Compare
Receipts, not quotes.
Same 1,431-sample corpus. Default configs. No tuning. Results public. Competitors never named.
$ bezoar scan ./my-skill --fail-on unsafe
✗ band=malicious decision=block components=1 findings=4
generic:skill:pdf-optimizer@a3f9c1e04b72 malicious → block (band_default)
[critical] harness_forgery/control-tag-close SKILL.md:16:1 [hidden]
Close of a trusted harness wrapper — the breakout primitive
evidence: </system-reminder>
[ high] harness_forgery/control-tag-open SKILL.md:17:1 [hidden]
Open of a reminder-role control tag with an imperative body
evidence: <system-reminder priority="critical">
[ high] harness_forgery/prose-terminator SKILL.md:22:1 [hidden]
Prose-form function-end marker (semantic escape)
evidence: [Function results halted by user]
[critical] prompt_injection/instruction-override SKILL.md:27:1
Instruction-override language
evidence: Ignore all previous instructions
$ echo $?
1
$ Public corpus
Same corpus. Same method.
They publish analyst quotes — we ran the numbers.
88.2%
known-malicious blocked
552/626 on the public corpus · 596/626 (95.2%) at potential_risk+
0
false positives
737 official vendor skills + registry configs — NVIDIA, AWS, Anthropic, HashiCorp, Stripe, MCP Registry
1,431
sample corpus
MCPTox · Connor · Invariant · MCPSecBench · vendor repos · MCP Registry. Reproducible.
Reproduce it
Public corpus. Versioned rules. One command, no account. We ran the competitors too — default configs, no tuning: 12.8% and 25.4% detection, 181 and 391 false positives.
pip install bezoar && bezoar scan ./corpusHead-to-head
Enterprise features. One compose file.
Same 1,431-sample corpus. Default configs. No tuning. Company A and B are scanner CLIs — suite rows are scope, not a bake-off.
| Capability | bezoar | Company A | Company B |
|---|---|---|---|
| Scanner · measured | |||
| Detection (626 malicious) | 88.2% | 12.8% | 25.4% |
| Flagged, absolute | 552/626 | 80/626 | 159/626 |
| False positives (737 official) | 0 | 181 | 391 |
| False positives (180 MCP Registry) | 0 | 0 | 0 |
| Curated fixture | 13/13 | 0/10 | 6/13 |
| Suite · 1.0.0a4 · scope, not a bake-off | |||
| Desktop guard — allow / ask / deny | macOS · Linux | scanner only | scanner only |
| MCP gateway — scan, pin, rug-pull | Yes | scanner only | scanner only |
| Install quarantine + trust ledger | Yes | scanner only | scanner only |
| Fleet inventory + finding lifecycle | Yes | scanner only | scanner only |
| CI ingest + Slack / Teams / email / webhook | Yes | scanner only | scanner only |
| Policy history — diff, restore, drift | Yes | scanner only | scanner only |
| Framework mappings (OWASP · ATLAS · ATT&CK) | Yes | scanner only | scanner only |
| Console | |||
| Self-hosted console | Yes | No | No |
| SSO as config | Yes | contact sales | No |
| Offline by default | Yes | No | No |
| Price | Apache-2.0 | annual contract | free CLI |
Curated fixture