config scanning	Yes — the only one	No	No
License	Apache 2.0	Apache 2.0	Apache 2.0
The catch	Inventory + exposure matching only, no CVE database; no Windows	Doesn’t see AI-tool or extension state	Needs an SBOM or image as input

Honest take: if you have ever added an MCP server to Claude Desktop, Cursor, or Open WebUI, run Bumblebee once — nothing else audits that file. Keep Trivy for your containers; the two don’t overlap.

What does Bumblebee actually scan?

Bumblebee inventories six categories of state on a developer machine and checks them against known supply-chain compromises. Verified from the official repository README, October 2026:

Surface	What it reads
Package ecosystems	npm, pnpm, Yarn, Bun, PyPI, Go modules, RubyGems, Composer
MCP host configs	JSON configs such as claude_desktop_config.json and ~/.claude.json
Agent skill lock files	Skill/plugin lock metadata for AI agents
Editor extensions	VS Code, Cursor, Windsurf, VSCodium
Browser extensions	Chromium-family browsers and Firefox
Homebrew	Installed formulas and casks

The design decision that matters: Bumblebee reads raw metadata files directly and never invokes a package manager. npm ls or pip list can execute lifecycle hooks — exactly the mechanism that compromised packages like the 2024 npm worm families used. A scanner that shells out to the tools it is auditing can trigger the payload it is looking for. Bumblebee parses lockfiles and manifests itself, in Go, with zero non-stdlib dependencies.

Output is NDJSON, one record per inventoried item, so it pipes straight into jq, a SIEM, or a log platform without a parser.

Why do MCP config files need a security scanner?

Because an MCP server entry is remote code execution by design, and until Bumblebee nothing audited the files that declare them. A line in claude_desktop_config.json or Cursor’s MCP settings is a command your AI client will happily execute with your user’s permissions — typically an npx ...@latest or uvx ... invocation that re-resolves a package on every launch. That is a supply-chain time bomb: the package you vetted in June is not necessarily the package that runs in October.

Self-hosters are squarely in the blast radius. A typical private stack — Ollama serving a local model, Open WebUI or Claude Desktop in front of it, plus a handful of MCP servers for files, search, and databases — was chosen because no data leaves the machine. One malicious or hijacked MCP package undoes all of it: the server process can read whatever your user can, including the prompts and documents you self-hosted to protect. We covered the exposure side of this stack in the exposed Ollama instances analysis; Bumblebee covers the ingestion side — what you have installed and declared, not what you have exposed.

Two details from the README worth knowing. Bumblebee parses MCP server entries but deliberately does not emit env values into its output, so API keys sitting in those configs don’t leak into your scan logs. And agent skill lock files are a first-class surface — relevant if your stack pulls community skills or plugins for Claude-family agents.

How do you install and run Bumblebee?

One go install command, no runtime dependencies. It needs Go 1.25+ to build and supports macOS and Linux (verified October 2026):

go install github.com/perplexityai/bumblebee/cmd/bumblebee@latest

bumblebee version
# bumblebee v0.1.1

bumblebee scan --profile baseline > inventory.ndjson

The baseline profile covers the standard surfaces at interactive speed. Two more profiles scale it up:

# Scan a specific project tree
bumblebee scan --profile project --root ~/code/my-stack > project.ndjson

# Deep scan with exposure matching and a time cap
bumblebee scan --profile deep --root "$HOME" \
  --exposure-catalog ./catalog.json --max-duration 10m

bumblebee roots --profile baseline prints which directories a profile will touch before you run it — useful for convincing a security team (or yourself) of the scope. bumblebee selftest validates the install and, per the README, makes no network calls.

A problem we hit on the first install: Debian 13’s packaged Go is 1.24, and the build fails with a go.mod requires go >= 1.25 error. The fix is the upstream tarball — rm -rf /usr/local/go && curl -LO https://go.dev/dl/go1.25.3.linux-amd64.tar.gz && sudo tar -C /usr/local -xzf go1.25.3.linux-amd64.tar.gz — then re-run the go install. Ubuntu 24.04’s default toolchain is similarly too old; anything from go.dev/dl from 1.25 up works.

The other operational note: the --exposure-catalog flag is where compromise matching happens. Bumblebee ships as the collector; the catalog of known-bad packages and extensions is a JSON file you supply and keep current. Without one, you still get the full inventory — which is useful on its own — but no verdicts. Plan for a scheduled job that refreshes the catalog and re-scans, not a one-off run.

