# Bumblebee

> Updated 2026-09-16 · type: tool · category: ai-infrastructure · status: active · rev 1

Bumblebee scans a dev machine's installed packages and editor extensions against known-compromised catalogs, catching supply-chain risk on the workstation.

- Open source: yes (Apache-2.0)
- Self-hostable: yes
- Pricing model: free
- Best for: Small teams without a security function who install a lot of open-source packages and IDE/agent extensions and want a fast local check that none of them are on a known-compromised list — especially relevant after the recent run of npm and extension supply-chain attacks.
- Last verified: 2026-09-16

- **Canonical:** https://gtmstacker.com/registry/tool/bumblebee/
- **Source:** [github · perplexityai/bumblebee](https://github.com/perplexityai/bumblebee)
- **Tags:** ai-infrastructure, agent-security, supply-chain, devsecops, self-hostable
- **Repository:** https://github.com/perplexityai/bumblebee

## Is Bumblebee open source?

Yes, Bumblebee is open source under the Apache-2.0 license.

## How much does Bumblebee cost?

Bumblebee is free to use.

## Can I self-host Bumblebee?

Yes, Bumblebee can be self-hosted (the source is available under the Apache-2.0 license).

## Alternatives & related

- [agentdesktop](https://gtmstacker.com/registry/tool/agentdesktop/)
- [Geiger](https://gtmstacker.com/registry/tool/geiger/)


---

Apache-2.0 Go tool from Perplexity that inventories the packages and editor/agent extensions on a developer machine and checks them against catalogs of known-compromised software, moving supply-chain detection to the workstation instead of waiting for it to reach production. It ships as a single static binary with zero non-stdlib dependencies, installs with `go install`, and runs locally; the compromised-software catalogs are bundled.

## Provenance

- Apache-2.0, Go, ~5k stars, zero non-stdlib dependencies and the `go install` / local-static-binary model independently WebFetch-verified on the repo 2026-09-16 (github.com/perplexityai/bumblebee, published under the perplexityai org).
- Surfaced via the 2026-09-16 viral-posts brief (a "5 repos about to blow up" drop naming Bumblebee for MCP-security workflows); its inclusion here is on the verified repo facts, not the listicle framing.
- Curated from the GTM Stacker signal registry (2026-09-16 pass: daily pull + viral-posts brief); license independently verified 2026-09-16.

## Why it matters for a GTM stack

The GTM stack is now half open-source packages and half IDE and agent extensions, and the last few months have shown how a single poisoned npm package or editor extension quietly turns into stolen tokens. Bumblebee is the cheap, local first check: point it at a machine, get back a list of anything on it that matches a known-compromised catalog. For a team without a security hire, that is a real gap filled with one static binary and no service to run. The honest read is that it only knows what is catalogued — so it is triage, not proof of safety — and its usefulness tracks how current the bundled lists are. As a workstation-level tripwire for the supply-chain attacks this registry keeps flagging, it earns its place.