# BoxLang AI vs AI SDK

> AI SDK scores 89.8 (AA) to BoxLang AI's 65.8 (B) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/boxlang-ai-vs-vercel-ai-sdk
- Markdown: https://www.anchorterminal.com/compare/boxlang-ai-vs-vercel-ai-sdk.md (~5,050 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

AI SDK scores 89.8 (AA) on agent readiness against BoxLang AI's 65.8 (B), and leads in every scored category. Both do agent frameworks.

- BoxLang AI: grade B, 65.8/100, rank #403 of 1510. Markdown https://www.anchorterminal.com/tools/boxlang-ai.md · JSON https://www.anchorterminal.com/api/v1/tools/boxlang-ai.json
- AI SDK: grade AA, 89.8/100, rank #1 of 1510. Markdown https://www.anchorterminal.com/tools/vercel-ai-sdk.md · JSON https://www.anchorterminal.com/api/v1/tools/vercel-ai-sdk.json
- Best agent frameworks and SDKs: https://www.anchorterminal.com/best/frameworks/index.md
- All 171 frameworks comparisons: https://www.anchorterminal.com/compare/frameworks/index.md

## Which one, for what

### BoxLang AI (B)

Good for: Teams already running BoxLang or modernising CFML on the JVM who want agents, RAG and MCP with approval and guardrails in the same language

Also in its favour:
- No key needed to call it

Watch for: Runs only on BoxLang, a JVM language, so it suits teams already on BoxLang or CFML rather than Python or TypeScript stacks

### AI SDK (AA)

Good for: TypeScript teams building agents and chat UIs who want one API across many providers and a short path to MCP.

Ahead on:
- Reliability, 93 against 66
- Schema & documentation, 100 against 71
- Agent ergonomics, 95 against 74
- Security & auth, 90 against 71
- Payments & pricing, 60 against 50
- Maintenance & community, 97 against 83
- Transparency & trust, 89 against 70

Also in its favour:
- Agent-ready, a grade of BB or better
- No incidents deducted, where BoxLang AI loses 3 points for them

Watch for: TypeScript only, and `ai` 7.x needs Node 22 or newer


## Why the edge

### Schema & documentation: AI SDK +29

- BoxLang AI (71): Framework reading. A reference page for each built-in function with its arguments, and tool schemas generated from typed function arguments with required fields since 3.3.1. BoxLang is dynamically typed and no published API reference was found, though the repository builds DocBox API docs (15 of 25). llms.txt with about 150 entries and a Markdown copy of every page (10). The FAQ says when to use aiChat() or aiAgent() and the security guide says which guards to use when, though some FAQ links still say coming soon for pages that exist (14 of 20). Tool arguments are typed with required lists, and stdio options a server doesn't have throw InvalidArgument (11 of 15). About 100 example scripts in the repository and a gallery on ai.boxlang.io, but the production guide catches RateLimitException, TimeoutException and AuthenticationException, which the module's source never throws, and there is no exception reference (9 of 15). Keep a Changelog and a release-history page per version, but the 3.6.0 page still read unreleased on 1 November and two old versions appear twice in the changelog (12 of 15). 71 in all.
- AI SDK (100): Typed TypeScript API with a reference section for every function (25). llms.txt and a Markdown copy of each page (10). The docs say when to use each piece, such as a table of WorkflowAgent against ToolLoopAgent, a when-to-use section for subagents and harnesses, and HTTP over stdio for MCP in production (20). Tools take Zod or JSON Schema inputs (15). 38 error types documented in the reference, with error-handling guides and examples throughout (15). Versioning page and a changesets CHANGELOG per package (15).

