BoxLang AI vs CrewAI

BoxLang AI 50

Self-hosted rule, scored on the paid option. No payment protocol (0). BoxLang runtime plans are public without a login, Starter $749 a year and BoxLang+ and BoxLang++ from $1,999 to $4,999 a server or node a year, plan pricing rather than per unit (10). The Apache-2.0 module installs with no card (20) and no account or sign-up (20). 50 in all.

CrewAI 40

No payment protocol (0). Scored on CrewAI AMP, the hosted option. Its free Basic plan is public but the only paid plan is contact-sales (0). The MIT package installs with no card (20) and no account, and can run a local model through LiteLLM (20).

BoxLang AI 66

Read with the local-software lines. Official package on ForgeBox, installed with install-bx-module bx-ai or box install bx-ai, with BoxLang 1.14.0 or later in box.json and JDK 21 in CONTRIBUTING.md, but the 3.6 announcement says BoxLang 1.18 or later (18 of 20). tests.yml runs about 140 test classes against Ollama and the vector stores in Docker Compose, and against paid providers on development and releases, on pull requests and pushes to development. Whether runs pass wasn't read, since WebFetch refused github.com (15 of 25). Open issues and replies weren't read for the same reason. The changelog closes issues #182 to #259 in 3.3.1 to 3.4.0, and bugs also go to Ortus's Jira (10 of 25). Keep a Changelog with semantic versioning stated and Migration sections, but breaking changes ship in minor releases (8 of 15). 3.6.0, past 1.0 (15). 66 in all.

CrewAI 75

Official package on PyPI with Requires-Python >=3.10,<3.14 in the pyproject at 1.15.33 (20). The Run Tests workflow runs the suite on pull requests only, and CodeQL, a vulnerability scan and a nightly canary run on main; run results weren't re-read on 1 November because GitHub's pages answer 403 (15). Between 99 and 184 open issues, triaged with labels and a stale bot, per the 1 October check, not re-read on 1 November (18). A dated changelog that notes deprecations, but no written versioning policy, new capabilities ship in patch releases, and 1.15.29, a patch release on 23 October 2026, removed public import paths and changed how every agent runs, marked as breaking only on 28 October (7). 1.15.33, stable (15).

BoxLang AI 70

Apache-2.0, OSI approved, though the licence file sits in src/main/resources rather than the repository root (30). The FAQ says prompts and history go to the chosen cloud provider and that Ollama keeps data local, and we found no telemetry in the source, but there's no statement for the module of what, if anything, Ortus receives. Ortus's privacy policy covers its website and customers and says data is collected when you use its products without naming which (15 of 30). Migration notes are dated in the changelog, and default models were moved off a Groq model on its removal date, but there's no written deprecation policy or support window (10 of 20). No telemetry statement either way in the docs (10 of 20). 65 in all.

CrewAI 79

MIT (30). The telemetry page lists what's collected and what isn't, but doesn't say where it goes or how long it's kept (15). Deprecations such as function_calling_llm and allow_code_execution appear in the dated changelog and docs, with no written deprecation policy (10). Telemetry disclosed in the docs and README with two opt-out variables (20).

BoxLang AI 74

Framework reading, scored on what a tool-calling agent with MCP takes. An agent with an MCP server is one aiAgent() call with mcpServers, and toolFilter and prefix limit what each server adds. Skills can load lazily, but autoLoadSkills is on by default and injects every SKILL.md under /.agents/skills into every agent (20 of 25). MaxToolCallsMiddleware caps tool calls, window and summary memory bound history by messages or tokens, withMaxResponseBytes caps MCP answers and listTools( cursor ) pages tools (17 of 20). Named exceptions (ProviderError, UnsupportedCapability, InvalidArgument, MCPCommandRefused, BXAI.SecurityViolation) but no reference page, and the changelog says a timed-out call still surfaces as a JSON parse error (12 of 20). RetryMiddleware with exponential backoff, approval resumes that don't replay the model call or rerun executed tools, and a stdio client that never repeats an in-flight call. MCP tool annotations such as readOnlyHint aren't read (15 of 20). An agent needs a name and works with defaults, and a mock provider runs with no key, but it is one language (10 of 15). 74 in all.

