{ "data": { "a": { "slug": "boxlang-ai", "name": "BoxLang AI", "vendor": "Ortus Solutions", "vendorUrl": "https://ai.boxlang.io", "kind": "framework", "category": "frameworks", "summary": "BoxLang AI (bx-ai) is Ortus Solutions' Apache-2.0 agent framework for BoxLang on the JVM, with agents, tools, memory, RAG, human approval, and an MCP client and server across more than 15 model providers.", "url": "https://www.anchorterminal.com/tools/boxlang-ai", "markdownUrl": "https://www.anchorterminal.com/tools/boxlang-ai.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/boxlang-ai.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/boxlang-ai.json", "dns": "boxlang-ai.grade.anchorterminal.com", "repo": "https://github.com/ortus-boxlang/bx-ai", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "forgebox", "name": "bx-ai" } ], "auth": "none", "authNotes": "A library with no account of its own. Model providers need their own keys, set in boxlang.json or read from each provider's environment variable (OPENAI_API_KEY, CLAUDE_API_KEY and so on). Ollama, Docker Model Runner and the mock provider need no key.", "pricing": "free", "pricingNotes": "Free under Apache-2.0. Model calls are billed by the provider. Ortus sells optional BoxLang runtime plans from $749 a year (Starter, one server) to $4,999 a node a year (BoxLang++), which the readme says add more vector memories and an Agent Dashboard.", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "Local library. No x402, MPP or L402 in the repository, the docs or the plans page, checked 1 November 2026.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-01" }, "docsUrl": "https://ai.ortusbooks.com", "llmsTxt": "https://ai.ortusbooks.com/llms.txt", "capabilities": [ "agent.framework", "agent.multi-agent", "agent.mcp-client" ], "tags": [ "framework", "boxlang", "jvm", "open-source", "apache-2.0", "mcp", "llms-txt", "free" ], "lastRelease": "2026-10-20", "graded": true, "anchor": { "graded": true, "score": 65.8, "grade": "B", "agentReady": false, "rank": 403, "ranked": true, "rankOf": 1510, "categoryRank": 14, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 83, "payments": 50, "reliability": 66, "schema": 71, "security": 71, "transparency": 70 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -3, "negativeNotes": [ "2026-10-20. -3, a breaking change in a minor release without advance notice. 3.6.0 renamed the `MCPClient` class to `MCPHttpClient` with no alias, so code that created the class directly must move to `MCP( url )`. The changelog's Migration section says so on release day. 3.5.0 (11 September) likewise raised the minimum BoxLang runtime from 1.8.0 to 1.14.0. One term at the floor, as google-adk's minor-release breaking changes took. https://github.com/ortus-boxlang/bx-ai/blob/main/changelog.md" ], "verdict": "A JVM agent framework with human approval, guardrail middleware and an MCP client over HTTP and stdio, all enforced in code, with three releases in the 90 days to 1 November 2026. It runs only on BoxLang, the stronger guards are opt-in, and minor releases have renamed public classes without a deprecation period.", "bestFor": "Teams already running BoxLang or modernising CFML on the JVM who want agents, RAG and MCP with approval and guardrails in the same language", "strengths": [ "Human approval enforced in code, with suspended runs that resume without replaying the model call, five approval policies and durable grants", "Untrusted context is fenced and inbound text Unicode-normalised by default, with opt-in sanitiser, LLM-judge and output-redaction middleware", "stdio MCP servers start without a shell, with an allowedCommands setting, per-server tool filters and prefixes, and restart limits", "Three releases in the 90 days to 1 November 2026 (3.4.0, 3.5.0, 3.6.0), with a Keep a Changelog file and migration notes", "llms.txt and a Markdown copy of every docs page, plus about 100 runnable example scripts in the repository" ], "weaknesses": [ "Runs only on BoxLang, a JVM language, so it suits teams already on BoxLang or CFML rather than Python or TypeScript stacks", "Minor releases carry breaking changes. 3.6.0 renamed MCPClient to MCPHttpClient with no alias, noted on release day", "The stdio command allow-list, filesystem tool paths and MCP server authentication are all open by default", "Docs lag the code. On 1 November the 3.6.0 release page still read unreleased and didn't mention the stdio MCP client", "No OpenTelemetry export found. Tracing is through BoxLang interception points, logging and flight-recorder middleware" ], "agentNotes": [ "Set `mcp.stdio.allowedCommands` to the executables you need. The default empty list lets any command start as a stdio MCP server.", "Pass `allowedPaths` when you create FileSystemTools. With none, its tools can read, write and delete anywhere the JVM user can.", "Attach HumanInTheLoopMiddleware with a checkpointer for tools that write or spend. Approval is opt-in.", "Create MCP clients with `MCP()` rather than the class, since 3.6.0 renamed MCPClient to MCPHttpClient without an alias.", "Use the `mock` provider to test agent wiring and guardrails with no API key or network." ], "metrics": { "kind": "library", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 65.8 } ], "editorialScores": { "ergonomics": 74, "maintenance": 83, "payments": 50, "reliability": 66, "schema": 71, "security": 71, "transparency": 65 }, "provenanceScore": 74, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "install-bx-module bx-ai # in a web app: box install bx-ai" }, "letme": { "capability": "https://letme.dev/agent.framework", "tool": "https://letme.dev/boxlang-ai" }, "sameCompany": [ "bx-playwright" ], "area": "frameworks", "provenance": { "legalEntity": "Ortus Solutions, Corp.", "domain": "ortussolutions.com", "domainRegistered": "2006-04-12", "endpointOnVendorDomain": null, "terms": "https://github.com/ortus-boxlang/bx-ai/blob/main/src/main/resources/LICENSE", "privacy": "https://www.ortussolutions.com/about-us/ortus-privacy-policy", "statusPage": "", "changelog": "https://github.com/ortus-boxlang/bx-ai/blob/main/changelog.md", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "The readme names Ortus Solutions, Corp as copyright holder, and box.json names Ortus Solutions as author.", "domainRegistered is from Verisign's RDAP record for ortussolutions.com. rdap.org has no record for boxlang.io, so the product domain's date wasn't read.", "security.txt answers 410 on www.ortussolutions.com and boxlang.io. CONTRIBUTING.md asks for vulnerability reports to security@ortussolutions.com.", "The Apache 2.0 licence stands in for terms. The privacy policy covers Ortus's website and customers, not the module.", "Local software, so there is no endpoint or status page." ], "score": 74 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/boxlang-ai.json", "live": { "slug": "boxlang-ai", "versions": [ { "registry": "github", "name": "ortus-boxlang/bx-ai", "version": "v3.7.0", "released": "2026-11-04", "seenAt": "2026-11-06T23:11:59.483535804Z" } ], "githubStars": 20, "securityTxt": { "url": "https://ortussolutions.