Compare · bake-off
bezoar vs Company B
Bootstrapped OSS CLI. No published benchmark — so we ran one. 88.2% vs 25.4% detection. 0 vs 391 false positives. Fixture: 13/13 vs 6/13.
Same corpus · default configs
| Metric | bezoar | Company B |
|---|---|---|
| Detection (626 malicious) | 88.2% | 25.4% |
| Flagged, absolute | 552/626 | 159/626 |
| False positives (737 official) | 0 | 391 |
| False positives (180 MCP Registry) | 0 | 0 |
| Curated fixture | 13/13 | 6/13 |
| Curated benign flagged | 0/6 | 2/6 |
Why the gap
- One Critical substring rule on
eval,exec,shell.evalmatchesevaluation; “when shell access is available” in a README is Critical. That rule drives most of the 391 FP and 159 hits. - 18 of 293 rules are prompt rules — “ignore previous instructions” shapes only. Tool poisoning and conceal-from-user shadowing aren't in the taxonomy.
- Default config, all phases, no login, one scan per sample, no tuning. “Flagged” is High or Critical — their threshold. Corpus and JSON public.
Beyond the scanner
Company B is a scanner. bezoar is a control plane. Scope gap, not a bake-off.
| Capability | bezoar | Company B |
|---|---|---|
| Desktop guard — allow / ask / deny | macOS · Linux | scanner only |
| MCP gateway — scan · pin · rug-pull | stdio · HTTP | scanner only |
| Install quarantine + trust ledger | bezoar fetch | scanner only |
| Fleet inventory + finding lifecycle | self-hosted console | scanner only |
| CI ingest + notifications | bezoar ingest | scanner only |
| Policy history · diff · restore | yes | scanner only |
| Framework mappings on every rule | OWASP · ATLAS · ATT&CK · CWE | scanner only |