TLDR Tech / InfoSec
Bumblebee (GitHub Repo)
Bumblebee, released by Perplexity, is a read-only inventory collector that turns scattered on-disk developer-tool metadata into structured NDJSON component records, parsing lockfiles, package-manager install metadata, editor and browser extension manifests, and MCP host configs across npm, PyPI, Go, RubyGems, Composer, and other ecosystems on macOS and Linux endpoints. Shipping as a single static Go 1.25+ binary with zero non-stdlib dependencies and three scan profiles (baseline, project, and deep), it answers a narrow supply-chain response question by flagging exact (ecosystem, name, and version) matches against a supplied exposure catalog, making it well-suited for fast fleet-wide checks when responders already know the compromised package from an advisory. The tool deliberately avoids executing package managers or reading source files and does not emit credential values from MCP env blocks, though teams should still validate the maintained threat_intel catalogs (assembled with Perplexity Computer) before relying on them for incident response.
Read the full story