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:35.513461646Z" }, "llmsTxt": { "url": "https://ai.ortusbooks.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:44.174922688Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/ortus-boxlang/bx-ai/main/changelog.md", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:22:35.612698873Z", "changedAt": "2026-11-04T08:34:53.336221384Z", "fingerprint": "f8be668a6e44" }, { "url": "https://www.ortussolutions.com/about-us/ortus-privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:32:35.59600414Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "b4280b39a3d6" }, { "url": "https://raw.githubusercontent.com/ortus-boxlang/bx-ai/main/src/main/resources/LICENSE", "kind": "terms", "status": 304, "checkedAt": "2026-11-07T14:22:37.201712876Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "839fbbcddc72" } ], "github": { "repo": "ortus-boxlang/bx-ai", "checkedAt": "2026-11-02T08:22:41.470134886Z", "stars": 19, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-01T17:24:53Z", "openIssues": 10, "openPRs": 8, "issuesOpened90d": 9, "issuesClosed90d": 9, "prsMerged90d": 65, "ci": { "branch": "development", "runs": 50, "success": 9, "failure": 28, "other": 13, "latest": "failure", "latestAt": "2026-11-01T17:37:12Z" }, "replies": { "sampled": 25, "unanswered": 7, "medianDays": 0.8 } }, "updatedAt": "2026-11-07T15:59:35.513461646Z" } }, "answer": "Strands Agents scores 80 (A) on agent readiness against BoxLang AI's 65.8 (B), and leads in every scored category.", "b": { "slug": "strands-agents", "name": "Strands Agents", "vendor": "Amazon Web Services", "vendorUrl": "https://strandsagents.com", "kind": "framework", "category": "frameworks", "summary": "Strands Agents is AWS's open-source agent SDK for Python and TypeScript. A model-driven loop runs tools, MCP servers, multi-agent patterns, sessions, interrupts for human approval and OpenTelemetry tracing, with Amazon Bedrock as the default model provider.", "url": "https://www.anchorterminal.com/tools/strands-agents", "markdownUrl": "https://www.anchorterminal.com/tools/strands-agents.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/strands-agents.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/strands-agents.json", "dns": "strands-agents.grade.anchorterminal.com", "repo": "https://github.com/strands-agents/harness-sdk", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "pypi", "name": "strands-agents" }, { "registry": "npm", "name": "@strands-agents/sdk" }, { "registry": "pypi", "name": "strands-agents-tools" } ], "auth": "none", "authNotes": "A library with no credentials of its own. The default Bedrock provider uses the caller's AWS credentials; other providers take their own API keys.", "pricing": "free", "pricingNotes": "Free and open source under Apache-2.0. You pay for model calls, on Bedrock by default or with any supported provider.", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the repository (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 9066, "npmWeekly": 697548, "pypiWeekly": 8902370, "asOf": "2026-11-06" }, "docsUrl": "https://strandsagents.com/docs", "llmsTxt": "https://strandsagents.com/llms.txt", "capabilities": [ "agent.framework", "agent.mcp-client", "agent.multi-agent", "agent.durable" ], "tags": [ "framework", "python", "typescript", "open-source", "llms-txt", "mcp", "otel", "a2a", "aws" ], "lastRelease": "2026-11-04", "graded": true, "anchor": { "graded": true, "score": 80, "grade": "A", "agentReady": true, "rank": 15, "ranked": true, "rankOf": 1510, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 87, "maintenance": 87, "payments": 60, "reliability": 87, "schema": 95, "security": 89, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": -4, "negativeNotes": [ "2026-10-23 and 2026-10-27. Three GitHub advisories for strands-agents. GHSA-4v6f-7vjh-6x4m (high) says the A2A server shared conversation history across callers with different context IDs, fixed in Python 1.43.0 and TypeScript 1.5.0. GHSA-3w55-933p-8pv5 (high) and GHSA-763v-5pjm-fx36 (moderate) say the default FileSessionManager stored sessions in a world-readable /tmp path that followed symlinks, fixed in 1.48.0. All published with fixes and credited, so 4 points. https://github.com/strands-agents/harness-sdk/security/advisories/GHSA-3w55-933p-8pv5" ], "verdict": "An Apache-2.0 agent SDK for Python and TypeScript with a managed MCP client, multi-agent patterns, interrupts and Cedar policies for approval, opt-in OpenTelemetry and no usage analytics. Bedrock is the default model, the default sandbox is the local host, and three session-isolation advisories were fixed in October 2026.", "bestFor": "Python or TypeScript teams, especially on AWS, who want a model-driven loop with MCP, multi-agent patterns and approval gates.", "strengths": [ "No usage analytics found, with OpenTelemetry tracing opt-in", "Interrupts and interventions pause tool calls for human approval or a Cedar policy", "MCP servers passed straight to the agent, with lifecycle handled", "Python and TypeScript SDKs released weekly, 1.0 since July 2025, under a written versioning policy", "llms.txt with a Markdown twin of every docs page" ], "weaknesses": [ "Three advisories in October 2026 on A2A session sharing and world-readable default session files, fixed in 1.43.0 and 1.48.0", "The default sandbox for shell and file tools is the local host", "Bedrock is the default provider, so a bare agent needs AWS credentials and model access", "Experimental modules and fast-moving standards (MCP, A2A, OTel conventions) sit outside the semantic versioning guarantee" ], "agentNotes": [ "Upgrade to strands-agents 1.48.0 or later, and set a private session directory rather than the /tmp default", "Pass a model explicitly when AWS credentials aren't configured, since Bedrock is the default", "Use interrupts or the harness's `interventions` for tools that write, send or pay", "Run