### Reliability: AI SDK +27

- BoxLang AI (66): Read with the local-software lines. Official package on ForgeBox, installed with `install-bx-module bx-ai` or `box install bx-ai`, with BoxLang 1.14.0 or later in box.json and JDK 21 in CONTRIBUTING.md, but the 3.6 announcement says BoxLang 1.18 or later (18 of 20). tests.yml runs about 140 test classes against Ollama and the vector stores in Docker Compose, and against paid providers on development and releases, on pull requests and pushes to development. Whether runs pass wasn't read, since WebFetch refused github.com (15 of 25). Open issues and replies weren't read for the same reason. The changelog closes issues #182 to #259 in 3.3.1 to 3.4.0, and bugs also go to Ortus's Jira (10 of 25). Keep a Changelog with semantic versioning stated and Migration sections, but breaking changes ship in minor releases (8 of 15). 3.6.0, past 1.0 (15). 66 in all.
- AI SDK (93): Official npm packages, with `ai` 7.x requiring Node 22 or newer (20). A public CI workflow with lint, type checks, unit tests, Node-version tests, MCP tests on Windows and e2e tests runs on every push to main, and the newest completed CI runs on main passed on 6 November (25). 1,517 open issues and pull requests on 6 November from GitHub's API, with 1,059 issues opened in the 90 days to 3 November; 47 of the 50 newest had a comment and 32 were closed (18). A written versioning page with breaking changes only in majors, experimental_ prefixes for unstable APIs and a migration guide per major (15). 7.0.163 (15). 20+25+18+15+15 = 93, up from 73 on 6 October, when GitHub couldn't be read.

### Agent ergonomics: AI SDK +21

- BoxLang AI (74): Framework reading, scored on what a tool-calling agent with MCP takes. An agent with an MCP server is one `aiAgent()` call with `mcpServers`, and `toolFilter` and `prefix` limit what each server adds. Skills can load lazily, but `autoLoadSkills` is on by default and injects every SKILL.md under /.agents/skills into every agent (20 of 25). MaxToolCallsMiddleware caps tool calls, window and summary memory bound history by messages or tokens, `withMaxResponseBytes` caps MCP answers and `listTools( cursor )` pages tools (17 of 20). Named exceptions (ProviderError, UnsupportedCapability, InvalidArgument, MCPCommandRefused, BXAI.SecurityViolation) but no reference page, and the changelog says a timed-out call still surfaces as a JSON parse error (12 of 20). RetryMiddleware with exponential backoff, approval resumes that don't replay the model call or rerun executed tools, and a stdio client that never repeats an in-flight call. MCP tool annotations such as readOnlyHint aren't read (15 of 20). An agent needs a name and works with defaults, and a mock provider runs with no key, but it is one language (10 of 15). 74 in all.
- AI SDK (95): An MCP client in a few lines with createMCPClient and client.tools(), and tool search with deferLoading keeps unused tool definitions out of the prompt (25). stopWhen with a default of 20 steps, and prepareStep to trim messages, switch models or limit active tools per step (20). 38 typed errors with isInstance guards, and MCP results with isError go back to the model (20). maxRetries on model calls, opt-in retries for transient MCP failures only, and WorkflowAgent for durable steps with automatic retries (20). Few required parameters, but TypeScript only, and a string model ID needs an AI Gateway key unless a default provider is set (10).

