{ "data": { "a": { "slug": "boxlang-ai", "name": "BoxLang AI", "vendor": "Ortus Solutions", "vendorUrl": "https://ai.boxlang.io", "kind": "framework", "category": "frameworks", "summary": "BoxLang AI (bx-ai) is Ortus Solutions' Apache-2.0 agent framework for BoxLang on the JVM, with agents, tools, memory, RAG, human approval, and an MCP client and server across more than 15 model providers.", "url": "https://www.anchorterminal.com/tools/boxlang-ai", "markdownUrl": "https://www.anchorterminal.com/tools/boxlang-ai.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/boxlang-ai.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/boxlang-ai.json", "dns": "boxlang-ai.grade.anchorterminal.com", "repo": "https://github.com/ortus-boxlang/bx-ai", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "forgebox", "name": "bx-ai" } ], "auth": "none", "authNotes": "A library with no account of its own. Model providers need their own keys, set in boxlang.json or read from each provider's environment variable (OPENAI_API_KEY, CLAUDE_API_KEY and so on). Ollama, Docker Model Runner and the mock provider need no key.", "pricing": "free", "pricingNotes": "Free under Apache-2.0. Model calls are billed by the provider. Ortus sells optional BoxLang runtime plans from $749 a year (Starter, one server) to $4,999 a node a year (BoxLang++), which the readme says add more vector memories and an Agent Dashboard.", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "Local library. No x402, MPP or L402 in the repository, the docs or the plans page, checked 1 November 2026.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-01" }, "docsUrl": "https://ai.ortusbooks.com", "llmsTxt": "https://ai.ortusbooks.com/llms.txt", "capabilities": [ "agent.framework", "agent.multi-agent", "agent.mcp-client" ], "tags": [ "framework", "boxlang", "jvm", "open-source", "apache-2.0", "mcp", "llms-txt", "free" ], "lastRelease": "2026-10-20", "graded": true, "anchor": { "graded": true, "score": 65.8, "grade": "B", "agentReady": false, "rank": 328, "ranked": true, "rankOf": 1260, "categoryRank": 10, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 83, "payments": 50, "reliability": 66, "schema": 71, "security": 71, "transparency": 70 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -3, "negativeNotes": [ "2026-10-20. -3, a breaking change in a minor release without advance notice. 3.6.0 renamed the `MCPClient` class to `MCPHttpClient` with no alias, so code that created the class directly must move to `MCP( url )`. The changelog's Migration section says so on release day. 3.5.0 (11 September) likewise raised the minimum BoxLang runtime from 1.8.0 to 1.14.0. One term at the floor, as google-adk's minor-release breaking changes took. https://github.com/ortus-boxlang/bx-ai/blob/main/changelog.md" ], "verdict": "A JVM agent framework with human approval, guardrail middleware and an MCP client over HTTP and stdio, all enforced in code, with three releases in the 90 days to 1 November 2026. It runs only on BoxLang, the stronger guards are opt-in, and minor releases have renamed public classes without a deprecation period.", "bestFor": "Teams already running BoxLang or modernising CFML on the JVM who want agents, RAG and MCP with approval and guardrails in the same language", "strengths": [ "Human approval enforced in code, with suspended runs that resume without replaying the model call, five approval policies and durable grants", "Untrusted context is fenced and inbound text Unicode-normalised by default, with opt-in sanitiser, LLM-judge and output-redaction middleware", "stdio MCP servers start without a shell, with an allowedCommands setting, per-server tool filters and prefixes, and restart limits", "Three releases in the 90 days to 1 November 2026 (3.4.0, 3.5.0, 3.6.0), with a Keep a Changelog file and migration notes", "llms.txt and a Markdown copy of every docs page, plus about 100 runnable example scripts in the repository" ], "weaknesses": [ "Runs only on BoxLang, a JVM language, so it suits teams already on BoxLang or CFML rather than Python or TypeScript stacks", "Minor releases carry breaking changes. 3.6.0 renamed MCPClient to MCPHttpClient with no alias, noted on release day", "The stdio command allow-list, filesystem tool paths and MCP server authentication are all open by default", "Docs lag the code. On 1 November the 3.6.0 release page still read unreleased and didn't mention the stdio MCP client", "No OpenTelemetry export found. Tracing is through BoxLang interception points, logging and flight-recorder middleware" ], "agentNotes": [ "Set `mcp.stdio.allowedCommands` to the executables you need. The default empty list lets any command start as a stdio MCP server.", "Pass `allowedPaths` when you create FileSystemTools. With none, its tools can read, write and delete anywhere the JVM user can.", "Attach HumanInTheLoopMiddleware with a checkpointer for tools that write or spend. Approval is opt-in.", "Create MCP clients with `MCP()` rather than the class, since 3.6.0 renamed MCPClient to MCPHttpClient without an alias.", "Use the `mock` provider to test agent wiring and guardrails with no API key or network." ], "metrics": { "kind": "library", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 65.8 } ], "editorialScores": { "ergonomics": 74, "maintenance": 83, "payments": 50, "reliability": 66, "schema": 71, "security": 71, "transparency": 65 }, "provenanceScore": 74, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "install-bx-module bx-ai # in a web app: box install bx-ai" }, "letme": { "capability": "https://letme.dev/agent.framework", "tool": "https://letme.dev/boxlang-ai" }, "sameCompany": [ "bx-playwright" ], "area": "frameworks", "provenance": { "legalEntity": "Ortus Solutions, Corp.", "domain": "ortussolutions.com", "domainRegistered": "2006-04-12", "endpointOnVendorDomain": null, "terms": "https://github.com/ortus-boxlang/bx-ai/blob/main/src/main/resources/LICENSE", "privacy": "https://www.ortussolutions.com/about-us/ortus-privacy-policy", "statusPage": "", "changelog": "https://github.com/ortus-boxlang/bx-ai/blob/main/changelog.md", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "The readme names Ortus Solutions, Corp as copyright holder, and box.json names Ortus Solutions as author.", "domainRegistered is from Verisign's RDAP record for ortussolutions.com. rdap.org has no record for boxlang.io, so the product domain's date wasn't read.", "security.txt answers 410 on www.ortussolutions.com and boxlang.io. CONTRIBUTING.md asks