shell and file tools in the Docker or SSH sandbox when the agent runs untrusted code", "Pin a minor version when using A2A, MCP or experimental modules" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "A", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 80 } ], "editorialScores": { "ergonomics": 87, "maintenance": 87, "payments": 60, "reliability": 87, "schema": 95, "security": 89, "transparency": 86 }, "provenanceScore": 58, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install strands-agents strands-agents-tools # TypeScript: npm i @strands-agents/sdk" }, "letme": { "capability": "https://letme.dev/agent.framework", "tool": "https://letme.dev/strands-agents" }, "sameCompany": [ "strands-decider" ], "area": "frameworks", "provenance": { "legalEntity": "Amazon Web Services, Inc.", "domain": "strandsagents.com", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/strands-agents/harness-sdk/releases", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The licence file and NOTICE attribute the project to Amazon.com, Inc. or its affiliates; SECURITY.md sends reports to the AWS Vulnerability Disclosure Program on HackerOne.", "strandsagents.com/robots.txt allows all crawlers with Content-Signal ai-train=no, search=yes, ai-input=yes.", "strandsagents.com/.well-known/security.txt returns 404." ], "score": 58 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/strands-agents.json", "live": { "slug": "strands-agents", "versions": [ { "registry": "github", "name": "strands-agents/harness-sdk", "version": "typescript/v1.24.0", "released": "2026-11-04", "seenAt": "2026-11-07T00:08:42.12303393Z" }, { "registry": "npm", "name": "@strands-agents/sdk", "version": "1.24.0", "seenAt": "2026-11-07T00:08:40.21989722Z" }, { "registry": "pypi", "name": "strands-agents", "version": "1.64.0", "released": "2026-11-04", "seenAt": "2026-11-07T00:08:40.035164104Z" }, { "registry": "pypi", "name": "strands-agents-tools", "version": "0.9.0", "released": "2026-11-04", "seenAt": "2026-11-07T00:08:41.063215915Z" } ], "githubStars": 9066, "npmWeekly": 697548, "pypiWeekly": 8902370, "securityTxt": { "url": "https://strandsagents.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:32.408705195Z" }, "llmsTxt": { "url": "https://strandsagents.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:02.911668247Z" }, "updatedAt": "2026-11-07T16:00:32.408705195Z" } }, "edges": [ { "by": 24, "category": "schema", "leads": "strands-agents", "name": "Schema \u0026 documentation", "reasons": { "a": "Framework reading. A reference page for each built-in function with its arguments, and tool schemas generated from typed function arguments with required fields since 3.3.1. BoxLang is dynamically typed and no published API reference was found, though the repository builds DocBox API docs (15 of 25). llms.txt with about 150 entries and a Markdown copy of every page (10). The FAQ says when to use aiChat() or aiAgent() and the security guide says which guards to use when, though some FAQ links still say coming soon for pages that exist (14 of 20). Tool arguments are typed with required lists, and stdio options a server doesn't have throw InvalidArgument (11 of 15). About 100 example scripts in the repository and a gallery on ai.boxlang.io, but the production guide catches RateLimitException, TimeoutException and AuthenticationException, which the module's source never throws, and there is no exception reference (9 of 15). Keep a Changelog and a release-history page per version, but the 3.6.0 page still read unreleased on 1 November and two old versions appear twice in the changelog (12 of 15). 71 in all.", "b": "Framework reading. Typed Python and TypeScript APIs with a reference for each (25). llms.txt with a Markdown twin of every page (10). The llms.txt and docs say when to use Strands over a hand-written loop and when to take the harness rather than the SDK (18). Tools are typed from decorated functions or Zod schemas (15). Python and TypeScript examples on every page, stop reasons and hook events documented, with no catalogue of exceptions (12). Versioning page and tagged releases per package (15). 25+10+18+15+12+15 = 95." }, "scores": { "a": 71, "b": 95 } }, { "by": 21, "category": "reliability", "leads": "strands-agents", "name": "Reliability", "reasons": { "a": "Read with the local-software lines. Official package on ForgeBox, installed with `install-bx-module bx-ai` or `box install bx-ai`, with BoxLang 1.14.0 or later in box.json and JDK 21 in CONTRIBUTING.md, but the 3.6 announcement says BoxLang 1.18 or later (18 of 20). tests.yml runs about 140 test classes against Ollama and the vector stores in Docker Compose, and against paid providers on development and releases, on pull requests and pushes to development. Whether runs pass wasn't read, since WebFetch refused github.com (15 of 25). Open issues and replies weren't read for the same reason. The changelog closes issues #182 to #259 in 3.3.1 to 3.4.0, and bugs also go to Ortus's Jira (10 of 25). Keep a Changelog with semantic versioning stated and Migration sections, but breaking changes ship in minor releases (8 of 15). 3.6.0, past 1.0 (15). 66 in all.", "b": "Local-package reading. Official PyPI and npm packages with Python 3.10 and Node 22 stated (20). A public CI workflow runs lint, type checks, unit and integration tests for each package on pull requests to main, plus security-audit workflows, and the latest Python, TypeScript, harness and MCP runs on main passed on 6 November (25). 664 open issues and 1,151 open issues and pull requests on 6 November, with 545 issues opened in the 90 days to 3 November. Of the 50 newest, 12 had a comment and 15 were closed, and 9 of the 40 newest open items carry a bug label. An issue-responder workflow runs on new issues (12). A written semantic versioning policy, experimental APIs kept apart, and deprecations removed only at a major (15). 1.0 since 15 July 2025 (15). 20+25+12+15+15 = 87." }, "scores": { "a": 66, "b": 87 } }, { "by": 18, "category": "security", "leads": "strands-agents", "name": "Security \u0026 auth", "reasons": { "a": "Framework reading. 30 for what leaves the machine and credentials, 20 for approvals and sandboxing, 15 for prompt injection, 15 for audit and 20 for the security programme. No telemetry in the module's source, requests go only to configured providers, keys come from settings or environment variables, and request logging is off by default. 