BoxLang AI vs Claude Agent SDK

BoxLang AI 74

Framework reading, scored on what a tool-calling agent with MCP takes. An agent with an MCP server is one aiAgent() call with mcpServers, and toolFilter and prefix limit what each server adds. Skills can load lazily, but autoLoadSkills is on by default and injects every SKILL.md under /.agents/skills into every agent (20 of 25). MaxToolCallsMiddleware caps tool calls, window and summary memory bound history by messages or tokens, withMaxResponseBytes caps MCP answers and listTools( cursor ) pages tools (17 of 20). Named exceptions (ProviderError, UnsupportedCapability, InvalidArgument, MCPCommandRefused, BXAI.SecurityViolation) but no reference page, and the changelog says a timed-out call still surfaces as a JSON parse error (12 of 20). RetryMiddleware with exponential backoff, approval resumes that don't replay the model call or rerun executed tools, and a stdio client that never repeats an in-flight call. MCP tool annotations such as readOnlyHint aren't read (15 of 20). An agent needs a name and works with defaults, and a mock provider runs with no key, but it is one language (10 of 15). 74 in all.

Claude Agent SDK 95

The documented agent with one MCP server is about 15 lines with the built-in client, and tool search, the default, withholds MCP tool definitions, both re-read on the MCP page on 1 November (25). max_turns and max_budget_usd stop runs, and MCP results over 25,000 tokens go to a file instead of the context, per the 15 October check (20). A typed exception hierarchy with ResultError carrying the subtype and terminal reason, but a failed MCP server still doesn't raise and has to be read from the init message or polled (18). Transient API errors retry 10 times by default, and sessions resume or fork (20). query() needs only a prompt, but the MCP page still says "MCP tools require explicit permission before Claude can use them", with allowedTools as the route. Since Claude Code 2.1.302, which Python 0.2.176 and TypeScript 0.3.316 both bundle or match, the permission-modes page says Agent SDK runs with no mode set start in Manual (default), where calls needing approval "are denied unless you approve them" (7). Python and TypeScript (5). 25+20+18+20+7+5 = 95. Judgement call. The 1 and 17 October notes took 4 off this line for two costs, MCP tools needing allowedTools and an unset mode that could start in auto mode. The second has gone. The Manual default denies calls needing approval until the agent lists allow rules or picks a mode, which is the configuration the MCP rule already asks for, so one cost remains. Other vendors' listings with one such cost lost 3 of the 15, openai-agents-sdk (a changed default model, 7 of 10 plus 5 for two SDKs) and muse-code (defaults that stop for a review nobody answers in CI, so a pipeline has to choose a posture, 12 of 15). We took that reading. Keeping 6 would count one cost twice, and the lighter reading gives 8.

BoxLang AI 71

Framework reading. A reference page for each built-in function with its arguments, and tool schemas generated from typed function arguments with required fields since 3.3.1. BoxLang is dynamically typed and no published API reference was found, though the repository builds DocBox API docs (15 of 25). llms.txt with about 150 entries and a Markdown copy of every page (10). The FAQ says when to use aiChat() or aiAgent() and the security guide says which guards to use when, though some FAQ links still say coming soon for pages that exist (14 of 20). Tool arguments are typed with required lists, and stdio options a server doesn't have throw InvalidArgument (11 of 15). About 100 example scripts in the repository and a gallery on ai.boxlang.io, but the production guide catches RateLimitException, TimeoutException and AuthenticationException, which the module's source never throws, and there is no exception reference (9 of 15). Keep a Changelog and a release-history page per version, but the 3.6.0 page still read unreleased on 1 November and two old versions appear twice in the changelog (12 of 15). 71 in all.

Claude Agent SDK 89

Typed public interfaces with a full Python and TypeScript reference, options as dataclasses and TypedDicts (25). llms.txt at code.claude.com/docs/llms.txt and Markdown pages, the permissions, permission-modes and MCP pages read as .md on 1 November (10). The overview, per the 15 October check, has a table of when to use the Agent SDK, the CLI, the Client SDK or Managed Agents, and each permission mode says when to use it, but permissions still run through a six-step evaluation order with many exceptions, re-read on 1 November, and open issue #1220 says as much per the 1 October check (15). Permission modes and MCP server configs are typed variants, Python 0.2.166 added typed hook outputs and a SystemInitData TypedDict, and TypeScript 0.3.312 to 0.3.316 added typed Settings keys for auto mode and working-directory read and write blocks, though TypedDicts still aren't validated at runtime (12). Python and TypeScript examples on every page, with the exception classes and terminal reasons documented (15). A changelog per package, with version headings and no dates, re-read in both repositories on 1 November (12). 25+10+15+12+15+12 = 89.