for vulnerability reports to security@ortussolutions.com.", "The Apache 2.0 licence stands in for terms. The privacy policy covers Ortus's website and customers, not the module.", "Local software, so there is no endpoint or status page." ], "score": 74 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/boxlang-ai.json" }, "answer": "BoxLang AI scores 65.8 (B) on agent readiness against Cursor Agent SDK's 63.7 (B), and leads in 4 of 7 scored categories. Cursor Agent SDK leads on schema \u0026 documentation and agent ergonomics.", "b": { "slug": "cursor-agent-sdk", "name": "Cursor Agent SDK", "vendor": "Cursor", "vendorUrl": "https://cursor.com/docs/agent-sdk", "kind": "framework", "category": "frameworks", "summary": "Cursor's TypeScript framework for defining an agent as a folder of instructions, typed tools, skills, MCP connections and channels, testing it with evals, and running it on your own server or on Cursor's hosting.", "url": "https://www.anchorterminal.com/tools/cursor-agent-sdk", "markdownUrl": "https://www.anchorterminal.com/tools/cursor-agent-sdk.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cursor-agent-sdk.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cursor-agent-sdk.json", "dns": "cursor-agent-sdk.grade.anchorterminal.com", "license": "Proprietary. The package's LICENSE.md reads \"© Anysphere Inc. All rights reserved\", with use subject to Cursor's Terms of Service (updated 3 September 2026). No source repository is published", "transports": [], "packages": [ { "registry": "npm", "name": "@grok/agent-sdk" } ], "auth": "mixed", "authNotes": "Model turns need a Cursor credential. `agent-sdk login` opens a browser sign-in and stores the key it creates, or pass a user API key from the dashboard or a team service-account key as `--api-key`, `CURSOR_API_KEY`, `CURSOR_API_KEY_FILE` or `CURSOR_SERVICE_ACCOUNT_KEY`. `logout` doesn't revoke the key. Direct tool calls without a model turn need no Cursor key. A self-hosted server is protected with `--bearer-token`, and a deployment's routes with an alias token.", "pricing": "byo-plan", "pricingNotes": "The package is free to install. Model turns draw on the Cursor plan of the key's owner, Free ($0, limited agent requests) to Ultra ($200 a month), and beyond the weekly pool the default model, Grok 4.5 with Fast on, is $4 per million input tokens and $18 per million output tokens. No price for Cursor-managed hosting and no statement of which plans include the Agent SDK were found (checked 2026-10-27).", "priceSummary": "Your plan", "where": "library", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Agent SDK docs, the npm package or the pricing page (checked 2026-10-27).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-27" }, "docsUrl": "https://cursor.com/docs/agent-sdk", "llmsTxt": "https://cursor.com/llms.txt", "capabilities": [ "agent.framework", "agent.mcp-client", "agent.durable", "agent.multi-agent", "obs.evals" ], "tags": [ "official", "framework", "typescript", "closed-source", "mcp", "llms-txt", "pre-1.0", "self-hosted", "hosted", "new" ], "lastRelease": "2026-10-25", "graded": true, "anchor": { "graded": true, "score": 63.7, "grade": "B", "agentReady": false, "rank": 437, "ranked": true, "rankOf": 1260, "categoryRank": 12, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 80, "maintenance": 74, "payments": 30, "reliability": 45, "schema": 82, "security": 68, "transparency": 71 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-27" }, "negative": 0, "verdict": "An agent-as-code framework with typed tools, declared read and write effects that drive retries and dry runs, an approval gate per tool and evals that assert on tool calls. It's closed source, every model turn runs through Cursor's backend on a Cursor plan, local sandboxing is off by default, and the changelog has two entries.", "bestFor": "Teams already on Cursor who want version-controlled agents for pull request review, triage and Slack, with evals in CI and one-command hosting.", "strengths": [ "Tools declare a read, write or idempotent effect. Only reads and idempotent calls retry, and dry-run sessions stub writes", "`needsApproval` on a tool parks the call until a person approves, and `ctx.approvedBy` records who did", "Evals assert which tools ran, with what input, and the reply's shape, and `github replay` turns a real pull request into signed test deliveries", "Every page has a Markdown twin listed in cursor.com/llms.txt, and the package ships the same docs and an llms.txt", "Sessions keep a record of every message and tool call, and OpenTelemetry export stays off until an endpoint is set" ], "weaknesses": [ "Closed source under Cursor's terms, with no public repository, CI or issue tracker", "Every model turn runs through Cursor's backend with a Cursor credential, including on a self-hosted server", "Local sandboxing is off by default, so shell commands auto-approve with the host's credentials", "The changelog has two entries, 0.2.29 and 0.3.0, both dated 23 October 2026. The 27 earlier @cursor/bdk versions have none", "The launch post's install command names a package that doesn't exist on npm" ], "agentNotes": [ "Install `@grok/agent-sdk`, not `@cursor/agent-sdk` from the launch post. That name answers 404 on npm", "Set `local.sandbox` before a turn reads webhook payloads, pull request diffs or chat. Without it shell commands auto-approve with the host's credentials", "Give every tool an `effect`. A tool without one counts as a write, runs once and is stubbed in dry runs", "Start `agent-sdk serve` with `--bearer-token` on any shared host. `--allow-anonymous` admits every caller as one principal", "Delete bot/hooks/memory.ts when sessions serve different people. The journal shares each turn's message and result with later turns" ], "metrics": { "kind": "library", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 63.7 } ], "editorialScores": { "ergonomics": 80, "maintenance": 74, "payments": 30, "reliability": 45, "schema": 82, "security": 68, "transparency": 49 }, "provenanceScore": 92, "checked": { "categories": { "ergonomics": "2026-10-27", "maintenance": "2026-10-27", "payments": "2026-10-27", "reliability": "2026-10-27", "schema": "2026-10-27", "security": "2026-10-27", "transparency": "2026-10-27" }, "last": "2026-10-27", "lastMoved": "2026-10-28", "oldest": "2026-10-27", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install --global @grok/agent-sdk", "headless": { "run": "agent-sdk run --dir . --message \"Introduce yourself in one sentence.