3.4.0 fixed a Gemini key leaking into logs through the request URL (27 of 30). Approval is enforced in code by HumanInTheLoopMiddleware with five policies, GuardrailMiddleware blocks tools by name and argument pattern, and stdio commands never use a shell. All of it is opt-in. `allowedCommands` allows any executable by default, FileSystemTools allows any path without `allowedPaths`, and the MCP server has no authentication unless configured (12 of 20). Unicode hygiene and fencing of `${context}` are on by default, with opt-in input sanitiser, LLM judge and output guard. Streaming guards detect after the fact, which the changelog says (14 of 15). About 70 interception points, LoggingMiddleware, FlightRecorderMiddleware and MCP server statistics, with no OpenTelemetry export (11 of 15). CONTRIBUTING.md asks for reports to security@ortussolutions.com and the Slack #security channel. No security.txt (410), no bounty, and no published advisory found, while 3.6.0 lists a SQL injection fix in MySQL vector memory under Fixed (7 of 20). 71 in all.", "b": "Framework reading (telemetry defaults, approvals, guardrails, sandboxing). No usage analytics found in either SDK, and OpenTelemetry is opt-in (25). Interrupts and the harness's interventions gate tool calls behind human approval or Cedar policies, but the default sandbox is the local host (16). Guardrails, PII redaction and trusted message history pages, with Bedrock Guardrails integration (13). OpenTelemetry traces for every model and tool call (15). The AWS Vulnerability Disclosure Program on HackerOne and three advisories in October 2026 published with fixed versions (20). 25+16+13+15+20 = 89." }, "scores": { "a": 71, "b": 89 } }, { "by": 13, "category": "ergonomics", "leads": "strands-agents", "name": "Agent ergonomics", "reasons": { "a": "Framework reading, scored on what a tool-calling agent with MCP takes. An agent with an MCP server is one `aiAgent()` call with `mcpServers`, and `toolFilter` and `prefix` limit what each server adds. Skills can load lazily, but `autoLoadSkills` is on by default and injects every SKILL.md under /.agents/skills into every agent (20 of 25). MaxToolCallsMiddleware caps tool calls, window and summary memory bound history by messages or tokens, `withMaxResponseBytes` caps MCP answers and `listTools( cursor )` pages tools (17 of 20). Named exceptions (ProviderError, UnsupportedCapability, InvalidArgument, MCPCommandRefused, BXAI.SecurityViolation) but no reference page, and the changelog says a timed-out call still surfaces as a JSON parse error (12 of 20). RetryMiddleware with exponential backoff, approval resumes that don't replay the model call or rerun executed tools, and a stdio client that never repeats an in-flight call. MCP tool annotations such as readOnlyHint aren't read (15 of 20). An agent needs a name and works with defaults, and a mock provider runs with no key, but it is one language (10 of 15). 74 in all.", "b": "Framework reading. An MCPClient is passed straight to the agent in a few lines and its lifecycle is managed, with tool filtering per client (22). Conversation managers, turn limits, token budgets and cancellation bound each run (20). Stop reasons and typed events, and hooks that can retry a model or tool call (16). Retry strategies, session managers that persist and resume a conversation, and interrupts that resume where they paused (17). Two official languages, but the default provider is Bedrock, which needs AWS credentials and model access (12). 22+20+16+17+12 = 87." }, "scores": { "a": 74, "b": 87 } }, { "by": 10, "category": "payments", "leads": "strands-agents", "name": "Payments \u0026 pricing", "reasons": { "a": "Self-hosted rule, scored on the paid option. No payment protocol (0). BoxLang runtime plans are public without a login, Starter $749 a year and BoxLang+ and BoxLang++ from $1,999 to $4,999 a server or node a year, plan pricing rather than per unit (10). The Apache-2.0 module installs with no card (20) and no account or sign-up (20). 50 in all.", "b": "Self-hosted rule. Free Apache-2.0 packages with nothing to buy from the project (20 + 20 + 20). No payment protocol (0). Model calls are paid to the provider. 0+20+20+20 = 60." }, "scores": { "a": 50, "b": 60 } } ], "facts": [ { "a": "Agent framework", "b": "Agent framework", "name": "Kind" }, { "a": "Ortus Solutions", "b": "Amazon Web Services", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "None", "b": "None", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-20", "b": "2026-11-04", "name": "Last release" }, { "a": "no date given", "b": "no document linked", "name": "Terms last updated" }, { "a": "no date given", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not read yet", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not read yet", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "9.1k stars, 698k npm/wk, 8.9M PyPI/wk", "name": "Popularity" } ], "faq": [ { "answer": "Strands Agents scores 80 (A) on agent readiness against BoxLang AI's 65.8 (B), and leads in every scored category.", "question": "Which is better for AI agents, BoxLang AI or Strands Agents?" }, { "answer": "Yes. BoxLang AI is open source (Apache-2.0). Strands Agents is open source (Apache-2.0).", "question": "Are BoxLang AI and Strands Agents open source?" } ], "goodFor": [ { "aheadOn": null, "also": null, "goodFor": "Teams already running BoxLang or modernising CFML on the JVM who want agents, RAG and MCP with approval and guardrails in the same language", "slug": "boxlang-ai", "watchFor": "Runs only on BoxLang, a JVM language, so it suits teams already on BoxLang or CFML rather than Python or TypeScript stacks" }, { "aheadOn": [ "Reliability, 87 against 66", "Schema \u0026 documentation, 95 against 71", "Agent ergonomics, 87 against 74", "Security \u0026 auth, 89 against 71", "Payments \u0026 pricing, 60 against 50" ], "also": [ "Agent-ready, a grade of BB or better" ], "goodFor": "Python or TypeScript teams, especially on AWS, who want a model-driven loop with MCP, multi-agent patterns and approval gates.", "slug": "strands-agents", "watchFor": "Three advisories in October 2026 on A2A session sharing and world-readable default session files, fixed in 1.43.0 and 1.48.0" } ], "history": null, "job": { "capability": "agent.framework", "name": "Agent frameworks" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentos-vs-boxlang-ai.json", "title": "AgentOS vs BoxLang AI", "url": "https://www.anchorterminal.com/compare/agentos-vs-boxlang-ai" }, { "json": "https://www.anchorterminal.com/compare/agentos-vs-strands-agents.json", "title": "AgentOS