Perplexity's Bumblebee Scans Your MCP Configs for Supply-Chain Threats — Without Running a Thing