\"" } }, "letme": { "capability": "https://letme.dev/agent.framework", "tool": "https://letme.dev/cursor-agent-sdk" }, "sameCompany": [ "cursor-cli", "grok-bot" ], "area": "frameworks", "unitPrices": [ { "item": "Grok 4.5 Fast (the default model) input, beyond the weekly pool", "unit": "1m-tokens", "usd": 4, "note": "cache reads $1" }, { "item": "Grok 4.5 Fast (the default model) output, beyond the weekly pool", "unit": "1m-tokens", "usd": 18 }, { "item": "Grok 4.5 input, Fast off, beyond the weekly pool", "unit": "1m-tokens", "usd": 2, "note": "cache reads $0.50" }, { "item": "Grok 4.5 output, Fast off, beyond the weekly pool", "unit": "1m-tokens", "usd": 6 }, { "item": "Premium plan (first plan with Cloud Agents and third-party models)", "unit": "month", "usd": 30 } ], "provenance": { "legalEntity": "Anysphere, Inc.", "domain": "cursor.com", "domainRegistered": "1995-12-20", "endpointOnVendorDomain": null, "terms": "https://cursor.com/terms-of-service", "privacy": "https://cursor.com/privacy", "statusPage": "https://status.cursor.com", "changelog": "https://cursor.com/docs/agent-sdk/changelog", "securityTxt": "valid", "checked": "2026-10-27", "notes": [ "The package's LICENSE.md and the site footer name Anysphere, Inc. The terms of service are dated 3 September 2026 and the privacy policy 11 October 2026.", "RDAP (Verisign) gives cursor.com a registration date of 1995-12-20.", "cursor.com/.well-known/security.txt has a Contact line pointing to github.com/getcursor/cursor/security and a secondary email, and no Expires line. The site's tracker reads a file with a Contact and no Expires as valid, as on the Cursor CLI listing.", "The footer links status.cursor.com. Its robots.txt answered with a Cloudflare challenge on 27 October 2026, so the status page wasn't read.", "The npm package's repository field points to github.com/cursor/cursor, which holds only a README and SECURITY.md." ], "score": 92 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cursor-agent-sdk.json", "live": { "slug": "cursor-agent-sdk", "vendorStatus": { "page": "https://status.cursor.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-02T01:00:41.266588542Z" }, "versions": [ { "registry": "npm", "name": "@grok/agent-sdk", "version": "0.5.0", "seenAt": "2026-11-01T16:53:08.44773046Z" } ], "npmWeekly": 8460, "securityTxt": { "url": "https://cursor.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-01T15:42:29.831441679Z" }, "llmsTxt": { "url": "https://cursor.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-01T15:13:32.02971531Z" }, "domain": { "domain": "cursor.com", "registered": "1995-12-20", "source": "https://rdap.verisign.com/com/v1/domain/cursor.com", "checkedAt": "2026-11-01T14:10:15.995316039Z" }, "pages": [ { "url": "https://cursor.com/docs/agent-sdk/changelog", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-01T06:38:23.081853471Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e878680a2c18" }, { "url": "https://cursor.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-01T06:38:27.173334664Z", "changedAt": "2026-10-21T00:22:04.890633076Z", "fingerprint": "60c67a53fa8c" }, { "url": "https://cursor.com/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-01T06:38:29.093075804Z", "changedAt": "2026-10-21T00:22:07.052190293Z", "fingerprint": "d31f70e876bc" } ], "updatedAt": "2026-11-02T01:00:41.266588542Z" } }, "edges": [ { "by": 21, "category": "reliability", "leads": "boxlang-ai", "name": "Reliability", "reasons": { "a": "Read with the local-software lines. Official package on ForgeBox, installed with `install-bx-module bx-ai` or `box install bx-ai`, with BoxLang 1.14.0 or later in box.json and JDK 21 in CONTRIBUTING.md, but the 3.6 announcement says BoxLang 1.18 or later (18 of 20). tests.yml runs about 140 test classes against Ollama and the vector stores in Docker Compose, and against paid providers on development and releases, on pull requests and pushes to development. Whether runs pass wasn't read, since WebFetch refused github.com (15 of 25). Open issues and replies weren't read for the same reason. The changelog closes issues #182 to #259 in 3.3.1 to 3.4.0, and bugs also go to Ortus's Jira (10 of 25). Keep a Changelog with semantic versioning stated and Migration sections, but breaking changes ship in minor releases (8 of 15). 3.6.0, past 1.0 (15). 66 in all.", "b": "Local-package reading, since the owner runs the framework, with Cursor's hosting as an option. Official npm package with Node 22.13 or newer stated in engines and in the docs, which also say never Bun (20). Closed source, so no public CI or test suite (0). No public issue tracker. github.com/cursor/cursor holds a README and SECURITY.md, and forum.cursor.com has no Agent SDK tag, so there's nothing to count open crashes against. The troubleshooting page lists known failures with fixes (5). A dated changelog of two entries, 0.2.29 and 0.3.0, both 23 October 2026, and 0.3.0 calls out the removed `persistent` option, but the 27 earlier @cursor/bdk versions and 123 @cursor/july versions have no notes, and one build ships under three package names (5). Version 0.3.0, but the changelog post of 20 October says generally available and the docs changelog labels 0.3.0 the GA release, which we read as declared stable (15). 20+0+5+5+15 = 45." }, "scores": { "a": 66, "b": 45 } }, { "by": 20, "category": "payments", "leads": "boxlang-ai", "name": "Payments \u0026 pricing", "reasons": { "a": "Self-hosted rule, scored on the paid option. No payment protocol (0). BoxLang runtime plans are public without a login, Starter $749 a year and BoxLang+ and BoxLang++ from $1,999 to $4,999 a server or node a year, plan pricing rather than per unit (10). The Apache-2.0 module installs with no card (20) and no account or sign-up (20). 50 in all.", "b": "Framework reading of the published rubric. No payment protocol (0). Per-million-token prices for Cursor models, including the default Grok 4.5 with Fast, and plan prices are public, but no price for managed hosting and no statement of which plans cover the Agent SDK were found (15). The package is free and the Free plan needs no card, but its usage is only described as limited agent requests (15). A person signs in through a browser or creates an API key in the dashboard before a model turn runs (0). 