vs Strands Agents", "url": "https://www.anchorterminal.com/compare/agentos-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/agno-vs-boxlang-ai.json", "title": "Agno vs BoxLang AI", "url": "https://www.anchorterminal.com/compare/agno-vs-boxlang-ai" }, { "json": "https://www.anchorterminal.com/compare/agno-vs-strands-agents.json", "title": "Agno vs Strands Agents", "url": "https://www.anchorterminal.com/compare/agno-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-claude-agent-sdk.json", "title": "BoxLang AI vs Claude Agent SDK", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-claude-agent-sdk" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-crewai.json", "title": "BoxLang AI vs CrewAI", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-crewai" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-cursor-agent-sdk.json", "title": "BoxLang AI vs Cursor Agent SDK", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-cursor-agent-sdk" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-docker-agent.json", "title": "BoxLang AI vs Docker Agent", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-docker-agent" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-google-adk.json", "title": "BoxLang AI vs Agent Development Kit (ADK)", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-google-adk" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-guilds-run.json", "title": "BoxLang AI vs guilds.run", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-langgraph.json", "title": "BoxLang AI vs LangGraph", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-langgraph" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-llamaindex.json", "title": "BoxLang AI vs LlamaIndex Framework", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-llamaindex" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.json", "title": "BoxLang AI vs Mastra", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-microsoft-agent-framework.json", "title": "BoxLang AI vs Microsoft Agent Framework", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-microsoft-agent-framework" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-openai-agents-sdk.json", "title": "BoxLang AI vs OpenAI Agents SDK", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-openai-agents-sdk" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-pydantic-ai.json", "title": "BoxLang AI vs Pydantic AI", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-pydantic-ai" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-smolagents.json", "title": "BoxLang AI vs smolagents", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-smolagents" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-tradingagents.json", "title": "BoxLang AI vs TradingAgents", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-vercel-ai-sdk.json", "title": "BoxLang AI vs AI SDK", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-strands-agents.json", "title": "Claude Agent SDK vs Strands Agents", "url": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/crewai-vs-strands-agents.json", "title": "CrewAI vs Strands Agents", "url": "https://www.anchorterminal.com/compare/crewai-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-strands-agents.json", "title": "Cursor Agent SDK vs Strands Agents", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/docker-agent-vs-strands-agents.json", "title": "Docker Agent vs Strands Agents", "url": "https://www.anchorterminal.com/compare/docker-agent-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-strands-agents.json", "title": "Agent Development Kit (ADK) vs Strands Agents", "url": "https://www.anchorterminal.com/compare/google-adk-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-strands-agents.json", "title": "guilds.run vs Strands Agents", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/langgraph-vs-strands-agents.json", "title": "LangGraph vs Strands Agents", "url": "https://www.anchorterminal.com/compare/langgraph-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/llamaindex-vs-strands-agents.json", "title": "LlamaIndex Framework vs Strands Agents", "url": "https://www.anchorterminal.com/compare/llamaindex-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-strands-agents.json", "title": "Mastra vs Strands Agents", "url": "https://www.anchorterminal.com/compare/mastra-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/microsoft-agent-framework-vs-strands-agents.json", "title": "Microsoft Agent Framework vs Strands Agents", "url": "https://www.anchorterminal.com/compare/microsoft-agent-framework-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/openai-agents-sdk-vs-strands-agents.json", "title": "OpenAI Agents SDK vs Strands Agents", "url": "https://www.anchorterminal.com/compare/openai-agents-sdk-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/pydantic-ai-vs-strands-agents.json", "title": "Pydantic AI vs Strands Agents", "url": "https://www.anchorterminal.com/compare/pydantic-ai-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/smolagents-vs-strands-agents.json", "title": "smolagents vs Strands Agents", "url": "https://www.anchorterminal.com/compare/smolagents-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/strands-agents-vs-tradingagents.json", "title": "Strands Agents vs TradingAgents", "url": "https://www.anchorterminal.com/compare/strands-agents-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/strands-agents-vs-vercel-ai-sdk.json", "title": "Strands Agents vs AI SDK", "url": "https://www.anchorterminal.com/compare/strands-agents-vs-vercel-ai-sdk" } ], "panel": null, "scores": [ { "boxlang-ai": 66, "by": 21, "edge": "strands-agents", "key": "reliability", "name": "Reliability", "strands-agents": 87, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "boxlang-ai": 71, "by": 24, "edge": "strands-agents", "key": "schema", "name": "Schema \u0026 documentation", "strands-agents": 95, "weight": 13 }, { "boxlang-ai": 74, "by": 13, "edge": "strands-agents", "key": "ergonomics", "name": "Agent ergonomics", "strands-agents": 87, "weight": 13 }, { "boxlang-ai": 71, "by": 18, "edge": "strands-agents", "key": "security", "name": "Security \u0026 auth", "strands-agents": 89, "weight": 14 }, { "boxlang-ai": 50, "by": 10, "edge": "strands-agents", "key": "payments", "name": "Payments \u0026 pricing", "strands-agents": 60, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "boxlang-ai": 83, "by": 4, "edge": "strands-agents", "key": "maintenance", "name": "Maintenance \u0026 