Web Applications

Two ways to build a web application on BoxLang - a raw MiniServer app, or a full framework starter built for building with an AI agent.

The BoxLang core runtime doesn't know anything about HTTP - "web" is a layer on top, provided by the MiniServer or a servlet server like CommandBox. What you put on top of that layer is up to you, and it depends on what you're building.

🧭 Which path should I take?

You're building...	Use
A single page, a small API, a prototype, or an embedded UI	Raw BoxLang (.bxm/.bx) on the MiniServer - no framework, nothing to learn first
A real application - routing, auth, an ORM, an admin panel, a team behind it	ColdBox, BoxLang's flagship HMVC framework, started from cbGenesis

🪶 Path 1: Raw BoxLang on the MiniServer

For something small, you don't need a framework at all. Drop an index.bxm in a folder and start the MiniServer:

cd mySite
boxlang-miniserver

Enable URL rewrites if you want clean URLs, and route requests yourself out of index.bxm. That's the whole framework. It's the right amount of structure for a script, a webhook receiver, or a page that will never grow past a few routes.

🏗️ Path 2: ColdBox, started from cbGenesis

Once an app has more than a couple of routes, its own auth, or more than one person working on it, hand-rolling routing and conventions stops paying off. ColdBox is BoxLang's HMVC framework for that case - handlers, routing, dependency injection, interceptors, and a convention for where everything lives.

You can start a ColdBox app from a bare skeleton. The fastest way, though - especially with an AI agent doing some of the building - is cbGenesis, a production-ready ColdBox starter template that ships a working app, not a blank one:

• Session auth, SSO, and WebAuthn passkeys
• A resource:action role-based permission model enforced via @secured handler annotations
• CSRF protection that's deny-by-default on every state-changing request
• An admin panel (users, roles, permissions, audit log, settings) built on Alpine.js + Bootstrap
• A real TestBox suite and a Docker Compose stack for local dev

install-bx-module bx-cli

coldbox create app skeleton=cbgenesis
box install
box migrate up
box migrate seed run
box server start

Ten minutes later you have a login screen, not a to-do list of security features you still need to build.

This is the fastest way to build a BoxLang web application with an AI agent at hand. cbGenesis ships an AGENTS.md, the full BoxLang skills ecosystem, and six project-specific skills describing its own permission model, CSRF contract, and CRUD conventions - so an agent builds on real patterns from its first prompt instead of exploring a mostly-empty repo. In one measured run, an agent using those skills needed 42% fewer tool calls and 34% less time than one given the same task with no skills to read. See Agentic Development for what makes a BoxLang project agent-ready in general, and cbGenesis's own docs for the full methodology behind that number.

Where to go next

MiniServerCommandBoxAgentic Development