0+15+15+0 = 30." }, "scores": { "a": 50, "b": 30 } }, { "by": 11, "category": "schema", "leads": "cursor-agent-sdk", "name": "Schema \u0026 documentation", "reasons": { "a": "Framework reading. A reference page for each built-in function with its arguments, and tool schemas generated from typed function arguments with required fields since 3.3.1. BoxLang is dynamically typed and no published API reference was found, though the repository builds DocBox API docs (15 of 25). llms.txt with about 150 entries and a Markdown copy of every page (10). The FAQ says when to use aiChat() or aiAgent() and the security guide says which guards to use when, though some FAQ links still say coming soon for pages that exist (14 of 20). Tool arguments are typed with required lists, and stdio options a server doesn't have throw InvalidArgument (11 of 15). About 100 example scripts in the repository and a gallery on ai.boxlang.io, but the production guide catches RateLimitException, TimeoutException and AuthenticationException, which the module's source never throws, and there is no exception reference (9 of 15). Keep a Changelog and a release-history page per version, but the 3.6.0 page still read unreleased on 1 November and two old versions appear twice in the changelog (12 of 15). 71 in all.", "b": "Framework reading. Typed TypeScript declarations ship in the package, tools take Zod or JSON Schema, `agent-sdk help --json` describes every command's flags and exit codes, and `GET /v1/info` and `GET /v1/tools/:name` return the discovered surface and each tool's schemas. No OpenAPI document for the HTTP routes (20). cursor.com/llms.txt lists every Agent SDK page with a Markdown twin, and the package ships the docs and an llms.txt (10). The overview has a table of when to use the Agent SDK, Automations or Grok Bot, and the hooks page has a table of what to use instead of a hook for each job (18). Typed config, `effect` as an enum or predicate, `timeArgs` checked against the input schema, and slug patterns stated (13). Examples on every page, with error tables for direct tool calls, HTTP 401, 403 and 409, the limit error's JSON and seven exit codes (15). A dated changelog, but only two entries, both from 23 October 2026 (6). 20+10+18+13+15+6 = 82." }, "scores": { "a": 71, "b": 82 } }, { "by": 9, "category": "maintenance", "leads": "boxlang-ai", "name": "Maintenance \u0026 community", "reasons": { "a": "3.6.0 on 2026-10-20 (30). Three releases in the 90 days to 1 November, 3.4.0 on 1 September, 3.5.0 on 11 September and 3.6.0 on 20 October (20). 79 commits on the development branch in those 90 days from Luis Majano, Doug Cain, Copilot and dependency bots, with pull requests up to #326 merged on 1 November. Issue reply times couldn't be read (10 of 25). The ForgeBox package is current at 3.6.0 (15). Dependabot for Gradle monthly and Actions quarterly, tests on pull requests and development, and a format check (8 of 10). 83 in all.", "b": "0.3.0 on npm on 25 October 2026 (30). Five @grok/agent-sdk versions from 22 to 25 October and 29 @cursor/bdk versions since 22 September (20). Closed product. A public changelog with two entries and a forum with no Agent SDK tag, so we couldn't see replies to SDK reports (8). The npm package is current and official, TypeScript only (12). Dependencies are current releases, but there's no public CI and the same build goes out under three names with a postinstall script (4). 30+20+8+12+4 = 74." }, "scores": { "a": 83, "b": 74 } }, { "by": 6, "category": "ergonomics", "leads": "cursor-agent-sdk", "name": "Agent ergonomics", "reasons": { "a": "Framework reading, scored on what a tool-calling agent with MCP takes. An agent with an MCP server is one `aiAgent()` call with `mcpServers`, and `toolFilter` and `prefix` limit what each server adds. Skills can load lazily, but `autoLoadSkills` is on by default and injects every SKILL.md under /.agents/skills into every agent (20 of 25). MaxToolCallsMiddleware caps tool calls, window and summary memory bound history by messages or tokens, `withMaxResponseBytes` caps MCP answers and `listTools( cursor )` pages tools (17 of 20). Named exceptions (ProviderError, UnsupportedCapability, InvalidArgument, MCPCommandRefused, BXAI.SecurityViolation) but no reference page, and the changelog says a timed-out call still surfaces as a JSON parse error (12 of 20). RetryMiddleware with exponential backoff, approval resumes that don't replay the model call or rerun executed tools, and a stdio client that never repeats an in-flight call. MCP tool annotations such as readOnlyHint aren't read (15 of 20). An agent needs a name and works with defaults, and a mock provider runs with no key, but it is one language (10 of 15). 74 in all.", "b": "Framework reading, scored on what it takes to run a tool-calling agent with MCP. One file per tool and one file per MCP connection, `tools` and `disallowedTools` filters with `effects: \"read\"`, and an allowlist for the harness's built-in tools (22). Concurrency caps with queued turns, `--fields`, page tokens and limits on list commands, and a per-session cost view. We found no turn cap or spend cap for a run (12). Built-in routes return `{ ok: false, error }` codes, direct tool calls have documented 400, 404, 409 and 500 codes, and the CLI has seven exit codes (18). Reads and idempotent calls retry up to three times, writes run once, MCP readOnlyHint and idempotentHint decide retries for connection tools, and dry-run sessions stub writes (20). `agent-sdk init` scaffolds a working project and every agent field is optional, but the framework is TypeScript only (8). 22+12+18+20+8 = 80." }, "scores": { "a": 74, "b": 80 } } ], "facts": [ { "a": "Agent framework", "b": "Agent framework", "name": "Kind" }, { "a": "Ortus Solutions", "b": "Cursor", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "None", "b": "OAuth or key", "name": "Auth" }, { "a": "Free", "b": "Your plan", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0", "b": "Proprietary. The package's LICENSE.md reads \"© Anysphere Inc. All rights reserved\", with use subject to Cursor's Terms of Service (updated 3 September 2026). No source repository is published", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-20", "b": "2026-10-25", "name": "Last release" }, { "a": "no date given", "b": "2026-09-03", "name": "Terms last updated" }, { "a": "no date given", "b": "2026-09-29", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" } ], "faq": [ { "answer": "BoxLang AI scores 65.8 (B) on agent readiness against Cursor Agent SDK's 63.7 (B), and leads in 4 of 7 scored categories. Cursor Agent SDK leads on schema \u0026 documentation and agent ergonomics.", "question": "Which is better for AI agents, BoxLang AI or Cursor