community", "strands-agents": 87, "weight": 7 }, { "boxlang-ai": 70, "by": 2, "edge": "strands-agents", "key": "transparency", "name": "Transparency \u0026 trust", "strands-agents": 72, "weight": 7 } ], "summary": "Strands Agents scores 80 (A) on agent readiness against BoxLang AI's 65.8 (B), and leads in every scored category. Both do agent frameworks.", "tasks": null, "tutorials": [], "verdicts": { "boxlang-ai": "A JVM agent framework with human approval, guardrail middleware and an MCP client over HTTP and stdio, all enforced in code, with three releases in the 90 days to 1 November 2026. It runs only on BoxLang, the stronger guards are opt-in, and minor releases have renamed public classes without a deprecation period.", "strands-agents": "An Apache-2.0 agent SDK for Python and TypeScript with a managed MCP client, multi-agent patterns, interrupts and Cedar policies for approval, opt-in OpenTelemetry and no usage analytics. Bedrock is the default model, the default sandbox is the local host, and three session-isolation advisories were fixed in October 2026." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/boxlang-ai-vs-strands-agents", "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-strands-agents.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/boxlang-ai-vs-strands-agents.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/boxlang-ai-vs-strands-agents.min.md" }, "markdown": "Strands Agents scores 80 (A) on agent readiness against BoxLang AI's 65.8 (B), and leads in every scored category. Both do agent frameworks.\n\n- BoxLang AI: grade B, 65.8/100, rank #403 of 1510. Markdown https://www.anchorterminal.com/tools/boxlang-ai.md · JSON https://www.anchorterminal.com/api/v1/tools/boxlang-ai.json\n- Strands Agents: grade A, 80/100, rank #15 of 1510. Markdown https://www.anchorterminal.com/tools/strands-agents.md · JSON https://www.anchorterminal.com/api/v1/tools/strands-agents.json\n- Best agent frameworks and SDKs: https://www.anchorterminal.com/best/frameworks/index.md\n- All 171 frameworks comparisons: https://www.anchorterminal.com/compare/frameworks/index.md\n\n## Which one, for what\n\n### BoxLang AI (B)\n\nGood for: Teams already running BoxLang or modernising CFML on the JVM who want agents, RAG and MCP with approval and guardrails in the same language\n\nWatch for: Runs only on BoxLang, a JVM language, so it suits teams already on BoxLang or CFML rather than Python or TypeScript stacks\n\n### Strands Agents (A)\n\nGood for: Python or TypeScript teams, especially on AWS, who want a model-driven loop with MCP, multi-agent patterns and approval gates.\n\nAhead on:\n- Reliability, 87 against 66\n- Schema \u0026 documentation, 95 against 71\n- Agent ergonomics, 87 against 74\n- Security \u0026 auth, 89 against 71\n- Payments \u0026 pricing, 60 against 50\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n\nWatch for: Three advisories in October 2026 on A2A session sharing and world-readable default session files, fixed in 1.43.0 and 1.48.0\n\n\n## Why the edge\n\n### Schema \u0026 documentation: Strands Agents +24\n\n- BoxLang AI (71): Framework reading. A reference page for each built-in function with its arguments, and tool schemas generated from typed function arguments with required fields since 3.3.1. BoxLang is dynamically typed and no published API reference was found, though the repository builds DocBox API docs (15 of 25). llms.txt with about 150 entries and a Markdown copy of every page (10). The FAQ says when to use aiChat() or aiAgent() and the security guide says which guards to use when, though some FAQ links still say coming soon for pages that exist (14 of 20). Tool arguments are typed with required lists, and stdio options a server doesn't have throw InvalidArgument (11 of 15). About 100 example scripts in the repository and a gallery on ai.boxlang.io, but the production guide catches RateLimitException, TimeoutException and AuthenticationException, which the module's source never throws, and there is no exception reference (9 of 15). Keep a Changelog and a release-history page per version, but the 3.6.0 page still read unreleased on 1 November and two old versions appear twice in the changelog (12 of 15). 71 in all.\n- Strands Agents (95): Framework reading. Typed Python and TypeScript APIs with a reference for each (25). llms.txt with a Markdown twin of every page (10). The llms.txt and docs say when to use Strands over a hand-written loop and when to take the harness rather than the SDK (18). Tools are typed from decorated functions or Zod schemas (15). Python and TypeScript examples on every page, stop reasons and hook events documented, with no catalogue of exceptions (12). Versioning page and tagged releases per package (15). 25+10+18+15+12+15 = 95.\n\n### Reliability: Strands Agents +21\n\n- BoxLang AI (66): Read with the local-software lines. Official package on ForgeBox, installed with `install-bx-module bx-ai` or `box install bx-ai`, with BoxLang 1.14.0 or later in box.json and JDK 21 in CONTRIBUTING.md, but the 3.6 announcement says BoxLang 1.18 or later (18 of 20). tests.yml runs about 140 test classes against Ollama and the vector stores in Docker Compose, and against paid providers on development and releases, on pull requests and pushes to development. Whether runs pass wasn't read, since WebFetch refused github.com (15 of 25). Open issues and replies weren't read for the same reason. The changelog closes issues #182 to #259 in 3.3.1 to 3.4.0, and bugs also go to Ortus's Jira (10 of 25). Keep a Changelog with semantic versioning stated and Migration sections, but breaking changes ship in minor releases (8 of 15). 3.6.0, past 1.0 (15). 66 in all.\n- Strands Agents (87): Local-package reading. Official PyPI and npm packages with Python 3.10 and Node 22 stated (20). A public CI workflow runs lint, type checks, unit and integration tests for each package on pull requests to main, plus security-audit workflows, and the latest Python, TypeScript, harness and MCP runs on main passed on 6 November (25). 664 open issues and 1,151 open issues and pull requests on 6 November, with 545 issues opened in the 90 days to 3 November. Of the 50 newest, 12 had a comment and 15 were closed, and 9 of the 40 newest open items carry a bug label. An issue-responder workflow runs on new issues (12). A written semantic versioning policy, experimental APIs kept apart, and deprecations removed only at a major (15). 1.0 since 15 July 2025 (15). 20+25+12+15+15 = 87.