### Security & auth: AI SDK +19

- BoxLang AI (71): Framework reading. 30 for what leaves the machine and credentials, 20 for approvals and sandboxing, 15 for prompt injection, 15 for audit and 20 for the security programme. No telemetry in the module's source, requests go only to configured providers, keys come from settings or environment variables, and request logging is off by default. 3.4.0 fixed a Gemini key leaking into logs through the request URL (27 of 30). Approval is enforced in code by HumanInTheLoopMiddleware with five policies, GuardrailMiddleware blocks tools by name and argument pattern, and stdio commands never use a shell. All of it is opt-in. `allowedCommands` allows any executable by default, FileSystemTools allows any path without `allowedPaths`, and the MCP server has no authentication unless configured (12 of 20). Unicode hygiene and fencing of `${context}` are on by default, with opt-in input sanitiser, LLM judge and output guard. Streaming guards detect after the fact, which the changelog says (14 of 15). About 70 interception points, LoggingMiddleware, FlightRecorderMiddleware and MCP server statistics, with no OpenTelemetry export (11 of 15). CONTRIBUTING.md asks for reports to security@ortussolutions.com and the Slack #security channel. No security.txt (410), no bounty, and no published advisory found, while 3.6.0 lists a SQL injection fix in MySQL vector memory under Fixed (7 of 20). 71 in all.
- AI SDK (90): No telemetry until an OpenTelemetry integration is registered. String model IDs route to Vercel's AI Gateway by default, which is documented and needs a Vercel key, so it isn't silent (25). Per-tool approval, HMAC-signed approvals against forged client history, and Open Policy Agent rules in @ai-sdk/policy-opa, though sandboxes are experimental (20). ToolLoopAgent rejects system messages in prompts by default as an injection risk, URL fetches are checked against private addresses, and MCP HTTP transport refuses redirects by default, but there's no guardrail primitive (10). OpenTelemetry spans for every model and tool call to any backend, opt-in (15). HackerOne programme, a valid security.txt, SECURITY.md and two low-severity advisories published with fixed versions (20). Framework reading, so SOC 2 isn't scored.

### Transparency & trust: AI SDK +19

- BoxLang AI (70): Apache-2.0, OSI approved, though the licence file sits in src/main/resources rather than the repository root (30). The FAQ says prompts and history go to the chosen cloud provider and that Ollama keeps data local, and we found no telemetry in the source, but there's no statement for the module of what, if anything, Ortus receives. Ortus's privacy policy covers its website and customers and says data is collected when you use its products without naming which (15 of 30). Migration notes are dated in the changelog, and default models were moved off a Groq model on its removal date, but there's no written deprecation policy or support window (10 of 20). No telemetry statement either way in the docs (10 of 20). 65 in all.
- AI SDK (89): Apache 2.0 (30). The library stores nothing. The AI Gateway's ZDR page says it doesn't retain prompts or outputs and per-request ZDR is available on Pro and Enterprise, and Vercel's privacy notice is dated 1 June 2026, but we didn't read a DPA or subprocessor list (22). Deprecated APIs are removed only at majors with a migration guide, and 6.x and 5.x keep getting releases, without a written support window (14). Telemetry is opt-in and documented, with switches for inputs and outputs (20).

### Maintenance & community: AI SDK +14

- BoxLang AI (83): 3.6.0 on 2026-10-20 (30). Three releases in the 90 days to 1 November, 3.4.0 on 1 September, 3.5.0 on 11 September and 3.6.0 on 20 October (20). 79 commits on the development branch in those 90 days from Luis Majano, Doug Cain, Copilot and dependency bots, with pull requests up to #326 merged on 1 November. Issue reply times couldn't be read (10 of 25). The ForgeBox package is current at 3.6.0 (15). Dependabot for Gradle monthly and Actions quarterly, tests on pull requests and development, and a format check (8 of 10). 83 in all.
- AI SDK (97): 7.0.163 on 2026-11-05 (30). 226 stable npm releases of `ai` across the 7.x, 6.x and 5.x lines in the 90 days to 6 November, 70 of them since 6 October (20). 47 of the 50 newest issues commented and 32 closed, with triage automation and backport workflows (22). `ai` and the provider packages are current, and 6.x and 5.x still get patches (15). Dependabot configured and CI passing on main (10). 30+20+22+15+10 = 97.

## Score by category

| Category | Weight | BoxLang AI | AI SDK | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 66 | 93 | AI SDK +27 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 71 | 100 | AI SDK +29 |
| Agent ergonomics | 13% (16.2 this run) | 74 | 95 | AI SDK +21 |
| Security & auth | 14% (17.5 this run) | 71 | 90 | AI SDK +19 |
| Payments & pricing | 10% (12.5 this run) | 50 | 60 | AI SDK +10 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 83 | 97 | AI SDK +14 |
| Transparency & trust | 7% (8.8 this run) | 70 | 89 | AI SDK +19 |
| Negative events | ≤15 | -3 | 0 | |
| **Total** | | **65.8 · B** | **89.8 · AA** | |