Agent SDK?" }, { "answer": "BoxLang AI is open source (Apache-2.0). No open-source release is listed for Cursor Agent SDK.", "question": "Are BoxLang AI and Cursor Agent SDK open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 66 against 45", "Payments \u0026 pricing, 50 against 30", "Maintenance \u0026 community, 83 against 74" ], "also": [ "No key needed to call it", "Open source" ], "goodFor": "Teams already running BoxLang or modernising CFML on the JVM who want agents, RAG and MCP with approval and guardrails in the same language", "slug": "boxlang-ai", "watchFor": "Runs only on BoxLang, a JVM language, so it suits teams already on BoxLang or CFML rather than Python or TypeScript stacks" }, { "aheadOn": [ "Schema \u0026 documentation, 82 against 71", "Agent ergonomics, 80 against 74" ], "also": [ "No incidents deducted, where BoxLang AI loses 3 points for them" ], "goodFor": "Teams already on Cursor who want version-controlled agents for pull request review, triage and Slack, with evals in CI and one-command hosting.", "slug": "cursor-agent-sdk", "watchFor": "Closed source under Cursor's terms, with no public repository, CI or issue tracker" } ], "history": { "boxlang-ai": null, "cursor-agent-sdk": [ { "causes": [ "method" ], "date": "2026-10-28", "delta": 0.1, "from": 63.6, "fromGrade": "B", "to": 63.7, "toGrade": "B" } ] }, "job": { "capability": "agent.framework", "name": "Agent frameworks" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentos-vs-boxlang-ai.json", "title": "AgentOS vs BoxLang AI", "url": "https://www.anchorterminal.com/compare/agentos-vs-boxlang-ai" }, { "json": "https://www.anchorterminal.com/compare/agentos-vs-cursor-agent-sdk.json", "title": "AgentOS vs Cursor Agent SDK", "url": "https://www.anchorterminal.com/compare/agentos-vs-cursor-agent-sdk" }, { "json": "https://www.anchorterminal.com/compare/agno-vs-boxlang-ai.json", "title": "Agno vs BoxLang AI", "url": "https://www.anchorterminal.com/compare/agno-vs-boxlang-ai" }, { "json": "https://www.anchorterminal.com/compare/agno-vs-cursor-agent-sdk.json", "title": "Agno vs Cursor Agent SDK", "url": "https://www.anchorterminal.com/compare/agno-vs-cursor-agent-sdk" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-claude-agent-sdk.json", "title": "BoxLang AI vs Claude Agent SDK", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-claude-agent-sdk" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-crewai.json", "title": "BoxLang AI vs CrewAI", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-crewai" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-docker-agent.json", "title": "BoxLang AI vs Docker Agent", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-docker-agent" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-google-adk.json", "title": "BoxLang AI vs Agent Development Kit (ADK)", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-google-adk" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-guilds-run.json", "title": "BoxLang AI vs guilds.run", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-langgraph.json", "title": "BoxLang AI vs LangGraph", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-langgraph" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-microsoft-agent-framework.json", "title": "BoxLang AI vs Microsoft Agent Framework", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-microsoft-agent-framework" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-openai-agents-sdk.json", "title": "BoxLang AI vs OpenAI Agents SDK", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-openai-agents-sdk" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-pydantic-ai.json", "title": "BoxLang AI vs Pydantic AI", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-pydantic-ai" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-tradingagents.json", "title": "BoxLang AI vs TradingAgents", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-cursor-agent-sdk.json", "title": "Claude Agent SDK vs Cursor Agent SDK", "url": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-cursor-agent-sdk" }, { "json": "https://www.anchorterminal.com/compare/crewai-vs-cursor-agent-sdk.json", "title": "CrewAI vs Cursor Agent SDK", "url": "https://www.anchorterminal.com/compare/crewai-vs-cursor-agent-sdk" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-docker-agent.json", "title": "Cursor Agent SDK vs Docker Agent", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-docker-agent" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-google-adk.json", "title": "Cursor Agent SDK vs Agent Development Kit (ADK)", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-google-adk" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-guilds-run.json", "title": "Cursor Agent SDK vs guilds.run", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-langgraph.json", "title": "Cursor Agent SDK vs LangGraph", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-langgraph" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-microsoft-agent-framework.json", "title": "Cursor Agent SDK vs Microsoft Agent Framework", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-microsoft-agent-framework" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-openai-agents-sdk.json", "title": "Cursor Agent SDK vs OpenAI Agents SDK", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-openai-agents-sdk" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-pydantic-ai.json", "title": "Cursor Agent SDK vs Pydantic AI", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-pydantic-ai" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-tradingagents.json", "title": "Cursor Agent SDK vs TradingAgents", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-tradingagents" } ], "panel": null, "scores": [ { "boxlang-ai": 66, "by": 21, "cursor-agent-sdk": 45, "edge": "boxlang-ai", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "boxlang-ai": 71, "by": 11, "cursor-agent-sdk": 82, "edge": "cursor-agent-sdk", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "boxlang-ai": 74, "by": 6, "cursor-agent-sdk": 80, "edge": "cursor-agent-sdk", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "boxlang-ai": 71, "by": 3, "cursor-agent-sdk": 68, "edge": "boxlang-ai", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "boxlang-ai": 50, "by": 20, "cursor-agent-sdk": 30, "edge": "boxlang-ai", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "boxlang-ai": 83, "by": 9, "cursor-agent-sdk": 74, "edge": "boxlang-ai", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "boxlang-ai": 