Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)

Amazon Bedrock AgentCore Code Interpreter 87

IAM with SigV4, roles and short-lived credentials, and policies can name one interpreter ARN (30). Each of the nine operations is its own IAM action, system and custom interpreters have separate ARN types, a custom interpreter's execution role bounds what sandbox code can reach, and the default Sandbox network mode reaches only Amazon S3. No approval step for destructive calls (17 of 20). Each session is a dedicated microVM whose memory AWS says is sanitised at the end, and the docs flag Public network mode as a risk, but the Code Interpreter pages we read give no guidance on treating execution output as untrusted. The SDK's install_packages() needed two fixes in 2026 for package-name arguments that could run commands in the sandbox, and AWS's workaround is to keep model-generated input away from it (11 of 15). CloudWatch metrics, spans and per-second usage logs per session, and the overview claims CloudTrail logging, but we found no page listing Code Interpreter's CloudTrail events, and console logs are not sent to CloudWatch (11 of 15). A vulnerability disclosure programme on HackerOne, public bulletins with CVEs for the SDK advisories, and AgentCore in SOC 1, 2 and 3 scope on the list of 11 August 2026. The security.txt on aws.amazon.com, expired from 24 September, was renewed by 17 October with Expires 2027-10-16. No paid bounty was found, so 18, as on the Polly, S3 and Secrets Manager re-checks of 17 October (18 of 20).

Celesto (formerly SmolVM) 52

Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). computer logs shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.

Amazon Bedrock AgentCore Code Interpreter 30

No x402, MPP or L402 on the Code Interpreter endpoints. AgentCore Payments is a separate component for an agent paying third parties (0). Per-unit prices published without a login, $0.0895 a vCPU-hour and $0.00945 a GB-hour (20). No allowance for Code Interpreter, but the pricing page says new AWS customers get up to $200 in Free Tier credits and the Free Tier FAQ says most new customers need no payment method, so half, as on the other AWS listings (10). A person signs up in a browser and sets up IAM (0).

Celesto (formerly SmolVM) 60

Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.

Amazon Bedrock AgentCore Code Interpreter 85

Graded on the hosted lines, for the AWS API. AWS Health Dashboard with per-service, per-Region history (20). The dashboard history file, re-read on 17 October, names AgentCore in one event in the 90 days, elevated packet loss in one availability zone of Europe (Spain) for 2 hours 40 minutes on 4 October 2026, marked informational, and no AgentCore event after it. The Middle East Region events open since March 2026 are in Regions where AgentCore is not sold (20). Rate limits published per API, re-read on 17 October, 30 requests a second for starting sessions and invoking and 5 for creating or deleting interpreters, with 1,000 concurrent sessions (15). ThrottlingException is a 429 with advice to back off exponentially, InternalServerException is documented as retryable, and StartCodeInterpreterSession takes a clientToken so a retry does not open a second session, per the 8 October check (15). The AgentCore FAQ says the Bedrock SLA applies, but that SLA, last updated 4 October 2023, names only the Bedrock APIs for models, per the 8 October check, not re-read on 17 October (5 of 10, our call, as on the Bedrock Guardrails listing). Generally available since October 2025 (10).

Celesto (formerly SmolVM) 66

Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as celesto with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.

Amazon Bedrock AgentCore Code Interpreter 65

The Python SDK that carries code_session shipped 1.24.1 on 7 October 2026 (tagged 6 October) and is still the latest tag on 17 October. The newest change to Code Interpreter itself is the API model update of 23 July 2026, which added filesystemConfigurations for Amazon S3 Files and EFS mounts, 86 days before 17 October, alongside the ActiveSessionCount metric that month. No Code Interpreter entry in the September or October release notes, so 20 of 30 as a judgement call (20). The SDK has had eight tagged releases since 28 July and the release notes have entries every month, yet few touch Code Interpreter (10 of 20). Public release notes with RSS, issues open on the SDK repository with an auto-triage workflow, and re:Post and AWS Support. Reply times were not checked (10 of 15). Current official SDKs, bedrock-agentcore 1.24.1 on PyPI and 0.4.5 on npm (15). The SDK repository runs CI, integration tests, security scanning and a breaking-change check, with a lock file, and since 5 October requires approval before a release is published (10).

Celesto (formerly SmolVM) 81

0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.

Amazon Bedrock AgentCore Code Interpreter 75

Results stream back as content blocks with stdout and stderr, and we found no control for truncating or sizing output. The MCP server registers 122 tools by default and AGENTCORE_ENABLE_TOOLS cuts that to the 10 for Code Interpreter (15 of 25). ListCodeInterpreterSessions pages with maxResults of 1 to 100 and nextToken and filters by status (15 of 20). Typed errors with HTTP codes, but a quota breach comes back as HTTP 402 and errors can also arrive inside the result stream (15 of 20). clientToken on session start and on interpreter create and delete. Running code has no idempotency key (15 of 20). The managed interpreter needs no set-up, code_session handles start and stop, and there are AgentCore SDKs for Python and TypeScript beside the AWS SDKs (15).

Celesto (formerly SmolVM) 69

A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). computer list, logs --follow and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). with Computer() creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.