\n\n### Security \u0026 auth: Strands Agents +18\n\n- BoxLang AI (71): Framework reading. 30 for what leaves the machine and credentials, 20 for approvals and sandboxing, 15 for prompt injection, 15 for audit and 20 for the security programme. No telemetry in the module's source, requests go only to configured providers, keys come from settings or environment variables, and request logging is off by default. 3.4.0 fixed a Gemini key leaking into logs through the request URL (27 of 30). Approval is enforced in code by HumanInTheLoopMiddleware with five policies, GuardrailMiddleware blocks tools by name and argument pattern, and stdio commands never use a shell. All of it is opt-in. `allowedCommands` allows any executable by default, FileSystemTools allows any path without `allowedPaths`, and the MCP server has no authentication unless configured (12 of 20). Unicode hygiene and fencing of `${context}` are on by default, with opt-in input sanitiser, LLM judge and output guard. Streaming guards detect after the fact, which the changelog says (14 of 15). About 70 interception points, LoggingMiddleware, FlightRecorderMiddleware and MCP server statistics, with no OpenTelemetry export (11 of 15). CONTRIBUTING.md asks for reports to security@ortussolutions.com and the Slack #security channel. No security.txt (410), no bounty, and no published advisory found, while 3.6.0 lists a SQL injection fix in MySQL vector memory under Fixed (7 of 20). 71 in all.\n- Strands Agents (89): Framework reading (telemetry defaults, approvals, guardrails, sandboxing). No usage analytics found in either SDK, and OpenTelemetry is opt-in (25). Interrupts and the harness's interventions gate tool calls behind human approval or Cedar policies, but the default sandbox is the local host (16). Guardrails, PII redaction and trusted message history pages, with Bedrock Guardrails integration (13). OpenTelemetry traces for every model and tool call (15). The AWS Vulnerability Disclosure Program on HackerOne and three advisories in October 2026 published with fixed versions (20). 25+16+13+15+20 = 89.\n\n### Agent ergonomics: Strands Agents +13\n\n- BoxLang AI (74): Framework reading, scored on what a tool-calling agent with MCP takes. An agent with an MCP server is one `aiAgent()` call with `mcpServers`, and `toolFilter` and `prefix` limit what each server adds. Skills can load lazily, but `autoLoadSkills` is on by default and injects every SKILL.md under /.agents/skills into every agent (20 of 25). MaxToolCallsMiddleware caps tool calls, window and summary memory bound history by messages or tokens, `withMaxResponseBytes` caps MCP answers and `listTools( cursor )` pages tools (17 of 20). Named exceptions (ProviderError, UnsupportedCapability, InvalidArgument, MCPCommandRefused, BXAI.SecurityViolation) but no reference page, and the changelog says a timed-out call still surfaces as a JSON parse error (12 of 20). RetryMiddleware with exponential backoff, approval resumes that don't replay the model call or rerun executed tools, and a stdio client that never repeats an in-flight call. MCP tool annotations such as readOnlyHint aren't read (15 of 20). An agent needs a name and works with defaults, and a mock provider runs with no key, but it is one language (10 of 15). 74 in all.\n- Strands Agents (87): Framework reading. An MCPClient is passed straight to the agent in a few lines and its lifecycle is managed, with tool filtering per client (22). Conversation managers, turn limits, token budgets and cancellation bound each run (20). Stop reasons and typed events, and hooks that can retry a model or tool call (16). Retry strategies, session managers that persist and resume a conversation, and interrupts that resume where they paused (17). Two official languages, but the default provider is Bedrock, which needs AWS credentials and model access (12). 22+20+16+17+12 = 87.\n\n### Payments \u0026 pricing: Strands Agents +10\n\n- BoxLang AI (50): Self-hosted rule, scored on the paid option. No payment protocol (0). BoxLang runtime plans are public without a login, Starter $749 a year and BoxLang+ and BoxLang++ from $1,999 to $4,999 a server or node a year, plan pricing rather than per unit (10). The Apache-2.0 module installs with no card (20) and no account or sign-up (20). 50 in all.\n- Strands Agents (60): Self-hosted rule. Free Apache-2.0 packages with nothing to buy from the project (20 + 20 + 20). No payment protocol (0). Model calls are paid to the provider. 0+20+20+20 = 60.\n\n## Score by category\n\n| Category | Weight | BoxLang AI | Strands Agents | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 66 | 87 | Strands Agents +21 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 71 | 95 | Strands Agents +24 |\n| Agent ergonomics | 13% (16.2 this run) | 74 | 87 | Strands Agents +13 |\n| Security \u0026 auth | 14% (17.5 this run) | 71 | 89 | Strands Agents +18 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 50 | 60 | Strands Agents +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 83 | 87 | Strands Agents +4 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 70 | 72 | Strands Agents +2 |\n| Negative events | ≤15 | -3 | -4 | |\n| **Total** | | **65.8 · B** | **80 · A** | |\n\n## Facts side by side\n\n| Fact | BoxLang AI | Strands Agents |\n| --- | --- | --- |\n| Kind | Agent framework | Agent framework |\n| Vendor | Ortus Solutions | Amazon Web Services |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | None | None |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | Apache-2.0 | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-10-20 | 2026-11-04 |\n| Terms last updated | no date given | no document linked |\n| Privacy policy last updated | no date given | no document linked |\n| Customer content may train models | not found in the text | not read yet |\n| Terms restrict automated access | not found in the text | not read yet |\n| Terms restrict benchmarking | not found in the text | not read yet |\n| Terms or service can change without notice | not found in the text | not read yet |\n| Arbitration or class-action waiver | not found in the text | not read yet |\n| Popularity | none | 9.1k stars, 698k npm/wk, 8.9M PyPI/wk |\n\n## Verdicts\n\n**BoxLang AI.** A JVM agent framework with human approval, guardrail middleware and an MCP client over HTTP and stdio, all enforced in code, with three releases in the 90 days to 1 November 2026. It runs only on BoxLang, the stronger guards are opt-in, and minor releases have renamed public classes without a deprecation period.