70, "by": 1, "cursor-agent-sdk": 71, "edge": "cursor-agent-sdk", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "BoxLang AI scores 65.8 (B) on agent readiness against Cursor Agent SDK's 63.7 (B), and leads in 4 of 7 scored categories. Cursor Agent SDK leads on schema \u0026 documentation and agent ergonomics. Both do agent frameworks.", "tasks": null, "tutorials": [], "verdicts": { "boxlang-ai": "A JVM agent framework with human approval, guardrail middleware and an MCP client over HTTP and stdio, all enforced in code, with three releases in the 90 days to 1 November 2026. It runs only on BoxLang, the stronger guards are opt-in, and minor releases have renamed public classes without a deprecation period.", "cursor-agent-sdk": "An agent-as-code framework with typed tools, declared read and write effects that drive retries and dry runs, an approval gate per tool and evals that assert on tool calls. It's closed source, every model turn runs through Cursor's backend on a Cursor plan, local sandboxing is off by default, and the changelog has two entries." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/boxlang-ai-vs-cursor-agent-sdk", "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-cursor-agent-sdk.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/boxlang-ai-vs-cursor-agent-sdk.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/boxlang-ai-vs-cursor-agent-sdk.min.md" }, "markdown": "BoxLang AI scores 65.8 (B) on agent readiness against Cursor Agent SDK's 63.7 (B), and leads in 4 of 7 scored categories. Cursor Agent SDK leads on schema \u0026 documentation and agent ergonomics. Both do agent frameworks.\n\n- BoxLang AI: grade B, 65.8/100, rank #328 of 1260. Markdown https://www.anchorterminal.com/tools/boxlang-ai.md · JSON https://www.anchorterminal.com/api/v1/tools/boxlang-ai.json\n- Cursor Agent SDK: grade B, 63.7/100, rank #437 of 1260. Markdown https://www.anchorterminal.com/tools/cursor-agent-sdk.md · JSON https://www.anchorterminal.com/api/v1/tools/cursor-agent-sdk.json\n- Best agent frameworks and SDKs: https://www.anchorterminal.com/best/frameworks/index.md\n- All 91 frameworks comparisons: https://www.anchorterminal.com/compare/frameworks/index.md\n\n## Which one, for what\n\n### BoxLang AI (B)\n\nGood for: Teams already running BoxLang or modernising CFML on the JVM who want agents, RAG and MCP with approval and guardrails in the same language\n\nAhead on:\n- Reliability, 66 against 45\n- Payments \u0026 pricing, 50 against 30\n- Maintenance \u0026 community, 83 against 74\n\nAlso in its favour:\n- No key needed to call it\n- Open source\n\nWatch for: Runs only on BoxLang, a JVM language, so it suits teams already on BoxLang or CFML rather than Python or TypeScript stacks\n\n### Cursor Agent SDK (B)\n\nGood for: Teams already on Cursor who want version-controlled agents for pull request review, triage and Slack, with evals in CI and one-command hosting.\n\nAhead on:\n- Schema \u0026 documentation, 82 against 71\n- Agent ergonomics, 80 against 74\n\nAlso in its favour:\n- No incidents deducted, where BoxLang AI loses 3 points for them\n\nWatch for: Closed source under Cursor's terms, with no public repository, CI or issue tracker\n\n\n## Why the edge\n\n### Reliability: BoxLang AI +21\n\n- BoxLang AI (66): Read with the local-software lines. Official package on ForgeBox, installed with `install-bx-module bx-ai` or `box install bx-ai`, with BoxLang 1.14.0 or later in box.json and JDK 21 in CONTRIBUTING.md, but the 3.6 announcement says BoxLang 1.18 or later (18 of 20). tests.yml runs about 140 test classes against Ollama and the vector stores in Docker Compose, and against paid providers on development and releases, on pull requests and pushes to development. Whether runs pass wasn't read, since WebFetch refused github.com (15 of 25). Open issues and replies weren't read for the same reason. The changelog closes issues #182 to #259 in 3.3.1 to 3.4.0, and bugs also go to Ortus's Jira (10 of 25). Keep a Changelog with semantic versioning stated and Migration sections, but breaking changes ship in minor releases (8 of 15). 3.6.0, past 1.0 (15). 66 in all.\n- Cursor Agent SDK (45): Local-package reading, since the owner runs the framework, with Cursor's hosting as an option. Official npm package with Node 22.13 or newer stated in engines and in the docs, which also say never Bun (20). Closed source, so no public CI or test suite (0). No public issue tracker. github.com/cursor/cursor holds a README and SECURITY.md, and forum.cursor.com has no Agent SDK tag, so there's nothing to count open crashes against. The troubleshooting page lists known failures with fixes (5). A dated changelog of two entries, 0.2.29 and 0.3.0, both 23 October 2026, and 0.3.0 calls out the removed `persistent` option, but the 27 earlier @cursor/bdk versions and 123 @cursor/july versions have no notes, and one build ships under three package names (5). Version 0.3.0, but the changelog post of 20 October says generally available and the docs changelog labels 0.3.0 the GA release, which we read as declared stable (15). 20+0+5+5+15 = 45.\n\n### Payments \u0026 pricing: BoxLang AI +20\n\n- BoxLang AI (50): Self-hosted rule, scored on the paid option. No payment protocol (0). BoxLang runtime plans are public without a login, Starter $749 a year and BoxLang+ and BoxLang++ from $1,999 to $4,999 a server or node a year, plan pricing rather than per unit (10). The Apache-2.0 module installs with no card (20) and no account or sign-up (20). 50 in all.\n- Cursor Agent SDK (30): Framework reading of the published rubric. No payment protocol (0). Per-million-token prices for Cursor models, including the default Grok 4.5 with Fast, and plan prices are public, but no price for managed hosting and no statement of which plans cover the Agent SDK were found (15). The package is free and the Free plan needs no card, but its usage is only described as limited agent requests (15). A person signs in through a browser or creates an API key in the dashboard before a model turn runs (0). 0+15+15+0 = 30.