boxlang-runtime-commandbox — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited boxlang-runtime-commandbox (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
BoxLang is the AI-native software productivity platform for building, modernizing and running applications, with developers and AI agents working together.
CommandBox is the enterprise Java servlet deployment option for BoxLang. Unlike the MiniServer (Undertow, no-servlet), CommandBox runs BoxLang inside a full Java EE servlet container (Undertow with servlet API), enabling enterprise features like multi-site hosting, SSL management, OS service integration, and JDK management.
| MiniServer | CommandBox | |
|---|---|---|
| Use case | Simple/fast deployment | Enterprise / production |
| Servlet API | No | Yes |
| SSL management | Manual | Built-in + Let's Encrypt |
| Multi-site | No | Yes |
| BoxLang+/++ | Not required | Unlocks PRO features |
| Docker image | ortussolutions/boxlang | ortussolutions/commandbox |
# macOS
brew install commandbox
# Linux (Debian/Ubuntu)
curl -fsSl https://downloads.ortussolutions.com/KEYS | sudo apt-key add -
sudo apt-get install commandbox
# All platforms
curl -fsSl https://downloads.ortussolutions.com/commandbox-cli-install | bashinstall commandbox-boxlangOn CommandBox 6.1+, BoxLang support is built-in — no module installation required.
# One-liner
server start cfengine=boxlang javaVersion=openjdk21_jdk
# With explicit port and webroot
server start cfengine=boxlang port=8080 webroot=/var/www/myapp
# Foreground (don't open browser)
server start cfengine=boxlang openBrowser=falseserver.json ConfigurationPlace server.json in your project root for repeatable server configuration:
{
"name": "MyBoxLangApp",
"app": {
"cfengine": "boxlang",
"serverHomeDirectory": ".engine/boxlang"
},
"openBrowser": false
}{
"name": "MyBoxLangApp",
"app": {
"cfengine": "boxlang",
"serverHomeDirectory": ".engine/boxlang"
},
"openBrowser": false,
"web": {
"rewrites": {
"enable": true
},
"ssl": {
"enable": true,
"port": 443,
"certFile": "/path/to/cert.pem",
"keyFile": "/path/to/key.pem"
}
},
"JVM": {
"heapSize": "512m",
"args": "-XX:+UseG1GC"
},
"env": {
"BOXLANG_ENVIRONMENT": "production",
"BOXLANG_DEBUG": false
},
"scripts": {
"onServerInitialInstall": "install bx-mail,bx-mysql,bx-redis",
"onServerStart": "echo 'Server starting...'",
"onServerStop": "echo 'Server stopping...'"
}
}boxlang.json{
"app": {
"cfengine": "boxlang",
"serverHomeDirectory": ".engine/boxlang",
"engineConfigFile": ".boxlang.json"
},
"web": {
"rewrites": { "enable": true }
},
"scripts": {
"onServerInitialInstall": "install bx-mail,bx-mysql,bx-compat-cfml"
}
}Modules are installed from CommandBox and are available after onServerInitialInstall runs:
# Install in running server
install bx-mysql
install bx-mail
install bx-redis
install bx-elasticsearch
install bx-compat-cfml
# Multiple at once
install bx-mysql,bx-mail,bx-redisOr in server.json:
"scripts": {
"onServerInitialInstall": "install bx-mysql,bx-mail,bx-redis"
}Enable debug mode via any of these methods:
# CLI flag
server start --debug
# server.json env variable
{
"env": { "BOXLANG_DEBUG": true }
}Or via .cfconfig.json:
{
"debuggingEnabled": true
}# Pull the official image
docker pull ortussolutions/commandbox
# Run BoxLang on CommandBox
docker run -p 8080:8080 \
-e cfengine=boxlang \
-v /path/to/myapp:/app \
ortussolutions/commandboxFROM ortussolutions/commandbox:latest
ENV cfengine=boxlang
ENV PORT=8080
COPY ./ /app
WORKDIR /app
EXPOSE 8080
CMD ["box", "server", "start", "--console"]A BoxLang+ or BoxLang++ subscription unlocks CommandBox PRO enterprise features:
| Feature | BoxLang+ | BoxLang++ |
|---|---|---|
| Multi-site hosting | ✅ | ✅ |
| Multi-SSL / SNI | ✅ | ✅ |
| OS Service Manager | ✅ | ✅ |
| JDK Management | ✅ | ✅ |
| Monitoring | — | ✅ |
| Priority support | — | ✅ |
Activate via CommandBox:
server activate --subscription=YOUR_KEYThe servlet/CommandBox runtime honors the same environment variables as the core OS runtime:
| Variable | Description |
|---|---|
BOXLANG_DEBUG | Enable/disable debug mode |
BOXLANG_CONFIG | Path to boxlang.json |
BOXLANG_HOME | Override BoxLang home |
BOXLANG_ENVIRONMENT | Environment name (development/staging/production) |
server start # Start the server
server stop # Stop the server
server restart # Restart the server
server status # View server status
server log # Tail the server log
server open # Open in browser
server list # List all servers
server forget # Remove server configserver.json for repeatable, version-controlled server configserverHomeDirectory to keep engine files out of source treescripts.onServerInitialInstall to auto-install required modulesengineConfigFile (.boxlang.json) for project-level BoxLang configJVM.heapSize to set appropriate memory limits for productionweb.rewrites.enable: true for front-controller or SPA routingenv vars in server.json over hard-coded values for environment-specific settingsortussolutions/commandbox with cfengine=boxlang env var~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.