BoxLang AI vs smolagents

BoxLang AI 83

3.6.0 on 2026-10-20 (30). Three releases in the 90 days to 1 November, 3.4.0 on 1 September, 3.5.0 on 11 September and 3.6.0 on 20 October (20). 79 commits on the development branch in those 90 days from Luis Majano, Doug Cain, Copilot and dependency bots, with pull requests up to #326 merged on 1 November. Issue reply times couldn't be read (10 of 25). The ForgeBox package is current at 3.6.0 (15). Dependabot for Gradle monthly and Actions quarterly, tests on pull requests and development, and a format check (8 of 10). 83 in all.

smolagents 34

v1.26.0 on 29 May 2026, 161 days before this check (10). No release in the 90 days to 6 November (0). 416 open issues and 1,045 open issues and pull requests on 6 November, with 144 issues opened in the 90 days to 3 November. Of the 50 newest, 26 had a comment and 1 was closed. Two 2026 CVE records say the vendor didn't respond to the reporter, and seven commits reached main from 8 August to 6 November (6). Python only, and the package is the current one (10). CI with actions pinned to commit SHAs and Dependabot for actions (8). 10+0+6+10+8 = 34.

BoxLang AI 71

Framework reading. A reference page for each built-in function with its arguments, and tool schemas generated from typed function arguments with required fields since 3.3.1. BoxLang is dynamically typed and no published API reference was found, though the repository builds DocBox API docs (15 of 25). llms.txt with about 150 entries and a Markdown copy of every page (10). The FAQ says when to use aiChat() or aiAgent() and the security guide says which guards to use when, though some FAQ links still say coming soon for pages that exist (14 of 20). Tool arguments are typed with required lists, and stdio options a server doesn't have throw InvalidArgument (11 of 15). About 100 example scripts in the repository and a gallery on ai.boxlang.io, but the production guide catches RateLimitException, TimeoutException and AuthenticationException, which the module's source never throws, and there is no exception reference (9 of 15). Keep a Changelog and a release-history page per version, but the 3.6.0 page still read unreleased on 1 November and two old versions appear twice in the changelog (12 of 15). 71 in all.

smolagents 81

Framework reading. A typed Python API with reference pages for agents, models, tools and executors (22). llms.txt and Markdown pages on huggingface.co (10). The docs say when to use CodeAgent or ToolCallingAgent and when a sandbox is needed (17). Tools declare typed inputs in a schema dictionary or from a decorated function (12). Many runnable examples; error classes exist but aren't catalogued (10). Versions tagged with release notes, no changelog file (10). 22+10+17+12+10+10 = 81.

BoxLang AI 50

Self-hosted rule, scored on the paid option. No payment protocol (0). BoxLang runtime plans are public without a login, Starter $749 a year and BoxLang+ and BoxLang++ from $1,999 to $4,999 a server or node a year, plan pricing rather than per unit (10). The Apache-2.0 module installs with no card (20) and no account or sign-up (20). 50 in all.

smolagents 60

Self-hosted rule. Free Apache-2.0 package with nothing to buy from the project (20 + 20 + 20). No payment protocol (0). 0+20+20+20 = 60.

BoxLang AI 74

Framework reading, scored on what a tool-calling agent with MCP takes. An agent with an MCP server is one aiAgent() call with mcpServers, and toolFilter and prefix limit what each server adds. Skills can load lazily, but autoLoadSkills is on by default and injects every SKILL.md under /.agents/skills into every agent (20 of 25). MaxToolCallsMiddleware caps tool calls, window and summary memory bound history by messages or tokens, withMaxResponseBytes caps MCP answers and listTools( cursor ) pages tools (17 of 20). Named exceptions (ProviderError, UnsupportedCapability, InvalidArgument, MCPCommandRefused, BXAI.SecurityViolation) but no reference page, and the changelog says a timed-out call still surfaces as a JSON parse error (12 of 20). RetryMiddleware with exponential backoff, approval resumes that don't replay the model call or rerun executed tools, and a stdio client that never repeats an in-flight call. MCP tool annotations such as readOnlyHint aren't read (15 of 20). An agent needs a name and works with defaults, and a mock provider runs with no key, but it is one language (10 of 15). 74 in all.

smolagents 68

Framework reading. MCPClient loads an MCP server's tools in a few lines (20). max_steps, planning intervals and final_answer_checks bound a run (16). Errors from tools and code go back to the model as observations (14). No built-in retry, idempotency or resume beyond replaying memory (8). Few required parameters and many providers, Python only, and the default model needs a Hugging Face token (10). 20+16+14+8+10 = 68.

BoxLang AI 71

Framework reading. 30 for what leaves the machine and credentials, 20 for approvals and sandboxing, 15 for prompt injection, 15 for audit and 20 for the security programme. No telemetry in the module's source, requests go only to configured providers, keys come from settings or environment variables, and request logging is off by default. 3.4.0 fixed a Gemini key leaking into logs through the request URL (27 of 30). Approval is enforced in code by HumanInTheLoopMiddleware with five policies, GuardrailMiddleware blocks tools by name and argument pattern, and stdio commands never use a shell. All of it is opt-in. allowedCommands allows any executable by default, FileSystemTools allows any path without allowedPaths, and the MCP server has no authentication unless configured (12 of 20). Unicode hygiene and fencing of ${context} are on by default, with opt-in input sanitiser, LLM judge and output guard. Streaming guards detect after the fact, which the changelog says (14 of 15). About 70 interception points, LoggingMiddleware, FlightRecorderMiddleware and MCP server statistics, with no OpenTelemetry export (11 of 15). CONTRIBUTING.md asks for reports to security@ortussolutions.com and the Slack #security channel. No security.txt (410), no bounty, and no published advisory found, while 3.6.0 lists a SQL injection fix in MySQL vector memory under Fixed (7 of 20). 71 in all.

smolagents 66

Framework reading (telemetry defaults, approvals, guardrails, sandboxing). No telemetry found in the source (25). No human approval hook beyond step callbacks; the local executor restricts imports but the guide says it isn't a security tool, and isolation needs a remote executor (10). The secure execution guide covers LLM-generated code risks, without prompt-injection guidance for tool output (7). OpenTelemetry tracing through OpenInference and run inspection (12). SECURITY.md with private reporting and CVE credit, and the remote-executor RCE was fixed in public, but two 2026 CVE records say the vendor didn't respond (12). 25+10+7+12+12 = 66.

BoxLang AI 70

Apache-2.0, OSI approved, though the licence file sits in src/main/resources rather than the repository root (30). The FAQ says prompts and history go to the chosen cloud provider and that Ollama keeps data local, and we found no telemetry in the source, but there's no statement for the module of what, if anything, Ortus receives. Ortus's privacy policy covers its website and customers and says data is collected when you use its products without naming which (15 of 30). Migration notes are dated in the changelog, and default models were moved off a Groq model on its removal date, but there's no written deprecation policy or support window (10 of 20). No telemetry statement either way in the docs (10 of 20). 65 in all.

smolagents 65

Apache-2.0 (30). The library stores nothing itself; the default model sends prompts to Hugging Face's inference providers, which the docs show (20). Breaking removals such as WasmExecutor shipped in minor releases, without a written deprecation policy (5). No telemetry, though no page states it (12). 30+20+5+12 = 67.