\n\n### Schema \u0026 documentation: Cursor Agent SDK +11\n\n- BoxLang AI (71): Framework reading. A reference page for each built-in function with its arguments, and tool schemas generated from typed function arguments with required fields since 3.3.1. BoxLang is dynamically typed and no published API reference was found, though the repository builds DocBox API docs (15 of 25). llms.txt with about 150 entries and a Markdown copy of every page (10). The FAQ says when to use aiChat() or aiAgent() and the security guide says which guards to use when, though some FAQ links still say coming soon for pages that exist (14 of 20). Tool arguments are typed with required lists, and stdio options a server doesn't have throw InvalidArgument (11 of 15). About 100 example scripts in the repository and a gallery on ai.boxlang.io, but the production guide catches RateLimitException, TimeoutException and AuthenticationException, which the module's source never throws, and there is no exception reference (9 of 15). Keep a Changelog and a release-history page per version, but the 3.6.0 page still read unreleased on 1 November and two old versions appear twice in the changelog (12 of 15). 71 in all.\n- Cursor Agent SDK (82): Framework reading. Typed TypeScript declarations ship in the package, tools take Zod or JSON Schema, `agent-sdk help --json` describes every command's flags and exit codes, and `GET /v1/info` and `GET /v1/tools/:name` return the discovered surface and each tool's schemas. No OpenAPI document for the HTTP routes (20). cursor.com/llms.txt lists every Agent SDK page with a Markdown twin, and the package ships the docs and an llms.txt (10). The overview has a table of when to use the Agent SDK, Automations or Grok Bot, and the hooks page has a table of what to use instead of a hook for each job (18). Typed config, `effect` as an enum or predicate, `timeArgs` checked against the input schema, and slug patterns stated (13). Examples on every page, with error tables for direct tool calls, HTTP 401, 403 and 409, the limit error's JSON and seven exit codes (15). A dated changelog, but only two entries, both from 23 October 2026 (6). 20+10+18+13+15+6 = 82.\n\n### Maintenance \u0026 community: BoxLang AI +9\n\n- BoxLang AI (83): 3.6.0 on 2026-10-20 (30). Three releases in the 90 days to 1 November, 3.4.0 on 1 September, 3.5.0 on 11 September and 3.6.0 on 20 October (20). 79 commits on the development branch in those 90 days from Luis Majano, Doug Cain, Copilot and dependency bots, with pull requests up to #326 merged on 1 November. Issue reply times couldn't be read (10 of 25). The ForgeBox package is current at 3.6.0 (15). Dependabot for Gradle monthly and Actions quarterly, tests on pull requests and development, and a format check (8 of 10). 83 in all.\n- Cursor Agent SDK (74): 0.3.0 on npm on 25 October 2026 (30). Five @grok/agent-sdk versions from 22 to 25 October and 29 @cursor/bdk versions since 22 September (20). Closed product. A public changelog with two entries and a forum with no Agent SDK tag, so we couldn't see replies to SDK reports (8). The npm package is current and official, TypeScript only (12). Dependencies are current releases, but there's no public CI and the same build goes out under three names with a postinstall script (4). 30+20+8+12+4 = 74.\n\n### Agent ergonomics: Cursor Agent SDK +6\n\n- BoxLang AI (74): Framework reading, scored on what a tool-calling agent with MCP takes. An agent with an MCP server is one `aiAgent()` call with `mcpServers`, and `toolFilter` and `prefix` limit what each server adds. Skills can load lazily, but `autoLoadSkills` is on by default and injects every SKILL.md under /.agents/skills into every agent (20 of 25). MaxToolCallsMiddleware caps tool calls, window and summary memory bound history by messages or tokens, `withMaxResponseBytes` caps MCP answers and `listTools( cursor )` pages tools (17 of 20). Named exceptions (ProviderError, UnsupportedCapability, InvalidArgument, MCPCommandRefused, BXAI.SecurityViolation) but no reference page, and the changelog says a timed-out call still surfaces as a JSON parse error (12 of 20). RetryMiddleware with exponential backoff, approval resumes that don't replay the model call or rerun executed tools, and a stdio client that never repeats an in-flight call. MCP tool annotations such as readOnlyHint aren't read (15 of 20). An agent needs a name and works with defaults, and a mock provider runs with no key, but it is one language (10 of 15). 74 in all.\n- Cursor Agent SDK (80): Framework reading, scored on what it takes to run a tool-calling agent with MCP. One file per tool and one file per MCP connection, `tools` and `disallowedTools` filters with `effects: \"read\"`, and an allowlist for the harness's built-in tools (22). Concurrency caps with queued turns, `--fields`, page tokens and limits on list commands, and a per-session cost view. We found no turn cap or spend cap for a run (12). Built-in routes return `{ ok: false, error }` codes, direct tool calls have documented 400, 404, 409 and 500 codes, and the CLI has seven exit codes (18). Reads and idempotent calls retry up to three times, writes run once, MCP readOnlyHint and idempotentHint decide retries for connection tools, and dry-run sessions stub writes (20). `agent-sdk init` scaffolds a working project and every agent field is optional, but the framework is TypeScript only (8). 22+12+18+20+8 = 80.\n\n## Score by category\n\n| Category | Weight | BoxLang AI | Cursor Agent SDK | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 66 | 45 | BoxLang AI +21 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 71 | 82 | Cursor Agent SDK +11 |\n| Agent ergonomics | 13% (16.2 this run) | 74 | 80 | Cursor Agent SDK +6 |\n| Security \u0026 auth | 14% (17.5 this run) | 71 | 68 | BoxLang AI +3 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 50 | 30 | BoxLang AI +20 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 83 | 74 | BoxLang AI +9 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 70 | 71 | Cursor Agent SDK +1 |\n| Negative events | ≤15 | -3 | 0 | |\n| **Total** | | **65.8 · B** | **63.7 · B** | |\n\n## Facts side by side\n\n| Fact | BoxLang AI | Cursor Agent SDK |\n| --- | --- | --- |\n| Kind | Agent framework | Agent framework |\n| Vendor | Ortus Solutions | Cursor |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | None | OAuth or key |\n| Pricing | Free | Your plan |\n| x402 | no | no |\n| Licence | Apache-2.0 | Proprietary. The package's LICENSE.md reads \"© Anysphere Inc. All rights reserved\", with use subject to Cursor's Terms of Service (updated 3 September 2026). No source repository is published |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-10-20 | 2026-10-25 |\n| Terms last updated | no date given | 2026-09-03 |\n| Privacy policy last updated | no date given | 2026-09-29 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | yes |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | not found in the text | yes |\n| Arbitration or class-action waiver | not found in the text | yes |\n\n## How the scores have moved\n\n### BoxLang AI\n\nNo score change since it was listed.