The bar is a development tool, keep it off. The console can run on a live server if you set a bxsecret: password, a tight console.access list, console.requireHttps and collect.level: "light". See Running Lens in production.

The bar is a strip on your HTML pages that shows one request. The console is a separate page at /~bxlens/index.bxm for one server: requests, errors, queries, datasources, caches, logs, executors, tasks, system and threads. They are switched on independently with bar.enabled and console.enabled. See Console.

/~bxlens/index.bxm always works. /~bxlens/ with a trailing slash works only if the request reaches BoxLang. On MiniServer that needs a pass predicate, see The console URL. A caller that is not allowed by console.access also gets a plain 404 on purpose.

Run boxlang generatesecret "your password" and put the bxsecret: value in console.password. See Console.

No, it is not open source. BxLens is freeware with limits under a BoxLang+ license. Free keeps the bar and most of the console: the last 25 requests, and errors and reports in memory. BoxLang+ or a trial adds request cost and the slow request sample, task and cache actions, log download, the diagnostic bundle, heap dumps, saving a bar layout, AI calls from the server, the disk store and a request history longer than 25. A locked item shows a "BoxLang+" note. See Licensing. See Licensing.

The page does not. Alpine.js and the Phosphor icons are bundled and fonts are system fonts. A strict Content-Security-Policy blocks any other request, so it works on an air gapped network. The server makes an outside call only if an admin turns on ai.enabled with a hosted provider. The Ask ChatGPT and Ask Claude buttons open a new tab in your browser and send nothing from the page.

Mostly in memory. History keeps the last 50 requests (history.maxRequests, 25 without BoxLang+ or a trial), and errors, reports and query statistics live in memory too. They clear on restart or module reload. With BoxLang+ or a trial, errors and reports are also saved to lens-data (store.dir) so they survive restarts. Lens also writes the bar layout (config/bxlens-layout.json), the settings you change in the console (config/bxlens-settings.json) and the audit log (bxlens-audit.log). There is no database. See Errors and Reports.

Yes, many of them. An admin can change them on the Settings page of the console. The change applies at once and is saved, so it survives a restart and wins over boxlang.json. Passwords, access rules and a few more can only be set in boxlang.json. See Live settings.

A viewer signs in with console.viewerPassword. They can look at every page. They cannot change anything, and cannot download thread dumps, log files, heap dumps or the diagnostic bundle, or read cache values. The last four need BoxLang+ anyway. See Roles.

Set console.readOnly to true in boxlang.json. Nobody can then change settings, run tasks, clear caches or reset counters from the console. Free already cannot run tasks or clear caches. See Console settings.

A heap dump needs BoxLang+ or a trial. It holds everything in memory, including passwords and session data, and Lens cannot redact it. It is off by default. An admin must turn on console.allowHeapDump, confirm the dump, and download the file, which Lens deletes soon after. See Heap dumps.

Copy prompt and the Ask ChatGPT and Ask Claude buttons send nothing from the server: you paste the prompt yourself. Explain with AI and Ask Lens send a redacted prompt through the bx-ai module, only when an admin sets ai.enabled. A local provider such as Ollama keeps it inside your network. See Ask Lens and AI help and the data flow.

Only Explain with AI and Ask Lens use it, and only with BoxLang+ or a trial. Copy prompt, Ask ChatGPT and Ask Claude are free. bx-ai ships inside Lens (the 3.6.0 snapshot build), so there is nothing to install. If you remove it, Lens still loads.

Without BoxLang+ or a trial they are kept in memory only. With one of them they are saved to disk. See Licensing.

The diagnostic bundle needs BoxLang+ or a trial. It is a zip with a thread dump, the environment, system, executor, task, datasource and cache data, and the Lens settings, with secrets hidden by name. No request data and no log files. See Environment.

Those responses get no bar, but Lens collects and stores them by default. Find them on the console Requests page.

Lens works at the request level, so it sees what core announces. Panels for ColdBox, cbwire and Quick are ideas, not shipped features.

Use lensPanel in app code or the interception points in a module. See Extending Lens.

Yes. Call lensDisable() early in the request.

Lens checks HTML responses for a missing Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, HSTS on HTTPS, and cookie flags. They are Notes: they do not count as issues and do not color the strip. Turn them off with checks.securityHeaders. See Issues.

Lens covers one server and one request at a time. BX Insights is the separate observability product for clusters, history over time and alerting. See the Roadmap.

Core announces no cache read events, so Lens cannot count them per request. The Runtime tab lists the names of the caches and the console Caches page shows the statistics.

Core renders its own page for uncaught exceptions and skips the event Lens uses. The request is still on the console Requests page.

No. The bar inlines its own assets into each HTML response, about 110 KB. The console serves its own files.