## Facts side by side

| Fact | BoxLang AI | AI SDK |
| --- | --- | --- |
| Kind | Agent framework | Agent framework |
| Vendor | Ortus Solutions | Vercel Inc. |
| Hosted endpoint | no (local only) | no (local only) |
| Transports |  |  |
| Auth | None | API key |
| Pricing | Free | Free |
| x402 | no | no |
| Licence | Apache-2.0 | Apache-2.0 |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-10-20 | 2026-11-05 |
| Terms last updated | no date given | 2026-06-01 |
| Privacy policy last updated | no date given | 2026-06-01 |
| Customer content may train models | not found in the text | yes, with an opt-out |
| Terms restrict automated access | not found in the text | not found in the text |
| Terms restrict benchmarking | not found in the text | not found in the text |
| Terms or service can change without notice | not found in the text | not found in the text |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | none | 28k stars, 44.9M npm/wk |

## Verdicts

**BoxLang AI.** A JVM agent framework with human approval, guardrail middleware and an MCP client over HTTP and stdio, all enforced in code, with three releases in the 90 days to 1 November 2026. It runs only on BoxLang, the stronger guards are opt-in, and minor releases have renamed public classes without a deprecation period.

**AI SDK.** A TypeScript agent toolkit with ToolLoopAgent, a built-in MCP client, per-tool approvals that can be HMAC-signed, opt-in OpenTelemetry and durable runs through WorkflowAgent. It ships three major versions in 14 months (5.0, 6.0, 7.0), each with a migration guide, and plain string model IDs route through Vercel's AI Gateway unless another provider is set.

## Before you call either

### BoxLang AI

1. Set `mcp.stdio.allowedCommands` to the executables you need. The default empty list lets any command start as a stdio MCP server.
2. Pass `allowedPaths` when you create FileSystemTools. With none, its tools can read, write and delete anywhere the JVM user can.
3. Attach HumanInTheLoopMiddleware with a checkpointer for tools that write or spend. Approval is opt-in.
4. Create MCP clients with `MCP()` rather than the class, since 3.6.0 renamed MCPClient to MCPHttpClient without an alias.
5. Use the `mock` provider to test agent wiring and guardrails with no API key or network.

### AI SDK

1. Pass a provider instance such as openai('model') if traffic shouldn't go through Vercel's AI Gateway
2. Set toolApproval on tools that write, and experimental_toolApprovalSecret when approvals come back from a browser
3. Raise or replace the default stop condition of 20 steps with stopWhen
4. Close the MCP client after the run, and use HTTP transport outside local development
5. Set recordInputs and recordOutputs to false when spans would carry secrets

## Questions

### Which is better for AI agents, BoxLang AI or AI SDK?

AI SDK scores 89.8 (AA) on agent readiness against BoxLang AI's 65.8 (B), and leads in every scored category.

### Are BoxLang AI and AI SDK open source?

Yes. BoxLang AI is open source (Apache-2.0). AI SDK is open source (Apache-2.0).


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/boxlang-ai-vs-vercel-ai-sdk.json, and with the fewest tokens: https://www.anchorterminal.com/compare/boxlang-ai-vs-vercel-ai-sdk.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "boxlang-ai", "b": "vercel-ai-sdk"}`. From a terminal: `anchor compare boxlang-ai vercel-ai-sdk`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/boxlang-ai.json and https://www.anchorterminal.com/api/v1/tools/vercel-ai-sdk.json