\n\n### Cursor Agent SDK\n\n- +0.1 on 28 October 2026: checklist\n\n## Verdicts\n\n**BoxLang AI.** A JVM agent framework with human approval, guardrail middleware and an MCP client over HTTP and stdio, all enforced in code, with three releases in the 90 days to 1 November 2026. It runs only on BoxLang, the stronger guards are opt-in, and minor releases have renamed public classes without a deprecation period.\n\n**Cursor Agent SDK.** An agent-as-code framework with typed tools, declared read and write effects that drive retries and dry runs, an approval gate per tool and evals that assert on tool calls. It's closed source, every model turn runs through Cursor's backend on a Cursor plan, local sandboxing is off by default, and the changelog has two entries.\n\n## Before you call either\n\n### BoxLang AI\n\n1. Set `mcp.stdio.allowedCommands` to the executables you need. The default empty list lets any command start as a stdio MCP server.\n2. Pass `allowedPaths` when you create FileSystemTools. With none, its tools can read, write and delete anywhere the JVM user can.\n3. Attach HumanInTheLoopMiddleware with a checkpointer for tools that write or spend. Approval is opt-in.\n4. Create MCP clients with `MCP()` rather than the class, since 3.6.0 renamed MCPClient to MCPHttpClient without an alias.\n5. Use the `mock` provider to test agent wiring and guardrails with no API key or network.\n\n### Cursor Agent SDK\n\n1. Install `@grok/agent-sdk`, not `@cursor/agent-sdk` from the launch post. That name answers 404 on npm\n2. Set `local.sandbox` before a turn reads webhook payloads, pull request diffs or chat. Without it shell commands auto-approve with the host's credentials\n3. Give every tool an `effect`. A tool without one counts as a write, runs once and is stubbed in dry runs\n4. Start `agent-sdk serve` with `--bearer-token` on any shared host. `--allow-anonymous` admits every caller as one principal\n5. Delete bot/hooks/memory.ts when sessions serve different people. The journal shares each turn's message and result with later turns\n\n## Questions\n\n### Which is better for AI agents, BoxLang AI or Cursor Agent SDK?\n\nBoxLang AI scores 65.8 (B) on agent readiness against Cursor Agent SDK's 63.7 (B), and leads in 4 of 7 scored categories. Cursor Agent SDK leads on schema \u0026 documentation and agent ergonomics.\n\n### Are BoxLang AI and Cursor Agent SDK open source?\n\nBoxLang AI is open source (Apache-2.0). No open-source release is listed for Cursor Agent SDK.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/boxlang-ai-vs-cursor-agent-sdk.json, and with the fewest tokens: https://www.anchorterminal.com/compare/boxlang-ai-vs-cursor-agent-sdk.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"boxlang-ai\", \"b\": \"cursor-agent-sdk\"}`. From a terminal: `anchor compare boxlang-ai cursor-agent-sdk`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/boxlang-ai.json and https://www.anchorterminal.com/api/v1/tools/cursor-agent-sdk.json\n\n## Other comparisons with BoxLang AI or Cursor Agent SDK\n\n- [AgentOS vs BoxLang AI](https://www.anchorterminal.com/compare/agentos-vs-boxlang-ai.md)\n- [AgentOS vs Cursor Agent SDK](https://www.anchorterminal.com/compare/agentos-vs-cursor-agent-sdk.md)\n- [Agno vs BoxLang AI](https://www.anchorterminal.com/compare/agno-vs-boxlang-ai.md)\n- [Agno vs Cursor Agent SDK](https://www.anchorterminal.com/compare/agno-vs-cursor-agent-sdk.md)\n- [BoxLang AI vs Claude Agent SDK](https://www.anchorterminal.com/compare/boxlang-ai-vs-claude-agent-sdk.md)\n- [BoxLang AI vs CrewAI](https://www.anchorterminal.com/compare/boxlang-ai-vs-crewai.md)\n- [BoxLang AI vs Docker Agent](https://www.anchorterminal.com/compare/boxlang-ai-vs-docker-agent.md)\n- [BoxLang AI vs Agent Development Kit (ADK)](https://www.anchorterminal.com/compare/boxlang-ai-vs-google-adk.md)\n- [BoxLang AI vs guilds.run](https://www.anchorterminal.com/compare/boxlang-ai-vs-guilds-run.md)\n- [BoxLang AI vs LangGraph](https://www.anchorterminal.com/compare/boxlang-ai-vs-langgraph.md)\n- [BoxLang AI vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/boxlang-ai-vs-microsoft-agent-framework.md)\n- [BoxLang AI vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/boxlang-ai-vs-openai-agents-sdk.md)\n- [BoxLang AI vs Pydantic AI](https://www.anchorterminal.com/compare/boxlang-ai-vs-pydantic-ai.md)\n- [BoxLang AI vs TradingAgents](https://www.anchorterminal.com/compare/boxlang-ai-vs-tradingagents.md)\n- [Claude Agent SDK vs Cursor Agent SDK](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-cursor-agent-sdk.md)\n- [CrewAI vs Cursor Agent SDK](https://www.anchorterminal.com/compare/crewai-vs-cursor-agent-sdk.md)\n- [Cursor Agent SDK vs Docker Agent](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-docker-agent.md)\n- [Cursor Agent SDK vs Agent Development Kit (ADK)](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-google-adk.md)\n- [Cursor Agent SDK vs guilds.run](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-guilds-run.md)\n- [Cursor Agent SDK vs LangGraph](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-langgraph.md)\n- [Cursor Agent SDK vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-microsoft-agent-framework.md)\n- [Cursor Agent SDK vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-openai-agents-sdk.md)\n- [Cursor Agent SDK vs Pydantic AI](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-pydantic-ai.md)\n- [Cursor Agent SDK vs TradingAgents](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-tradingagents.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-02", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "BoxLang AI vs Cursor Agent SDK", "url": "" } ], "description": "BoxLang AI scores 65.8 (B) to Cursor Agent SDK's 63.7 (B) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "BoxLang AI B 65.8", "Cursor Agent SDK B 63.7", "scores" ], "h1": "BoxLang AI vs Cursor Agent SDK", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/boxlang-ai-vs-cursor-agent-sdk", "published": "2026-10-01", "section": "tools", "title": "BoxLang AI vs Cursor Agent SDK for AI agents (2026) | Anchor Terminal", "toc": null, "updated": "2026-11-01", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-cursor-agent-sdk" }, "tokens": { "markdown": 4600, "slim": 2730 }, "version": 1 }