CrewAI 80

The mcps field gives an agent an MCP server in five lines, with static and dynamic tool filters and tool-list caching (25). max_iter defaults to 20, max_execution_time and max_rpm cap runs, and respect_context_window is on by default (20). MCP connection failures are logged as warnings and the agent carries on without those tools, and we found no exception reference (10). max_retry_limit retries an agent twice on error, and Flows persist state with @persist (20). An agent needs role, goal and backstory before it does anything, and it's Python only (5).

BoxLang AI 71

Framework reading. 30 for what leaves the machine and credentials, 20 for approvals and sandboxing, 15 for prompt injection, 15 for audit and 20 for the security programme. No telemetry in the module's source, requests go only to configured providers, keys come from settings or environment variables, and request logging is off by default. 3.4.0 fixed a Gemini key leaking into logs through the request URL (27 of 30). Approval is enforced in code by HumanInTheLoopMiddleware with five policies, GuardrailMiddleware blocks tools by name and argument pattern, and stdio commands never use a shell. All of it is opt-in. allowedCommands allows any executable by default, FileSystemTools allows any path without allowedPaths, and the MCP server has no authentication unless configured (12 of 20). Unicode hygiene and fencing of ${context} are on by default, with opt-in input sanitiser, LLM judge and output guard. Streaming guards detect after the fact, which the changelog says (14 of 15). About 70 interception points, LoggingMiddleware, FlightRecorderMiddleware and MCP server statistics, with no OpenTelemetry export (11 of 15). CONTRIBUTING.md asks for reports to security@ortussolutions.com and the Slack #security channel. No security.txt (410), no bounty, and no published advisory found, while 3.6.0 lists a SQL injection fix in MySQL vector memory under Fixed (7 of 20). 71 in all.

CrewAI 65

Anonymous telemetry on by default (versions, crew and agent configuration, tool usage, agent roles and tool names, no prompts or task descriptions), off with CREWAI_DISABLE_TELEMETRY or OTEL_SDK_DISABLED (20). Pre-tool-call hooks can block a call or ask a person to approve it, and MCP tools can be allow-listed, but there's no sandbox now that CodeInterpreterTool is gone (15). Task guardrails and hooks, and the MCP page says to trust a server before using it, but we found no prompt-injection guidance (10). Tracing to CrewAI AMP or third-party tools such as Langfuse and MLflow (12). A security policy in the repository with private reporting through GitHub, security@crewai.com, response times, safe harbour and a CVE commitment through GitHub's CNA, and a valid security.txt that points to it. No paid bug bounty. The four March 2026 CVEs came through CERT/CC, and October fixes cite two GHSA ids that OSV didn't list on 1 November (8). Framework reading, so SOC 2 isn't scored.

BoxLang AI 83

3.6.0 on 2026-10-20 (30). Three releases in the 90 days to 1 November, 3.4.0 on 1 September, 3.5.0 on 11 September and 3.6.0 on 20 October (20). 79 commits on the development branch in those 90 days from Luis Majano, Doug Cain, Copilot and dependency bots, with pull requests up to #326 merged on 1 November. Issue reply times couldn't be read (10 of 25). The ForgeBox package is current at 3.6.0 (15). Dependabot for Gradle monthly and Actions quarterly, tests on pull requests and development, and a format check (8 of 10). 83 in all.

CrewAI 88

1.15.33, tagged on 2026-10-29 (30). 23 stable releases tagged in the 90 days from 3 August, 1.15.11 (4 August) to 1.15.33, and no pre-release in that window (20). Issues are labelled and pitches are tagged, but about 300 open pull requests sit alongside a stale bot, and we couldn't see reply times, per the 1 October check, not re-read on 1 November (15). The Python package is current (15). CodeQL, a vulnerability scan and Dependabot run on main, but Python 3.14 isn't supported yet and dev builds share the PyPI name (8).