Bumblebee 是一个只读的物品收集器，用于包裹、扩展， 以及macOS和Linux开发端点上的开发工具元数据。

它回答了一个狭窄的供应链响应问题：当咨询 开发者机器显示的是一个包、扩展或版本 现在磁盘上的元数据匹配吗？

SBOMs帮助回答哪些已发布，EDR则帮助确定运行情况 触及网络，但供应链响应往往需要不同的方式 视图：锁文件间的混乱本地状态，包管理器元数据， 扩展清单，以及支持的开发者工具配置。

Bumblebee 将散落的磁盘状态转换为结构化的 NDJSON 组成记录，并在获得曝光目录时，标记精确 匹配用于快速只读暴露检查，当响应者已经 知道他们在找什么。

范围

• 单静态二进制，Go 1.25+，零非标准库依赖。
• 三种扫描配置文件（baseline、project、deep）用于不同 种群和阶数。
• 仅读取锁文件，包管理器安装元数据， 扩展清单，以及支持的 MCP JSON 配置，列在 docs/inventory-sources.md。没有包裹

bumblebee

Bumblebee is a read-only inventory collector for package, extension, and developer-tool metadata on macOS and Linux developer endpoints.

It answers a narrow supply-chain response question: when an advisory names a package, extension, or version, which developer machines show a match in their on-disk metadata right now?

SBOMs help answer what shipped, and EDR helps answer what ran or touched the network, but supply-chain response often needs a different view: messy local state across lockfiles, package-manager metadata, extension manifests, and supported developer-tool configs.

Bumblebee turns that scattered on-disk state into structured NDJSON component records and, when given an exposure catalog, flags exact matches for fast, read-only exposure checks when responders already know what they are looking for.

Scope

• Single static binary, Go 1.25+, zero non-stdlib dependencies.
• Three scan profiles (baseline, project, deep) for different populations and cadences.
• Reads only the lockfiles, package-manager install metadata, extension manifests, and supported MCP JSON configs listed in docs/inventory-sources.md. No package manager execution (npm ls, pip show, go list, …) and no source-file reads. MCP host configs can carry environment values and credentials in their env blocks; Bumblebee parses these configs for the server inventory it needs but does not emit those values in its records.

Coverage