bumblebee

{
  "aliases": [],
  "alternatives": [],
  "build_dependencies": [
    "go"
  ],
  "categories": [],
  "caveats": null,
  "conflicts_with": [],
  "dependencies": [],
  "deprecated": 0,
  "deprecation_reason": null,
  "desc": "Read-only developer endpoint scanner for supply-chain exposure",
  "disable_reason": null,
  "disabled": 0,
  "enrichment_fetched_at": "2026-06-20T23:36:02+00:00",
  "first_seen": "2026-06-20T23:34:18+00:00",
  "full_name": "bumblebee",
  "github_default_branch": "main",
  "github_last_commit_at": "2026-06-18T15:13:32Z",
  "github_readme_excerpt": "# bumblebee\n\nBumblebee is a read-only inventory collector for package, extension,\nand developer-tool metadata on macOS and Linux developer endpoints.\n\nIt answers a narrow supply-chain response question: when an advisory\nnames a package, extension, or version, which developer machines show\na match in their on-disk metadata right now?\n\nSBOMs help answer what shipped, and EDR helps answer what ran or\ntouched the network, but supply-chain response often needs a different\nview: messy local state across lockfiles, package-manager metadata,\nextension manifests, and supported developer-tool configs.\n\nBumblebee turns that scattered on-disk state into structured NDJSON\ncomponent records and, when given an exposure catalog, flags exact\nmatches for fast, read-only exposure checks when responders already\nknow what they are looking for.\n\n## Scope\n\n- Single static binary, Go 1.25+, zero non-stdlib dependencies.\n- Three scan profiles (`baseline`, `project`, `deep`) for different\n  populations and cadences.\n- Reads only the lockfiles, package-manager install metadata,\n  extension manifests, and supported MCP JSON configs listed in\n  [docs/inventory-sources.md](docs/inventory-sources.md). No package\n  manager execution (`npm ls`, `pip show`, `go list`, ...) and no\n  source-file reads. MCP host configs can carry environment values\n  and credentials in their `env` blocks; Bumblebee parses these\n  configs for the server inventory it needs but does not emit those\n  values in its records.\n\n## Coverage\n\n| Family | Emitted `ecosystem` | Sources |\n|---|---|---|\n| npm | `npm` | `package-lock.json`, `npm-shrinkwrap.json`, `node_modules/.package-lock.json`, `node_modules/\u003cpkg\u003e/package.json` |\n| pnpm | `npm` | `pnpm-lock.yaml`, `.pnpm/.../package.json` |\n| Yarn | `npm` | `yarn.lock` (Classic + Berry) |\n| Bun | `npm` | `bun.lock`; `bun.lockb` presence as diagnostic |\n| PyPI | `pypi` | `*.dist-info/METADATA`, `INSTALLER`, `direct_url.json`, `*.egg-info/PKG-INFO` |\n| Go modules | `go` | `go.sum`, `",
  "github_repo": "perplexityai/bumblebee",
  "github_stars": 4556,
  "github_topics": [
    "golang",
    "package-inventory",
    "supply-chain-security"
  ],
  "homepage": "https://github.com/perplexityai/bumblebee",
  "homepage_og_description": null,
  "homepage_og_image": null,
  "homepage_title": null,
  "installs_30d": 90,
  "installs_365d": 90,
  "installs_90d": 90,
  "keg_only": 0,
  "keg_only_reason": null,
  "last_seen": "2026-06-20T23:34:18+00:00",
  "license": "Apache-2.0",
  "llm_generated_at": null,
  "llm_model": null,
  "name": "bumblebee",
  "oldnames": [],
  "one_liner": null,
  "optional_dependencies": [],
  "rank_30d": 3619,
  "rank_365d": 9479,
  "rank_90d": 5832,
  "raw_hash": "c3e8de4aa50f5dfe",
  "recommended_dependencies": [],
  "revision": 0,
  "ruby_source_path": "Formula/b/bumblebee.rb",
  "tap": "homebrew/core",
  "test_dependencies": [],
  "uses_from_macos": [],
  "version_head": "HEAD",
  "version_stable": "0.1.2",
  "versioned_formulae": [],
  "why_use_this": null
}