boxlang-runtime-commandbox — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited boxlang-runtime-commandbox (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
CommandBox is the enterprise Java servlet deployment option for BoxLang. Unlike the MiniServer (Undertow, no-servlet), CommandBox runs BoxLang inside a full Java EE servlet container (Undertow with servlet API), enabling enterprise features like multi-site hosting, SSL management, OS service integration, and JDK management.
| MiniServer | CommandBox | |
|---|---|---|
| Use case | Simple/fast deployment | Enterprise / production |
| Servlet API | No | Yes |
| SSL management | Manual | Built-in + Let's Encrypt |
| Multi-site | No | Yes |
| BoxLang+/++ | Not required | Unlocks PRO features |
| Docker image | ortussolutions/boxlang | ortussolutions/commandbox |
# macOS
brew install commandbox
# Linux (Debian/Ubuntu)
curl -fsSl https://downloads.ortussolutions.com/KEYS | sudo apt-key add -
sudo apt-get install commandbox
# All platforms
curl -fsSl https://downloads.ortussolutions.com/commandbox-cli-install | bashinstall commandbox-boxlangOn CommandBox 6.1+, BoxLang support is built-in — no module installation required.
# One-liner
server start cfengine=boxlang javaVersion=openjdk21_jdk
# With explicit port and webroot
server start cfengine=boxlang port=8080 webroot=/var/www/myapp
# Foreground (don't open browser)
server start cfengine=boxlang openBrowser=falseserver.json ConfigurationPlace server.json in your project root for repeatable server configuration:
{
"name": "MyBoxLangApp",
"app": {
"cfengine": "boxlang",
"serverHomeDirectory": ".engine/boxlang"
},
"openBrowser": false
}{
"name": "MyBoxLangApp",
"app": {
"cfengine": "boxlang",
"serverHomeDirectory": ".engine/boxlang"
},
"openBrowser": false,
"web": {
"rewrites": {
"enable": true
},
"ssl": {
"enable": true,
"port": 443,
"certFile": "/path/to/cert.pem",
"keyFile": "/path/to/key.pem"
}
},
"JVM": {
"heapSize": "512m",
"args": "-XX:+UseG1GC"
},
"env": {
"BOXLANG_ENVIRONMENT": "production",
"BOXLANG_DEBUG": false
},
"scripts": {
"onServerInitialInstall": "install bx-mail,bx-mysql,bx-redis",
"onServerStart": "echo 'Server starting...'",
"onServerStop": "echo 'Server stopping...'"
}
}boxlang.json{
"app": {
"cfengine": "boxlang",
"serverHomeDirectory": ".engine/boxlang",
"engineConfigFile": ".boxlang.json"
},
"web": {
"rewrites": { "enable": true }
},
"scripts": {
"onServerInitialInstall": "install bx-mail,bx-mysql,bx-compat-cfml"
}
}Modules are installed from CommandBox and are available after onServerInitialInstall runs:
# Install in running server
install bx-mysql
install bx-mail
install bx-redis
install bx-elasticsearch
install bx-compat-cfml
# Multiple at once
install bx-mysql,bx-mail,bx-redisOr in server.json:
"scripts": {
"onServerInitialInstall": "install bx-mysql,bx-mail,bx-redis"
}Enable debug mode via any of these methods:
# CLI flag
server start --debug
# server.json env variable
{
"env": { "BOXLANG_DEBUG": true }
}Or via .cfconfig.json:
{
"debuggingEnabled": true
}# Pull the official image
docker pull ortussolutions/commandbox
# Run BoxLang on CommandBox
docker run -p 8080:8080 \
-e cfengine=boxlang \
-v /path/to/myapp:/app \
ortussolutions/commandboxFROM ortussolutions/commandbox:latest
ENV cfengine=boxlang
ENV PORT=8080
COPY ./ /app
WORKDIR /app
EXPOSE 8080
CMD ["box", "server", "start", "--console"]A BoxLang+ or BoxLang++ subscription unlocks CommandBox PRO enterprise features:
| Feature | BoxLang+ | BoxLang++ |
|---|---|---|
| Multi-site hosting | ✅ | ✅ |
| Multi-SSL / SNI | ✅ | ✅ |
| OS Service Manager | ✅ | ✅ |
| JDK Management | ✅ | ✅ |
| Monitoring | — | ✅ |
| Priority support | — | ✅ |
Activate via CommandBox:
server activate --subscription=YOUR_KEYThe servlet/CommandBox runtime honors the same environment variables as the core OS runtime:
| Variable | Description |
|---|---|
BOXLANG_DEBUG | Enable/disable debug mode |
BOXLANG_CONFIG | Path to boxlang.json |
BOXLANG_HOME | Override BoxLang home |
BOXLANG_ENVIRONMENT | Environment name (development/staging/production) |
server start # Start the server
server stop # Stop the server
server restart # Restart the server
server status # View server status
server log # Tail the server log
server open # Open in browser
server list # List all servers
server forget # Remove server configserver.json for repeatable, version-controlled server configserverHomeDirectory to keep engine files out of source treescripts.onServerInitialInstall to auto-install required modulesengineConfigFile (.boxlang.json) for project-level BoxLang configJVM.heapSize to set appropriate memory limits for productionweb.rewrites.enable: true for front-controller or SPA routingenv vars in server.json over hard-coded values for environment-specific settingsortussolutions/commandbox with cfengine=boxlang env var~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.