Bumblebee, released by Perplexity AI on May 22, 2026, is an open-source security auditing tool designed to detect vulnerabilities in the software supply chain and AI tool environments, targeting developers' local endpoints. Much like a skilled patrol officer meticulously inspecting the security of doors and windows within a home without causing damage or forced entry, this tool safely detects security risks in various language-specific package manager files, editor extensions, and the rapidly growing MCP (Model Context Protocol) server configurations installed on local development machines through read-only scanning. Implemented in Go, it operates with a single executable file, without external library dependencies, and statically parses file metadata of local operating systems (macOS and Linux) to visualize potential threats. Existing Software Composition Analysis (SCA) or SBOM (Software Bill of Materials) tools primarily focus on checking dependencies in deployable production artifacts or cloud repositories, limiting their ability to quickly address security threats to the personal development equipment that developers use daily. In particular, the recent surge in sophisticated supply chain attacks exploits preinstall scripts that run during the package installation process or excessive file system write permissions of AI assistants, leading to the theft of critical assets such as API keys and environment variables stored locally. To address these issues, Bumblebee directly installs and executes dangerous packages or communicates externally; instead, it safely analyzes only the lockfiles or JSON configuration documents present on the disk, preventing the execution path of attack code within the local system in advance. Researchers and engineers working in the fields of bioinformatics and AI-driven drug discovery are constantly exposed to supply chain threats due to their complex use of numerous open-source dependency modules and AI coding assistants to drive large-scale computational pipelines. By specifying the directory path where the research project is stored as a parameter and running the scan, it quickly inventories and analyzes the PyPI or npm dependency structure running within the project and the credential management status included in the MCP server configuration information. This allows for the quantitative inspection of research data leakage risks or external malicious code injection and the output of a standardized threat report in NDJSON format within 1-2 seconds, helping to maintain the reliability of the research infrastructure.

AI security scanner for detecting vulnerabilities in the software supply chain.

🔬 Bio Pipeline Dependency Scan: By running bumblebee scan --profile project --dir /home/user/rna-seq, perform a static check within 0.5 seconds to verify the integrity of lockfiles for approximately 150 Python (PyPI) dependency packages in the project folder, and detect the presence of malicious pre-install scripts, thereby preventing supply chain threats at their source.