Perplexity's recent open-source Bumblebee is quite practical—read-only scanning without touching the production environment. The supply chain risk assessment finally has a handy tool.

Perplexity AI announces the open-source security scanning tool Bumblebee, a read-only asset collector for macOS/Linux that quickly inventories local dependencies, package management metadata, editor plugins, and AI tool configurations, using read-only parsing to ensure safety. It offers baseline, project, and deep three configurations, supporting extraction of dependency information from over ten ecosystems including npm, pypi, and go modules. It is open-sourced on GitHub under Apache 2.0, version v0.1.1, helping enterprise security teams assess risk exposure during supply chain attacks.