How radioactivetobi/bumblebee-hive works
Bumblebee is a read-only endpoint inventory and exposure scanner; Hive adds fleet ingestion, persistence, query APIs, and a dashboard. The principal workflow scans endpoint metadata, optionally matches an exposure catalog, emits records to Hive, and presents fleet inventory and findings. Scanner orchestration and Hive wiring are sampled; individual ecosystem parsers and some UI/API implementation details are represented at their supported tree paths, with uncertain links omitted.
Main entry points: scanner.go Scan orchestrator · bumblebee/main.go Scanner CLI · hive/main.go Hive HTTP server · handler.go NDJSON ingest
Components 22
Endpoint scanning
- Scanner CLI
cmd/bumblebee/main.go - Root resolution
cmd/bumblebee/roots.go - Filesystem walker
internal/walk/walk.go - Scan orchestrator
internal/scanner/scanner.go - Ecosystem parsers
internal/ecosystem - Record normalization
internal/normalize/normalize.go - Record output
cmd/bumblebee/sink.go - HTTP output
internal/output/httpsink.go
Hive services
- Hive HTTP server
cmd/hive/main.go - NDJSON ingest
internal/ingest/handler.go - Ingest authentication
internal/ingest/auth.go - SQLite inventory store
internal/store/sqlite/sqlite.go - REST read API
internal/api/api.go
Fleet dashboard
- Dashboard routes
web/src/App.tsx - Fleet views
web/src/pages - API client
web/src/api.ts - Offline demo
web/src/pages/Demo.tsx
Exposure catalogs
- Exposure matching
internal/exposure/exposure.go - OSV catalog builder
tools/osvcatalog/main.go - OSV record mapping
internal/osv/osv.go
Other components
- Developer endpoint
- Security/platform user
Connections 23
- Developer endpoint → Scanner CLI: runs scan
- Scanner CLI → Root resolution: resolves roots
- Scanner CLI → Scan orchestrator: starts scan
- Root resolution → Scan orchestrator: provides roots
- Scan orchestrator → Filesystem walker: walks roots
- Scan orchestrator → Ecosystem parsers: dispatches files
- Scan orchestrator → Record normalization: normalizes records
- Scan orchestrator → Exposure matching: matches packages
- Scanner CLI → Record output: emits records
- Record output → HTTP output: sends batches
- HTTP output → Hive HTTP server: POSTs NDJSON
- Hive HTTP server → NDJSON ingest: routes ingest
- NDJSON ingest → Ingest authentication: verifies request
- NDJSON ingest → SQLite inventory store: ingests and promotes
- Hive HTTP server → REST read API: routes API
- REST read API → SQLite inventory store: queries inventory
- Security/platform user → Dashboard routes: uses dashboard
- Dashboard routes → Fleet views: renders routes
- Fleet views → API client: requests data
- API client → REST read API: calls endpoints
- Security/platform user → Offline demo: loads local file
- OSV catalog builder → OSV record mapping: builds catalog
- Scanner CLI → Exposure matching: loads catalog