Perplexity's 'Bumblebee' Supply-Chain Scanner Targets the MCP Server and Editor-Extension Attack Surface

ByteByteGo·medium signal

Bumblebee is a read-only scanner from Perplexity AI that checks dependencies, MCP servers, and editor extensions for suspicious packages — notable because MCP servers and IDE extensions are the two agent-era attack surfaces that traditional SCA tooling doesn't cover. It's at roughly 2.6K stars and growing since the v0.1.1 release in May 2026. Read-only by design, which makes it safe to run in CI without write-access risk.