Bumblebee - AI Supply Chain Scanner Cheatsheet
Bumblebee is a read-only supply chain scanner from Perplexity AI. It checks three attack surfaces most scanners miss: your dependencies, your MCP servers, and your editor extensions. The MCP and editor-extension coverage is the notable part — developers now routinely install MCP servers that can invoke tools and VS Code extensions with broad filesystem access, and neither gets the scrutiny that npm packages receive. Bumblebee runs in seconds and never modifies anything.
Installation
| Method | Command |
|---|
| Install script | `curl -fsSL https://bumblebee.perplexity.ai/install.sh |
| npm | npx @perplexity/bumblebee |
| Homebrew | brew install perplexityai/tap/bumblebee |
| Binary | download from GitHub Releases |
| Verify | bumblebee --version |
Scanning
| Command | Description |
|---|
bumblebee scan | Scan the current project + local AI tooling |
bumblebee scan --path ./repo | Scan a specific directory |
bumblebee scan --mcp | Only MCP server configs |
bumblebee scan --extensions | Only editor extensions |
bumblebee scan --deps | Only package dependencies |
bumblebee scan --json | Machine-readable output |
What It Inspects
| Surface | Why it matters |
|---|
| Package dependencies | Typosquats, malicious releases, known-bad packages |
| MCP servers | Servers expose tools an agent can invoke |
| Editor extensions | Broad filesystem/network access, auto-updating |
| Lockfiles | Actual resolved versions, not just declared ranges |
| Config files | Where MCP servers and extensions are registered |
Why MCP Servers Are a Real Surface
| Risk | Detail |
|---|
| Tool invocation | An MCP server’s tools can read files, call APIs, run commands |
| Implicit trust | Added once to a config, invoked silently thereafter |
| Supply chain | Installed from registries with limited vetting |
| Prompt injection reach | A compromised server can influence agent behavior |
This is the gap Bumblebee targets: teams that carefully review npm dependencies often add MCP servers with no review at all.
Reading Results
| Field | Meaning |
|---|
| Package/server name | What was flagged |
| Risk level | Severity of the finding |
| Reason | Typosquat, known-malicious, suspicious capability |
| Location | Which manifest/config declared it |
| Recommendation | Remove, pin, or investigate |
Read-Only by Design
| Property | Benefit |
|---|
| No writes | Cannot break your project |
| No installs | Does not execute package code |
| Fast | Seconds, so it fits pre-commit or shell startup |
| Local | Analysis of local manifests/configs |
The read-only guarantee matters for a scanner: tools that install or execute dependencies to analyze them create the very risk they are checking for.
Common Workflows
# Before onboarding a new repo, check what it pulls in
bumblebee scan --path ./new-project
# Audit your AI tooling specifically
bumblebee scan --mcp --extensions
# CI gate on dependency findings
bumblebee scan --deps --json | jq -e '.findings | length == 0'
| Aspect | Bumblebee | Socket | Grype/Trivy |
|---|
| Dependencies | Yes | Yes (behavioral) | Yes (CVE match) |
| MCP servers | Yes | No | No |
| Editor extensions | Yes | No | No |
| Model | Read-only, fast | Behavioral analysis | Vulnerability DB |
| Best for | AI tooling surface | Malicious packages | Known CVEs |
Complements Socket for behavioral package analysis and Grype/Trivy for CVE scanning — Bumblebee covers the AI tooling those miss.
Resources