BoxLang AI 70

Apache-2.0, OSI approved, though the licence file sits in src/main/resources rather than the repository root (30). The FAQ says prompts and history go to the chosen cloud provider and that Ollama keeps data local, and we found no telemetry in the source, but there's no statement for the module of what, if anything, Ortus receives. Ortus's privacy policy covers its website and customers and says data is collected when you use its products without naming which (15 of 30). Migration notes are dated in the changelog, and default models were moved off a Groq model on its removal date, but there's no written deprecation policy or support window (10 of 20). No telemetry statement either way in the docs (10 of 20). 65 in all.

Claude Agent SDK 83

The Python wrapper is MIT, but its wheel bundles the proprietary Claude Code binary, and the TypeScript package's LICENSE.md still says All rights reserved under Anthropic's Commercial Terms, both re-read in the clones on 1 November (18). The data-usage page, re-read on 1 November, states 30-day retention for commercial and API users, zero data retention for qualified accounts, no training on commercial data and 30 days of local transcripts in ~/.claude/projects, but still names the logging and error-tracking services only as third parties (25). Deprecations appear in the changelogs without dates, and there's no written deprecation policy for the SDK (8). Telemetry is documented per provider, with an opt-out for each service (20). 18+25+8+20 = 71. Judgement call on the licence line, written on Claude.

BoxLang AI 71

Framework reading. 30 for what leaves the machine and credentials, 20 for approvals and sandboxing, 15 for prompt injection, 15 for audit and 20 for the security programme. No telemetry in the module's source, requests go only to configured providers, keys come from settings or environment variables, and request logging is off by default. 3.4.0 fixed a Gemini key leaking into logs through the request URL (27 of 30). Approval is enforced in code by HumanInTheLoopMiddleware with five policies, GuardrailMiddleware blocks tools by name and argument pattern, and stdio commands never use a shell. All of it is opt-in. allowedCommands allows any executable by default, FileSystemTools allows any path without allowedPaths, and the MCP server has no authentication unless configured (12 of 20). Unicode hygiene and fencing of ${context} are on by default, with opt-in input sanitiser, LLM judge and output guard. Streaming guards detect after the fact, which the changelog says (14 of 15). About 70 interception points, LoggingMiddleware, FlightRecorderMiddleware and MCP server statistics, with no OpenTelemetry export (11 of 15). CONTRIBUTING.md asks for reports to security@ortussolutions.com and the Slack #security channel. No security.txt (410), no bounty, and no published advisory found, while 3.6.0 lists a SQL injection fix in MySQL vector memory under Fixed (7 of 20). 71 in all.

Claude Agent SDK 83

Usage metrics go to Anthropic and third-party logging by default on the Claude API, without code, prompts or file paths, and DISABLE_TELEMETRY=1 turns them off. They're off by default on Google Cloud, Bedrock, Foundry and Claude Platform on AWS, unless a host platform sets CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST. WebFetch sends hostnames to api.anthropic.com for a blocklist check on every provider, with its own opt-out. All re-read on the data-usage page on 1 November (20). canUseTool approval callback and PreToolUse hooks, plan and dontAsk modes with deny rules, and sandbox settings for shell commands, re-read on the permissions page on 1 November. TypeScript 0.3.301 added per-tool always_ask and always_deny policies for in-process MCP servers, and 0.3.314 and 0.3.316 typed blockWritesOutsideWorkingDirectories and blockReadsExemptPaths (20). Hooks can block a call and auto mode runs a classifier on actions, but there's no input or output guardrail primitive (10). OpenTelemetry export to your own collector stays off until CLAUDE_CODE_ENABLE_TELEMETRY=1 is set, prompt and tool content need separate flags, and tool_decision and permission_mode_changed events can form a per-user audit trail, per the observability page read on 15 October (15). HackerOne bug bounty, advisories published on the claude-code repository, whose SECURITY.md is unchanged in the clone, and anthropic.com's security.txt valid to 31 December 2026, re-read on 1 November, but neither the Python nor the TypeScript SDK repository has a SECURITY.md, checked again in both clones on 1 November (18). 20+20+10+15+18 = 83. Framework reading, so SOC 2 isn't scored, as for claude-code. The bundled CLI's advisories are counted under negative events, not here.

BoxLang AI 50

Self-hosted rule, scored on the paid option. No payment protocol (0). BoxLang runtime plans are public without a login, Starter $749 a year and BoxLang+ and BoxLang++ from $1,999 to $4,999 a server or node a year, plan pricing rather than per unit (10). The Apache-2.0 module installs with no card (20) and no account or sign-up (20). 50 in all.

Claude Agent SDK 40

No payment protocol (0). Claude model prices and Managed Agents at $0.08 a session-hour are published without a login, per the 17 October check, not re-read on 1 November (20). The package is free and needs no card (20). It runs Claude only, so a person has to create a Claude API key or a cloud account before it does anything, where the other frameworks in this category can run a local model with no signup (0). 0+20+20+0 = 40. Judgement call, and it goes against Anthropic's own listing. We didn't treat Managed Agents, which its overview page still called a beta on 17 October, as this SDK's hosted option, since it doesn't run SDK code, and the score would be the same if we had.