Is Bumblebee really read-only, with no call-home?

Yes, as far as the source and docs show in October 2026 — and this is the FOSS purity test that matters for a tool you point at your secrets-adjacent configs. The checklist:

• License: Apache 2.0, verified from the repository’s LICENSE file. No open-core split, no paid tier.
• Write behavior: the README describes it as a read-only inventory collector. It does not modify files, does not run package managers, and does not read your source code — metadata and manifests only.
• Network behavior: no telemetry endpoint is documented, selftest explicitly makes no network calls, and output goes to stdout or a file you name. Shipping records anywhere (HTTPS to a collector, for instance) is operator-configured, not default.
• Dependencies: zero outside the Go standard library, which makes the “audit the auditor” job a single-vendor read.

The honest caveat: v0.1.1 is a young release from a vendor whose main business is a proprietary AI product, and the GitHub Releases page is still sparse. Pin the version you audited rather than tracking @latest in anything automated — the same advice the tool itself embodies for MCP servers.

How does Bumblebee compare to Trivy, Grype, and Snyk?

It doesn’t compete with them — it scans a layer they don’t see. Trivy is the right tool for container images, filesystems, and IaC misconfigurations with full CVE lookup. Grype matches SBOMs and images against vulnerability databases. Snyk is strongest inside package-manager dependency trees with a commercial database behind it. None of the three reads MCP host configs, editor extension state, or browser extensions on a developer workstation.

The inverse is equally true: Bumblebee has no CVE database. It tells you what is installed and declared and flags matches against the exposure catalog you feed it; it will not tell you that your requests version has a known CVE. A self-hosted AI box wants both layers: Trivy or Grype on the containers running Ollama, Open WebUI, and your vector DB, and Bumblebee on the workstation (and config directories) that orchestrates them. If you run coding agents too, the same scan covers the Cursor/Windsurf extension surface — the angle our sister site covers in its Bumblebee for coding-tool setups guide.

When NOT to use Bumblebee

• You need Windows coverage. macOS and Linux only as of v0.1.1. A Windows dev fleet gets nothing from it today.
• You expect vulnerability scanning. No CVE lookup exists. If your goal is “find outdated packages with known CVEs,” Trivy, Grype, or npm audit is the tool, not this.
• You have no exposure catalog and no plan to maintain one. Raw inventory without matching is only half the product. If nobody will own the catalog refresh, you’ll accumulate NDJSON nobody reads.
• Your threat model is runtime, not install-time. Bumblebee audits what is installed and declared. It does not watch process behavior or network egress — a compromised MCP server already running needs containment of the kind we walked through in the Kimi K3 containment analysis.

For a single-user homelab with two hand-picked MCP servers, a monthly manual read of your own config file honestly gets you 80% of the value. Bumblebee earns its keep from the third machine, the third teammate, or the tenth MCP entry onward.

FAQ

Does Bumblebee send my scan results to Perplexity? No. As of v0.1.1 (October 2026), output goes to stdout or a local file, no telemetry endpoint is documented, and the self-test makes no network calls. Any forwarding to a central collector is something you configure yourself.

Which MCP configs does it find? MCP host JSON configs such as Claude Desktop’s claude_desktop_config.json and ~/.claude.json, plus agent skill lock files. bumblebee roots --profile baseline lists the exact paths your install will read. Server env values (where API keys live) are excluded from output by design.

Can Bumblebee scan my self-hosted Ollama or Open WebUI server? Yes, if it runs Linux — install the binary on the box and scan the config and package surfaces there. What it audits is the machine’s installed packages, extensions, and MCP/agent configs, not Ollama’s network exposure; for the open-port problem, start with binding Ollama to 127.0.0.1 as covered in our privacy stack guide.

Sources

• PerplexityAI/bumblebee — official GitHub repository (license, scan surfaces, commands; accessed Oct 15, 2026)
• Perplexity: “Perplexity is open-sourcing Bumblebee” (official announcement)
• i-programmer: “Perplexity Releases The Bumblebee Supply Chain Security Scanner”
• Better Stack: Bumblebee read-only scanner guide
• Open Source For U: “Perplexity Open Sources ‘Read-Only’ Security Tool”

What self-hosting actually costs

Real cost breakdowns for self-hosted AI: hardware floors, power, maintenance hours, and the honest comparison against paying for it. No spam, unsubscribe anytime.

Email address Subscribe