Bumblebee Desktop is a macOS endpoint inventory app for local developer-machine supply-chain checks. It wraps the Bumblebee scanner in a desktop UI for scan scope selection, package inventory review, diagnostics, exposure findings, history, and threat catalog management.
The app is designed around the upstream scanner's incident-response model: when a known package, extension, or version appears in a Bumblebee threat catalog, does this endpoint have an exact local match in package metadata?
Signed and notarized macOS builds are published on the GitHub releases page:
Public site: https://bumblebee.drmhse.com
- Verified scan scope before scans run.
- Exact scan progress from the scanner stream: package records, findings, diagnostics, files considered, duration, and completion state.
- Inventory browsing with package search, ecosystem filters, confidence labels, root filters, and pagination.
- Exposure findings from bundled or synced threat catalog JSON files.
- Diagnostics for malformed local configs or skipped scan inputs.
- About, attribution, version, repository, and catalog provenance information.
Bumblebee Desktop bundles catalog JSON files copied from the upstream Bumblebee scanner project and can sync current catalog files from:
https://raw.githubusercontent.com/perplexityai/bumblebee/main/threat_intel/
The scanner and catalog format come from:
https://github.com/perplexityai/bumblebee
The Flutter app source is built from the local app/ project in this working tree. The release DMGs contain:
Bumblebee.app- Apache 2.0 license text
- distribution notice and upstream attribution
The bundled helper binaries are built from upstream Bumblebee v0.1.1 for each target architecture and pruned so each macOS DMG carries only the matching helper.
Dependencies are pinned. Release preparation runs a dependency-age audit so newly published registry packages are not silently introduced immediately before release.
The desktop app performs local scans through a bundled helper binary. It does not need cloud ingestion to show local inventory, diagnostics, or catalog matches.
This repository is licensed under the Apache License, Version 2.0. See LICENSE.
The bundled scanner and catalog format are derived from the upstream Bumblebee project, also licensed under Apache 2.0. See NOTICE for attribution.