Skip to content

88.2% of 626 known-malicious skills blocked — 0 false positives on 737 official vendor skills · corpus + method public

bezoar
GitHub

Open-source · Offline · Self-hostable

The AI-agent supply chain, scanned. Free.

88.2% of 626 known-malicious skills blocked. 0 false positives on 737 official vendor skills. Measured on a public corpus you can re-run.

uv tool install bezoar
See the numbers

No account. No upload. No demo call.

  • 136 versioned rules
  • 9 detection families
  • 0 network requests
  • Apache-2.0

Supply-chain hygiene, every release

Real output

One command. One exit code.

~/skills — bezoar scan ./my-skill
$ bezoar scan ./my-skill --fail-on unsafe

✗  band=malicious  decision=block  components=1  findings=4

generic:skill:pdf-optimizer@a3f9c1e04b72  malicious → block  (band_default)

  [critical] harness_forgery/control-tag-close      SKILL.md:16:1  [hidden]
             Close of a trusted harness wrapper — the breakout primitive
             evidence: </system-reminder>

  [    high] harness_forgery/control-tag-open       SKILL.md:17:1  [hidden]
             Open of a reminder-role control tag with an imperative body
             evidence: <system-reminder priority="critical">

  [    high] harness_forgery/prose-terminator       SKILL.md:22:1  [hidden]
             Prose-form function-end marker (semantic escape)
             evidence: [Function results halted by user]

  [critical] prompt_injection/instruction-override  SKILL.md:27:1
             Instruction-override language
             evidence: Ignore all previous instructions

$ echo $?
1
$

01/Proof

The numbers, not the quotes.

Measured on a public corpus with a published method. They publish analyst quotes, so we measured them too.

How we measure

The corpus is public. The rules are in the repo, versioned. Every number above comes from one command you can run yourself — no account, no upload, nothing to take on faith. We ran the competitors on the same corpus too, default configs, no tuning, results public: 12.8% and 25.4% detection, 181 and 391 false positives. Transparency is the feature.

pip install bezoar && bezoar scan ./corpus

Curated fixture · the small set

13/13 · 0 FP

The hand-picked 13-sample bake-off still holds (Company B: 6/13, 2/6 benign flagged). It's the fixture, not the headline. Read it.

02/How it works

Install, scan, gate.

Think npm audit for agent add-ons: offline-first, deterministic, CI-friendly, SARIF/JSON output. Same inputs, same report.

  1. Install

    01

    One tool, no account. Python ≥ 3.11.

    step 01
    $ uv tool install bezoar
$ bezoar version
bezoar 1.0.0a2

  2. Scan

    02

    Point it at a skill, MCP server, plugin, or repo root. Static detectors, four verdict bands, offline.

    step 02
    $ bezoar scan ./my-skill --format sarif
{"version":"2.1.0","runs":[…]}

  3. Gate

    03

    Band is a fact. Decision is policy — in .bezoar.yml, in CI, with baselines. Exit 1 means blocked.

    step 03
    $ bezoar scan . --fail-on unsafe \
    --baseline .bezoar-baseline.json
✓  band=safe  decision=allow

03/We measured. They didn't.

Everything they charge enterprise prices for, as a docker compose file.

Competitors publish no detection benchmarks, so we ran them on the same 1,431-sample public corpus as bezoar: default configs, no tuning, one scan per sample. Corpus and results are public. They are anonymized on purpose: Company A is a venture-backed vendor's OSS scanner; Company B is a bootstrapped OSS CLI.

Feature comparison: bezoar vs Company A vs Company B
CapabilitybezoarCompany ACompany B
Detection rate (626 malicious, public corpus)88.2%12.8%25.4%
False positives (737 official vendor skills)0181391
Curated fixture (small set)13/130/106/13
Self-hosted consoleYesNoNo
SSO as configYescontact salesNo
Offline by defaultYesNoNo
PriceApache-2.0annual contractfree CLI

All three measured by us, default configs, same corpus. Reproduce it yourself:

pip install bezoar && bezoar scan ./corpus
vs Company A vs Company B

04/Self-host

SSO, RBAC and an audit log are YAML keys, not a pricing tier.

The console is free because it's software, not a SKU. Deploy it in one command; configure the enterprise features by editing a file.

Or compose

docker compose -f bezoar.compose.yml up -d
bezoar.serve.yml
# enterprise features are configuration
auth:
  mode: oidc
  issuer: https://login.example.com
  client_id: bezoar-console

rbac:
  roles:
    admin: [security@example.com]
    viewer: [*@example.com]

audit:
  enabled: true
  retention_days: 365

# that's the enterprise tier.

05/Manifesto

Scanning the supply chain is hygiene. Hygiene is necessary — and it is not the same as safety.

We built bezoar so the hygiene layer costs nobody anything — and so the industry can stop confusing the two.

uv tool install bezoar
Read the manifesto