Registry › Compare › BoxLite vs Fence

BoxLite vs Fence

BoxLite leads on trust: 85.1/100 (Grade A) against 56.6/100 (Grade C), a 28.5-point gap. BoxLite leads on provenance and maintenance, and rests on broader evidence; Fence leads on transparency.

A BoxLite 85.1

The micro-VM for AI agents — light enough to embed on your laptop, elastic enough to power an agentic cloud.

boxlite-ai/boxlite · #93 overall · #1 Sandboxes & Runtimes · coverage B (3/5)

Choose BoxLite if provenance and maintenance matter most.

+8.5Maintenance: last push today, against 7d ago
+7.2Identity / Provenance: package provenance attested, against none
+6.8Adoption: 2.5k GitHub stars against 991
+6.2Safety / Integrity: 100% of recent commits signed, against 79%

C Fence 56.6

Lightweight, container-free sandbox for running commands with network and filesystem restrictions

fencesandbox/fence · #766 overall · #6 Sandboxes & Runtimes · coverage C (2/5)

Choose Fence if transparency matters most.

+1.6Transparency: OSSF Scorecard 7.0 against 5.1

Where they differ

18.9

Safety / IntegrityBoxLite +6.2

12.7

18.0

Identity / ProvenanceBoxLite +7.2

10.8

12.8

TransparencyFence +1.6

14.4

20.0

MaintenanceBoxLite +8.5

11.5

14.0

AdoptionBoxLite +6.8

7.2

+1.4

Runtime calibrationBoxLite +1.4

+0.0

Full evidence table

An independent, evidence-based trust comparison of BoxLite and Fence, two Sandboxes & Runtimes projects in the HVTracker registry. Scores come from public, checkable signals — supply-chain provenance, OSSF Scorecard, maintenance, and adoption — not popularity.

Full evidence

Signal	BoxLiteboxlite-ai/boxlite	Fencefencesandbox/fence
HVTrust score	85.1	56.6
Evidence grade	A	C
Coverage grade	B	C
Overall rank	#93	#766
Rank in Sandboxes & Runtimes	#1	#6
GitHub stars	2.5k	991
Last updated	today	7d ago
Build provenance	Yes	No
OSSF Scorecard	5.1 / 10	7.0 / 10
License	Apache-2.0	Apache-2.0
Downloads	24k/wk	—
Trust dimensions (points earned)
Safety / integrity / 25	18.9	12.7
Identity & provenance / 18	18.0	10.8
Transparency / 17	12.8	14.4
Maintenance / 20	20.0	11.5
Adoption / 20	14.0	7.2
Runtime capability surface (full matrix)
MCP server	—	—
External providers	3 — Anthropic, Postgres, Redis	—
Requires API keys	No	No
Plugin surface	plugins	—
Provenance drift	Match	—

Open in the live compare tool → BoxLite profile Fence profile More Sandboxes & Runtimes →

How to read this: HVTrust (0–100) weighs supply-chain signals (provenance, OSSF Scorecard, signed commits, open license) alongside real-world adoption, scaled by an evidence-confidence factor. Grade bands: A ≥ 80, B ≥ 65, C ≥ 50, D < 50. Signals refresh daily. Full methodology v4.4 →