Bumblebee is a production-grade supply-chain inventory collector for macOS and Linux developer endpoints. It scans the filesystem for package metadata from lockfiles (npm, pnpm, yarn, bun, gomod, rubygems, composer), install receipts (Homebrew, Python dist-info, Go sum), extension manifests (VS Code, browser extensions), and MCP configuration files. The system outputs NDJSON records of installed packages and can optionally match them against operator-supplied threat intelligence catalogs to emit findings for known malicious packages. It is a single Go binary with zero runtime dependencies, designed for offline, read-only operation. Architecturally, it follows a modular scanner pattern with a generic filesystem walker, per-ecosystem scanners, an exposure catalog loader, and a pluggable output sink (stdout, file, or HTTP with bearer/HMAC auth and gzip). The repository also includes a threat_intel directory of curated supply-chain attack data and a tool to convert OSV records into its catalog format. Although primarily an application, it has a strong data component through its structured threat intelligence catalogs, making it a hybrid that leans towards a security scanning tool.