Bumblebee is a read-only inventory collector written in Go that scans macOS and Linux developer endpoints for installed packages, extensions, and developer tools, then emits NDJSON records (package, finding, scan_summary, diagnostic) to stdout, a file, or an HTTP sink. In production it walks the filesystem without executing package managers or discovered code, parsing on-disk metadata: lockfiles (npm, yarn, bun, pnpm, composer), Homebrew receipts, MCP config files, editor/browser extension manifests, and Go/Ruby/Python package registries. Its core value is supply-chain incident response: operators supply an exposure catalog (JSON of known-compromised (ecosystem, package, version) tuples) and Bumblebee correlates scanned inventory against it to emit finding records. This is hybrid — the repo bundles curated threat-intel data and an OSV-to-catalog converter — but the dominant character is a purpose-built CLI application, not a data pipeline. The architecture is a zero-runtime-dependency Go CLI (subcommands: scan, roots, selftest, version) with clean separation: an optimized filesystem walker (internal/walk) with symlink-loop protection and O(1) exclude checks, per-ecosystem scanner packages (internal/ecosystem/*), an exact-match exposure matcher (internal/exposure), stable content-addressed ID generation (internal/model), and pluggable output emitters including an HTTP sink with gzip/bearer/HMAC-SHA256 auth and batch batching. Scan profiles (baseline, project, deep) control root scope; deep targets bare-home incident response. Each ecosystem scanner is independently tested, CI runs a selftest against synthetic fixtures, output schemas are versioned under docs/schema, and releases are built via GoReleaser. Quality is strong: the zero-dependency stdlib constraint forces hand-rolled parsers, and several demonstrate non-obvious skill — notably the MCP config parser's credential-safe argument inference (prevents secret-bearing flag values from leaking into package identities) and the line-oriented pnpm lockfile parser handling v5/v6/v9 key formats without a YAML dependency. Sustainability mechanisms are real: versioned JSON Schemas that must be bumped rather than edited, provenance comments in threat-intel catalogs, an explicit state model (snapshot-only, no endpoint-side cache), and documented coverage gaps. Risks are operational rather than architectural: curated catalogs require manual PR-based updates, format drift in lockfile/MCP/extension metadata could silently drop records, and heuristic parsers are intentionally subset-based rather than exhaustive.