boxlang-runtime-matchbox — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited boxlang-runtime-matchbox (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MatchBox is a native Rust implementation of the BoxLang runtime. It compiles BoxLang source code to a custom bytecode and executes it without any JVM required. MatchBox is ideal for environments where the JVM is unavailable, cold-start time matters, or binary size must be minimal.
MatchBox code is a strict subset of JVM BoxLang. Code written for MatchBox runs on JVM BoxLang, but not vice versa — some JVM-specific APIs are unavailable in MatchBox.
# Install via the official install script (macOS, Linux)
curl -sSL https://raw.githubusercontent.com/ortus-boxlang/matchbox/master/install/install.sh | bash
# Verify
matchbox --version| Component | Technology | Description |
|---|---|---|
| Parser | Pest PEG (Rust) | Parses BoxLang source to AST |
| Compiler | Rust | Compiles AST to MatchBox bytecode |
| VM | Stack-based bytecode VM (Rust) | Executes bytecode at runtime |
| Targets | native, wasm, js, esp32 | Output deployment formats |
| Target | Command | Output | Use Case |
|---|---|---|---|
native | matchbox --target native app.bxs | Executable binary | CLI tools, microservices |
wasm | matchbox --target wasm app.bxs | .wasm file | Edge/FaaS, Wasmtime, containers |
js | matchbox --target js app.bxs | .js + .wasm ES module | Web browsers, Node.js |
esp32 | matchbox --target esp32 --chip esp32s3 app.bxs | Firmware | Microcontrollers |
Without a --target flag, MatchBox interprets and runs BoxLang immediately:
# Run a script directly (JVM-like execution, no output file)
matchbox hello.bxs
# With arguments
matchbox process.bxs --input=data.json --output=result.json| Aspect | JVM BoxLang | MatchBox |
|---|---|---|
| Runtime | JVM (Java 21+) | No JVM — pure Rust |
| Cold start | 300ms–2s | < 10ms |
| Binary size | ~50MB JAR | ~500KB executable |
| Full BoxLang API | ✅ All BIFs | ✅ Core subset |
| Java interop | ✅ Full | ❌ None |
| CFML compat | ✅ (bx-compat-cfml) | ❌ |
| Browser (WASM/JS) | ❌ | ✅ |
| Embedded (ESP32) | ❌ | ✅ |
| Strict subset | Use either | Write for MatchBox, runs on JVM too |
.wasm binary + scratch imageCode written for MatchBox is a strict subset and runs on JVM BoxLang unchanged. This lets you develop locally with JVM BoxLang tooling and deploy anywhere:
# Test with JVM BoxLang locally
boxlang app.bxs
# Deploy as native binary
matchbox --target native app.bxs
# Deploy as WASM
matchbox --target wasm app.bxscompiled-native-binaries — --target native single binaries + Native Fusion Rust interopwasm-container — --target wasm for server-side WASM and OCI containerswasm-in-the-browser — --target js / --target wasm for browsers and Node.jsesp32 — --target esp32 for microcontroller deploymentsinstall.sh scriptmatchbox app.bxs to test locally before compiling to a targetnative > wasm > js > esp32~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.