Compare
We measured. They didn't.
Competitors publish no detection benchmarks, so we ran them on the same 1,431-sample public corpus as bezoar. Default configs, no tuning, one isolated scan per sample. Corpus and per-tool results are public. Competitors are never named.
bezoar · public corpus
88.2%
blocked · 552/626 known-malicious
0
false positives · 737 official vendor skills
1,431
samples · public corpus
Corpus assembled from MCPTox, Connor, Invariant, MCPSecBench, official vendor skill repos, and the MCP Registry. 596/626 (95.2%) score potential_risk or above. Rules are in the repo; pip install bezoar && bezoar scan reproduces every bezoar number here.
Head-to-head · same corpus · default configs
| Metric | bezoar | Company A | Company B |
|---|---|---|---|
| Detection rate (626 malicious, public corpus) | 88.2% | 12.8% | 25.4% |
| Flagged, absolute | 552/626 | 80/626 | 159/626 |
| False positives (737 official vendor skills) | 0 | 181 | 391 |
| False positives (180 MCP Registry configs) | 0 | 0 | 0 |
Measured by us, not by them. Every tool got the same 1,431 sample directories, one scan each, stock flags, no allowlists, no extra rules. “Flagged” is each tool's own default failing threshold. Company A was run in its offline regex mode; it has no prompt-injection detection class, and its false positives include a bare ncat pattern matching inside truncate and concatenate. Company B's numbers are dominated by one substring rule (eval matching evaluation); 18 of its 293 rules cover prompt injection. Competitor results JSONs sit next to the corpus; nothing here was retuned after the fact.
Curated fixture · the small set · head-to-head
Being written
This page is in progress. The source of truth is the repository until it lands. Back to home.