## Other comparisons with BoxLang AI or AI SDK

- [AgentOS vs BoxLang AI](https://www.anchorterminal.com/compare/agentos-vs-boxlang-ai.md)
- [AgentOS vs AI SDK](https://www.anchorterminal.com/compare/agentos-vs-vercel-ai-sdk.md)
- [Agno vs BoxLang AI](https://www.anchorterminal.com/compare/agno-vs-boxlang-ai.md)
- [Agno vs AI SDK](https://www.anchorterminal.com/compare/agno-vs-vercel-ai-sdk.md)
- [BoxLang AI vs Claude Agent SDK](https://www.anchorterminal.com/compare/boxlang-ai-vs-claude-agent-sdk.md)
- [BoxLang AI vs CrewAI](https://www.anchorterminal.com/compare/boxlang-ai-vs-crewai.md)
- [BoxLang AI vs Cursor Agent SDK](https://www.anchorterminal.com/compare/boxlang-ai-vs-cursor-agent-sdk.md)
- [BoxLang AI vs Docker Agent](https://www.anchorterminal.com/compare/boxlang-ai-vs-docker-agent.md)
- [BoxLang AI vs Agent Development Kit (ADK)](https://www.anchorterminal.com/compare/boxlang-ai-vs-google-adk.md)
- [BoxLang AI vs guilds.run](https://www.anchorterminal.com/compare/boxlang-ai-vs-guilds-run.md)
- [BoxLang AI vs LangGraph](https://www.anchorterminal.com/compare/boxlang-ai-vs-langgraph.md)
- [BoxLang AI vs LlamaIndex Framework](https://www.anchorterminal.com/compare/boxlang-ai-vs-llamaindex.md)
- [BoxLang AI vs Mastra](https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.md)
- [BoxLang AI vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/boxlang-ai-vs-microsoft-agent-framework.md)
- [BoxLang AI vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/boxlang-ai-vs-openai-agents-sdk.md)
- [BoxLang AI vs Pydantic AI](https://www.anchorterminal.com/compare/boxlang-ai-vs-pydantic-ai.md)
- [BoxLang AI vs smolagents](https://www.anchorterminal.com/compare/boxlang-ai-vs-smolagents.md)
- [BoxLang AI vs Strands Agents](https://www.anchorterminal.com/compare/boxlang-ai-vs-strands-agents.md)
- [BoxLang AI vs TradingAgents](https://www.anchorterminal.com/compare/boxlang-ai-vs-tradingagents.md)
- [Claude Agent SDK vs AI SDK](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-vercel-ai-sdk.md)
- [CrewAI vs AI SDK](https://www.anchorterminal.com/compare/crewai-vs-vercel-ai-sdk.md)
- [Cursor Agent SDK vs AI SDK](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-vercel-ai-sdk.md)
- [Docker Agent vs AI SDK](https://www.anchorterminal.com/compare/docker-agent-vs-vercel-ai-sdk.md)
- [Agent Development Kit (ADK) vs AI SDK](https://www.anchorterminal.com/compare/google-adk-vs-vercel-ai-sdk.md)
- [guilds.run vs AI SDK](https://www.anchorterminal.com/compare/guilds-run-vs-vercel-ai-sdk.md)
- [LangGraph vs AI SDK](https://www.anchorterminal.com/compare/langgraph-vs-vercel-ai-sdk.md)
- [LlamaIndex Framework vs AI SDK](https://www.anchorterminal.com/compare/llamaindex-vs-vercel-ai-sdk.md)
- [Mastra vs AI SDK](https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.md)
- [Microsoft Agent Framework vs AI SDK](https://www.anchorterminal.com/compare/microsoft-agent-framework-vs-vercel-ai-sdk.md)
- [OpenAI Agents SDK vs AI SDK](https://www.anchorterminal.com/compare/openai-agents-sdk-vs-vercel-ai-sdk.md)
- [Pydantic AI vs AI SDK](https://www.anchorterminal.com/compare/pydantic-ai-vs-vercel-ai-sdk.md)
- [smolagents vs AI SDK](https://www.anchorterminal.com/compare/smolagents-vs-vercel-ai-sdk.md)
- [Strands Agents vs AI SDK](https://www.anchorterminal.com/compare/strands-agents-vs-vercel-ai-sdk.md)
- [TradingAgents vs AI SDK](https://www.anchorterminal.com/compare/tradingagents-vs-vercel-ai-sdk.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp