ColdBox at 20: Building the Next Chapter of Modern Application Development
For 20 years, ColdBox has helped developers structure, build, test, and maintain applications across the CFML ecosystem.
What began as an MVC framework has grown into a broader application-development platform supported by dependency injection, caching, logging, testing, security, scheduling, background jobs, command-line tooling, and an extensive collection of community and Ortus-maintained modules.
That history matters, especially to organizations responsible for applications expected to remain useful for many years. Longevity alone, however, is not enough. A framework must continue adapting to changes in application architecture, deployment, security, developer tooling, and runtime technology.
That was the central message behind the ColdBox announcements at Into the Box 2026: preserve the framework’s proven foundations while giving teams practical ways to build with BoxLang, adopt AI-assisted workflows, and modernize their applications incrementally.
From a CFML Framework to a Modern JVM Application Platform
ColdBox remains a conventions-based HMVC framework with deep roots in CFML. With ColdBox 8, it can also operate natively with BoxLang.
This is an important distinction.
Organizations are not being asked to discard their ColdBox experience or abandon existing applications. Teams can continue working with familiar architectural patterns—handlers, modules, routing, dependency injection, interceptors, scheduled tasks, testing, and application services—while choosing the runtime and language approach that fits each project.
ColdBox 8 introduced native BoxLang support through bx-coldbox, a compiled and BoxLang-enhanced edition of the framework. With BoxLang PRIME support, teams can build ColdBox applications directly in BoxLang without depending on the CFML Compatibility Module.
This creates two practical paths:
- Existing CFML applications can continue using ColdBox while teams evaluate modernization at their own pace.
- New projects can use ColdBox with native BoxLang capabilities and direct access to the wider Java ecosystem.
The result is continuity at the architectural level with more options at the language and runtime levels.
Explore what arrived with ColdBox 8
Watch the status and future updates during the Day 2 Keynote.
Why the ColdBox and BoxLang Integration Matters
The value of this integration is not simply that ColdBox can run on another language.
ColdBox provides the application architecture: routing, dependency injection, modularity, lifecycle events, configuration, testing patterns, and integrations. BoxLang provides a modern dynamic language and runtime designed for JVM interoperability, extensibility, and multiple deployment environments.
Together, they give development teams a structured way to use BoxLang for applications ranging from APIs and web platforms to services and other JVM workloads.
For developers, this means they do not need to assemble every architectural concern independently. For technical leaders, it provides an established framework and ecosystem around the newer runtime.
It also gives CFML teams a more gradual modernization path. Existing knowledge and application patterns remain relevant while developers gain access to native BoxLang compilation, Java interoperability, virtual threads, and BoxLang-specific framework capabilities.
This is less about rewriting applications and more about expanding what those applications—and the teams maintaining them—can do next.
Better Starting Points for New Applications
Application architecture is easiest to improve before a system becomes large.
ColdBox 8 introduced updated application templates designed around clearer separation of application code, configuration, resources, tests, and deployment assets. The templates also include options for Docker, Vite, Maven, testing, CI/CD workflows, and modern frontend integration.
A non-root security model is part of the newer application structure, helping teams begin with safer container and deployment practices instead of retrofitting them later.
These templates do not eliminate architectural decisions. They provide a more complete and consistent starting point from which teams can make those decisions.
For enterprise teams, that consistency can be especially useful. Standard project structures make applications easier to review, onboard, automate, and transfer between developers. They can also reduce the number of foundational choices every new team must repeatedly make.
A More Useful Debugging Experience
ColdBox 8 also introduced a redesigned Whoops error experience.
The updated interface provides clearer stack information and a visual representation of the files and calls involved in an exception. This helps developers move from the visible symptom toward the relevant part of the application more quickly.
Whoops can also provide exception context to a configured language model for further analysis. The model can help explain an error, identify likely causes, or suggest areas to investigate.
This should be understood as an additional diagnostic aid—not an automatic source of correct fixes. Developers still need to evaluate suggestions against the application’s code, data, configuration, and security requirements.
Used appropriately, the feature can reduce the manual effort required to collect error context and begin an investigation while leaving technical judgment with the development team.
AI Routing: Bringing AI Workflows into Application Architecture
ColdBox 8.1 expanded the framework with AI Routing, a BoxLang-specific capability for exposing AI operations through familiar ColdBox routes.
Developers can connect a route to supported AI runnables such as chat agents, embedding workflows, or MCP-related operations. Instead of designing the entire HTTP integration layer from the beginning, teams can apply ColdBox’s established routing and application patterns to these newer workloads.
Potential uses include:
- Conversational endpoints
- Embedding services
- Retrieval and agent workflows
- Authenticated AI operations
- Applications connecting to MCP servers
- Internal AI services governed through existing application architecture
The architectural benefit is consistency. AI features do not have to exist as disconnected experiments outside the main application. They can participate in established routing, security, configuration, logging, and service patterns.
This does not remove the need to design authentication, authorization, data boundaries, model access, observability, and cost controls. It gives teams a structured place to implement those concerns.
cbMCP: Giving AI Tools Application Context
ColdBox’s Model Context Protocol integration takes a related but different approach.
cbMCP is the official ColdBox MCP server and is available as a BoxLang-exclusive module. It allows compatible AI clients to inspect a running ColdBox application through structured MCP resources, prompts, and tools.
Depending on the configured capabilities, an AI client can inspect areas such as:
- Registered routes and handlers
- Loaded modules
- WireBox mappings
- CacheBox configuration and activity
- LogBox information
- Schedulers and tasks
- Interceptors
- Async executors
This addresses a common limitation in AI-assisted development: an assistant may understand the framework generally but know very little about the application currently running.
Skills and documentation can teach an agent how ColdBox works. cbMCP can provide structured information about how a particular application is configured and behaving.
Most of this interaction supports inspection and diagnosis. However, cbMCP also exposes a limited number of explicit operations that can change application state, including selected cache, task, and application-management actions. Teams should therefore treat the endpoint as an administrative surface.
The current guidance recommends using SSL, limiting access to trusted clients, and binding the endpoint to local interfaces in production. Protocol-level authentication and more granular access controls remain roadmap items, so access boundaries should be designed carefully.
Read the cbMCP announcement and security guidance
ColdBox CLI and Agent-Assisted Development
The ColdBox CLI has also evolved beyond project scaffolding.
ColdBox CLI 8.11 can create and refresh project context for AI coding tools, discover skills and MCP documentation servers contributed by installed modules, and maintain shared agent guidance inside a project.
This helps solve a practical problem: AI assistants often produce generic or inconsistent results when they do not understand a framework’s conventions or a project’s structure.
The CLI can generate the files and context needed to explain those conventions to supported tools. When project dependencies change, developers can refresh that context so the assistant’s available guidance stays aligned with the application.
The CLI does not replace the developer or independently understand every business requirement. Teams still need to document their domain, architecture, security rules, and internal conventions. Its role is to make the reusable framework and module context easier to install and maintain.
See what is available in ColdBox CLI 8.11
Reusable Skills for Development Teams
The public BoxLang Skills Directory extends this workflow with reusable, task-specific instructions for AI agents.
At launch, the directory included more than 200 skills covering BoxLang, ColdBox, TestBox, CommandBox, supporting modules, and general development practices.
A skill might teach an agent how to create a ColdBox handler, write a TestBox specification, structure a REST API, work with asynchronous operations, or apply a particular module’s conventions.
This approach is useful because it separates reusable technical guidance from one-off prompts. Skills can be versioned, reviewed, installed, and shared across development environments.
For organizations, this can support more consistent AI-assisted workflows across a team. It does not guarantee correct output, and generated code should continue through normal review, testing, and security processes. It does, however, give agents more relevant context than a generic model would otherwise possess.
Explore the Skills ecosystem
What This Means for Enterprise Teams
ColdBox’s longevity provides evidence of continuity, but its value to an enterprise depends on more than age.
The framework offers several practical characteristics for long-lived applications:
- Conventions that make project structure easier to understand
- Modular architecture for separating business capabilities
- Dependency injection and lifecycle management
- Integrated testing through TestBox
- Security, caching, logging, scheduling, and queue integrations
- CLI-supported project creation and automation
- Container-oriented templates and deployment options
- A migration path from CFML applications toward native BoxLang development
- Commercial training, support, and development services from the team behind the framework
The ColdBox ecosystem also includes more than 700 modules, giving teams access to existing integrations without requiring every capability to be developed internally.
No framework removes the need for sound architecture, operational discipline, testing, or security review. ColdBox’s value is that it provides an established structure and ecosystem in which teams can apply those practices.
Modernization Without Discarding What Already Works
One of the most useful aspects of the ColdBox and BoxLang relationship is that teams can approach modernization in stages.
An organization might begin by updating its ColdBox application and tests. It might then standardize deployment through containers, introduce newer application templates for greenfield services, evaluate BoxLang compatibility, or adopt native BoxLang for a new module or application.
AI-assisted development, Skills, AI Routing, and MCP integration can be evaluated separately based on the organization’s needs and security requirements.
Not every application needs every capability, and modernization does not need to happen as one large migration project.
ColdBox provides continuity in application architecture. BoxLang expands the available runtime and language options. Together, they give teams a way to move forward while protecting useful business logic, team knowledge, and existing investments.
Twenty Years, with the Foundations Still Intact
ColdBox’s 20th anniversary is an opportunity to recognize both longevity and change.
The framework has grown from its MVC origins into a modular application platform with extensive tooling, testing, integrations, and a large ecosystem. Its native relationship with BoxLang now opens another chapter—one that connects established ColdBox practices with modern JVM development and optional AI-assisted workflows.
The most important point is not that every ColdBox application must immediately adopt BoxLang or AI.
It is that developers and organizations now have more paths available to them.
They can maintain existing applications, modernize them progressively, build native BoxLang applications with familiar ColdBox architecture, or introduce newer capabilities where they produce a clear technical benefit.
After 20 years, ColdBox is not abandoning the principles that made it useful. It is applying those principles to the next set of application-development challenges.
Continue Exploring
- Explore the ColdBox platform
- Read the ColdBox documentation
- Review ColdBox 8: The Ocho
- Discover BoxLang
- Explore BoxLang AI
- Browse reusable AI Skills
ColdBox has reached 20 years because developers continued building with it, contributing to it, and adapting it to real application requirements. The next chapter will be shaped the same way: through practical use, technical feedback, and the community around it.
Join the Ortus Community
Be part of the movement shaping the future of web development. Stay connected and receive the latest updates on, product launches, tool updates, promo services and much more.
Subscribe to our newsletter for exclusive content.
Follow Us on Social media and don’t miss any news and updates:
Add Your Comment