Auditing MCP Servers for Supply-Chain Risk with Bumblebee

Install a dozen MCP servers in a few months and you lose track of what any of them do. Most of us run one install command from a Discord recommendation, grant filesystem or terminal access, and move on. Bumblebee, an open-source CLI from Perplexity, targets that gap.

What it checks

Bumblebee is a read-only scanner written in Go with no external dependencies. That matters more than it sounds: a security tool carrying twenty transitive dependencies is a supply-chain risk pretending to solve one. It covers four surfaces:

• Package manifests across npm, PyPI, Go modules, RubyGems, and Composer
• Installed MCP servers, matched against known-malicious and suspicious registries
• VS Code extensions installed on the machine
• Browser extensions in your inventory

It changes nothing. It reads, compares against threat registries, and reports. You do not want the scanner to be the component with write access to your environment.

Where it sits next to npm audit and Snyk

npm audit, Dependabot, and Snyk handle package manifests well. None of them look at MCP servers, editor extensions, or browser extensions, and that gap grew as MCP servers started receiving broad permissions.

• npm audit and Dependabot track dependency vulnerabilities inside one ecosystem and run in CI.
• Snyk has a broader vulnerability database and better remediation guidance. It is paid beyond basic use, and it does not cover MCP servers as of this writing.
• Bumblebee has the narrower scope. It will not tell you how to fix a flagged package, and it is the only one of the three checking installed MCP servers, editor extensions, and browser extensions against threat data.

Most teams end up running more than one. Bumblebee covers the surfaces the others ignore.

Who needs it now

• Solo developers installing MCP servers from GitHub and Discord links. Least existing tooling covers this gap.
• Teams on shared dev machines or shared CI runners. A compromised server there becomes a lateral-movement problem.
• Anyone running servers with filesystem or terminal permissions. That access level is what makes a bad server dangerous.
• Teams enforcing extension allowlists through MDM. Lower priority, though a second check still helps.

Why MCP specifically

Auditing npm and PyPI packages is old ground. The MCP server check is new. MCP adoption ran ahead of its vetting culture, and the ecosystem resembles npm around 2015: many small, single-maintainer servers, thin review, and users granting filesystem access, terminal execution, and API keys without much thought.

A compromised MCP server is a program that can read your codebase and send data anywhere it likes. People grant that access in one click.

Running it

1. Install. Go 1.25 or newer.
source links: https://www.hamvero.space/blog/auditing-mcp-servers-bumblebee/