boxlang-runtime-matchbox — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited boxlang-runtime-matchbox (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
BoxLang is the AI-native software productivity platform for building, modernizing and running applications, with developers and AI agents working together.
BoxLang has two runtimes. The JVM runtime is the full platform. MatchBox is a Rust implementation that compiles BoxLang to bytecode and runs it on a Rust VM, with no JVM needed for the core runtime. It complements the JVM runtime: use MatchBox where a JVM does not fit (single binaries, the browser, WASI containers, serverless, microcontrollers).
MatchBox is an independent, evolving implementation. Code written for MatchBox generally runs on JVM BoxLang, but MatchBox has a smaller standard library and fewer modules. Check compatibility for your target before promising a feature.
Docs: https://matchbox.boxlang.io Source: https://github.com/ortus-boxlang/matchbox
Install the MatchBox Version Manager, then a MatchBox version. See the matchbox-mvm skill for everything MVM can do.
curl -fsSL https://raw.githubusercontent.com/ortus-boxlang/matchbox-quick-installer/main/install/install.sh | bash
mvm install latest && mvm use latest
matchbox --versionDocker image: docker run --rm -v "$PWD:/app" ghcr.io/ortus-boxlang/matchbox:latest my_app.bxs
Run matchbox --help for the options of the installed version.
| Command | Purpose |
|---|---|
matchbox | Interactive REPL |
matchbox app.bxs | Run a script (the native CLI has the JIT enabled) |
matchbox --build app.bxs | Compile to a .bxb bytecode file |
matchbox --build --strip-source app.bxs | Bytecode without embedded source text |
matchbox app.bxb | Run compiled bytecode |
matchbox --serve --port 8080 --webroot ./www | Built-in web server for .bxm pages and static files |
--output <path> | Set the output path of a compiled artifact |
--module <path> | Load a BoxLang module directory (repeatable) |
--no-shaking, --keep <bifs>, --no-std-lib | Control tree-shaking of prelude BIFs |
| Target | Command | Output | Notes |
|---|---|---|---|
| native | matchbox --target native app.bxs | Executable | Runner stub plus your bytecode, about 500 KB stub, no JVM. See compiled-native-binaries |
| js | matchbox --target js app.bxs | .js + .wasm module | Browser and JavaScript hosts, including Cloudflare Workers. See wasm-in-the-browser |
| wasm | matchbox --target wasm app.bxs | .wasm | Standalone WASM (web) |
| wasi | matchbox --target wasi app.bxs | .wasm | WASI container binary. See wasm-container |
| wasi-http | matchbox --target wasi-http --webroot ./www | WASI HTTP component | Built from a webroot |
| esp32 | matchbox --target esp32 --chip esp32s3 app.bxs --flash | Firmware | Needs the ESP toolchain. Run matchbox esp32-doctor first. See esp32 |
| AWS Lambda | matchbox lambda deploy Lambda.bx --function <name> --bootstrap <path> | Lambda function | Preview. Deploy currently needs an explicit Linux bootstrap binary. Try locally with matchbox lambda invoke Lambda.bx --event event.json |
The Lambda class defines function run( event, context, response ).
matchbox --serve hosts .bxm templates and static assets.web.server() with routes, middleware, static mounts and ColdBox-style handlers. Examples: docs/examples/app_server and docs/examples/websocket_counter in the MatchBox repo.web.server() exists, enabled with --esp32-web..bxb files, --strip-source.runAsync and non-blocking sleep and HTTP.http() with its own request struct API (see the HTTP guide on the docs site).matchbox-native-fusion.| Area | BoxLang JVM | MatchBox |
|---|---|---|
| Runtime | JVM | Rust VM, no JVM for the core runtime |
| Standard library and modules | Full | Smaller, growing. Verify each BIF and module you need |
| Java interop | Full | Experimental JNI, native only. None in WASM or ESP32 |
| CFML compatibility | bx-compat-cfml | None |
| Targets | Server, CLI, Lambda and more | Adds browser, WASI, ESP32, single binaries |
Test on the real target. A feature that works in matchbox app.bxs can be missing in a WASM or ESP32 build.
mvm install latest && mvm use latestmatchbox app.bxs, then build for the target with --target--build --strip-source when shipping bytecode without source text~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.