\n\n**Strands Agents.** An Apache-2.0 agent SDK for Python and TypeScript with a managed MCP client, multi-agent patterns, interrupts and Cedar policies for approval, opt-in OpenTelemetry and no usage analytics. Bedrock is the default model, the default sandbox is the local host, and three session-isolation advisories were fixed in October 2026.\n\n## Before you call either\n\n### BoxLang AI\n\n1. Set `mcp.stdio.allowedCommands` to the executables you need. The default empty list lets any command start as a stdio MCP server.\n2. Pass `allowedPaths` when you create FileSystemTools. With none, its tools can read, write and delete anywhere the JVM user can.\n3. Attach HumanInTheLoopMiddleware with a checkpointer for tools that write or spend. Approval is opt-in.\n4. Create MCP clients with `MCP()` rather than the class, since 3.6.0 renamed MCPClient to MCPHttpClient without an alias.\n5. Use the `mock` provider to test agent wiring and guardrails with no API key or network.\n\n### Strands Agents\n\n1. Upgrade to strands-agents 1.48.0 or later, and set a private session directory rather than the /tmp default\n2. Pass a model explicitly when AWS credentials aren't configured, since Bedrock is the default\n3. Use interrupts or the harness's `interventions` for tools that write, send or pay\n4. Run shell and file tools in the Docker or SSH sandbox when the agent runs untrusted code\n5. Pin a minor version when using A2A, MCP or experimental modules\n\n## Questions\n\n### Which is better for AI agents, BoxLang AI or Strands Agents?\n\nStrands Agents scores 80 (A) on agent readiness against BoxLang AI's 65.8 (B), and leads in every scored category.\n\n### Are BoxLang AI and Strands Agents open source?\n\nYes. BoxLang AI is open source (Apache-2.0). Strands Agents is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/boxlang-ai-vs-strands-agents.json, and with the fewest tokens: https://www.anchorterminal.com/compare/boxlang-ai-vs-strands-agents.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"boxlang-ai\", \"b\": \"strands-agents\"}`. From a terminal: `anchor compare boxlang-ai strands-agents`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/boxlang-ai.json and https://www.anchorterminal.com/api/v1/tools/strands-agents.json\n\n## Other comparisons with BoxLang AI or Strands Agents\n\n- [AgentOS vs BoxLang AI](https://www.anchorterminal.com/compare/agentos-vs-boxlang-ai.md)\n- [AgentOS vs Strands Agents](https://www.anchorterminal.com/compare/agentos-vs-strands-agents.md)\n- [Agno vs BoxLang AI](https://www.anchorterminal.com/compare/agno-vs-boxlang-ai.md)\n- [Agno vs Strands Agents](https://www.anchorterminal.com/compare/agno-vs-strands-agents.md)\n- [BoxLang AI vs Claude Agent SDK](https://www.anchorterminal.com/compare/boxlang-ai-vs-claude-agent-sdk.md)\n- [BoxLang AI vs CrewAI](https://www.anchorterminal.com/compare/boxlang-ai-vs-crewai.md)\n- [BoxLang AI vs Cursor Agent SDK](https://www.anchorterminal.com/compare/boxlang-ai-vs-cursor-agent-sdk.md)\n- [BoxLang AI vs Docker Agent](https://www.anchorterminal.com/compare/boxlang-ai-vs-docker-agent.md)\n- [BoxLang AI vs Agent Development Kit (ADK)](https://www.anchorterminal.com/compare/boxlang-ai-vs-google-adk.md)\n- [BoxLang AI vs guilds.run](https://www.anchorterminal.com/compare/boxlang-ai-vs-guilds-run.md)\n- [BoxLang AI vs LangGraph](https://www.anchorterminal.com/compare/boxlang-ai-vs-langgraph.md)\n- [BoxLang AI vs LlamaIndex Framework](https://www.anchorterminal.com/compare/boxlang-ai-vs-llamaindex.md)\n- [BoxLang AI vs Mastra](https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.md)\n- [BoxLang AI vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/boxlang-ai-vs-microsoft-agent-framework.md)\n- [BoxLang AI vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/boxlang-ai-vs-openai-agents-sdk.md)\n- [BoxLang AI vs Pydantic AI](https://www.anchorterminal.com/compare/boxlang-ai-vs-pydantic-ai.md)\n- [BoxLang AI vs smolagents](https://www.anchorterminal.com/compare/boxlang-ai-vs-smolagents.md)\n- [BoxLang AI vs TradingAgents](https://www.anchorterminal.com/compare/boxlang-ai-vs-tradingagents.md)\n- [BoxLang AI vs AI SDK](https://www.anchorterminal.com/compare/boxlang-ai-vs-vercel-ai-sdk.md)\n- [Claude Agent SDK vs Strands Agents](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-strands-agents.md)\n- [CrewAI vs Strands Agents](https://www.anchorterminal.com/compare/crewai-vs-strands-agents.md)\n- [Cursor Agent SDK vs Strands Agents](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-strands-agents.md)\n- [Docker Agent vs Strands Agents](https://www.anchorterminal.com/compare/docker-agent-vs-strands-agents.md)\n- [Agent Development Kit (ADK) vs Strands Agents](https://www.anchorterminal.com/compare/google-adk-vs-strands-agents.md)\n- [guilds.run vs Strands Agents](https://www.anchorterminal.com/compare/guilds-run-vs-strands-agents.md)\n- [LangGraph vs Strands Agents](https://www.anchorterminal.com/compare/langgraph-vs-strands-agents.md)\n- [LlamaIndex Framework vs Strands Agents](https://www.anchorterminal.com/compare/llamaindex-vs-strands-agents.md)\n- [Mastra vs Strands Agents](https://www.anchorterminal.com/compare/mastra-vs-strands-agents.md)\n- [Microsoft Agent Framework vs Strands Agents](https://www.anchorterminal.com/compare/microsoft-agent-framework-vs-strands-agents.md)\n- [OpenAI Agents SDK vs Strands Agents](https://www.anchorterminal.com/compare/openai-agents-sdk-vs-strands-agents.md)\n- [Pydantic AI vs Strands Agents](https://www.anchorterminal.com/compare/pydantic-ai-vs-strands-agents.md)\n- [smolagents vs Strands Agents](https://www.anchorterminal.com/compare/smolagents-vs-strands-agents.md)\n- [Strands Agents vs TradingAgents](https://www.anchorterminal.com/compare/strands-agents-vs-tradingagents.md)\n- [Strands Agents vs AI SDK](https://www.anchorterminal.com/compare/strands-agents-vs-vercel-ai-sdk.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "BoxLang AI vs Strands Agents", "url": "" } ], "description": "Strands Agents scores 80 (A) to BoxLang AI's 65.8 (B) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "BoxLang AI B 65.8", "Strands Agents A 80", "scores" ], "h1": "BoxLang AI vs Strands Agents", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/boxlang-ai-vs-strands-agents", "published": "2026-10-01", "section": "tools", "title": "BoxLang AI vs Strands Agents for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-strands-agents" }, "tokens": { "markdown": 4600, "slim": 2580 }, "version": 1 }