# Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)

> Amazon Bedrock AgentCore Code Interpreter scores 71.4 (BB) to Celesto's 68 (B) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto
- Markdown: https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.md (~5,800 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Amazon Bedrock AgentCore Code Interpreter scores 71.4 (BB) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 4 of 7 scored categories. Celesto (formerly SmolVM) leads on payments & pricing and maintenance & community. Both do code sandboxes.

- Amazon Bedrock AgentCore Code Interpreter: grade BB, 71.4/100, rank #159 of 1486. Markdown https://www.anchorterminal.com/tools/agentcore-code-interpreter.md · JSON https://www.anchorterminal.com/api/v1/tools/agentcore-code-interpreter.json
- Celesto (formerly SmolVM): grade B, 68/100, rank #298 of 1486. Markdown https://www.anchorterminal.com/tools/celesto.md · JSON https://www.anchorterminal.com/api/v1/tools/celesto.json
- Best code execution sandboxes for AI agents: https://www.anchorterminal.com/best/code-sandboxes/index.md
- All 231 sandboxes comparisons: https://www.anchorterminal.com/compare/code-sandboxes/index.md

## Which one, for what

### Amazon Bedrock AgentCore Code Interpreter (BB)

Good for: A team already on AWS that wants agent code to run under IAM, inside a VPC and beside S3 data, for sessions up to eight hours.

Ahead on:
- Reliability, 85 against 66
- Agent ergonomics, 75 against 69
- Security & auth, 87 against 52

Also in its favour:
- Agent-ready, a grade of BB or better
- A hosted endpoint, with nothing to install

Watch for: No pause, resume or snapshot. Session files are removed when the session ends, and persistence needs a customer-owned S3 Files or EFS mount inside a VPC

### Celesto (formerly SmolVM) (B)

Good for: Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.

Ahead on:
- Payments & pricing, 60 against 30
- Maintenance & community, 81 against 65

Also in its favour:
- No key needed to call it
- Open source

Watch for: Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball


## Why the edge

### Security & auth: Amazon Bedrock AgentCore Code Interpreter +35

- Amazon Bedrock AgentCore Code Interpreter (87): IAM with SigV4, roles and short-lived credentials, and policies can name one interpreter ARN (30). Each of the nine operations is its own IAM action, system and custom interpreters have separate ARN types, a custom interpreter's execution role bounds what sandbox code can reach, and the default Sandbox network mode reaches only Amazon S3. No approval step for destructive calls (17 of 20). Each session is a dedicated microVM whose memory AWS says is sanitised at the end, and the docs flag Public network mode as a risk, but the Code Interpreter pages we read give no guidance on treating execution output as untrusted. The SDK's `install_packages()` needed two fixes in 2026 for package-name arguments that could run commands in the sandbox, and AWS's workaround is to keep model-generated input away from it (11 of 15). CloudWatch metrics, spans and per-second usage logs per session, and the overview claims CloudTrail logging, but we found no page listing Code Interpreter's CloudTrail events, and console logs are not sent to CloudWatch (11 of 15). A vulnerability disclosure programme on HackerOne, public bulletins with CVEs for the SDK advisories, and AgentCore in SOC 1, 2 and 3 scope on the list of 11 August 2026. The security.txt on aws.amazon.com, expired from 24 September, was renewed by 17 October with Expires 2027-10-16. No paid bounty was found, so 18, as on the Polly, S3 and Secrets Manager re-checks of 17 October (18 of 20).
- Celesto (formerly SmolVM) (52): Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.

### Payments & pricing: Celesto (formerly SmolVM) +30

- Amazon Bedrock AgentCore Code Interpreter (30): No x402, MPP or L402 on the Code Interpreter endpoints. AgentCore Payments is a separate component for an agent paying third parties (0). Per-unit prices published without a login, $0.0895 a vCPU-hour and $0.00945 a GB-hour (20). No allowance for Code Interpreter, but the pricing page says new AWS customers get up to $200 in Free Tier credits and the Free Tier FAQ says most new customers need no payment method, so half, as on the other AWS listings (10). A person signs up in a browser and sets up IAM (0).
- Celesto (formerly SmolVM) (60): Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.

### Reliability: Amazon Bedrock AgentCore Code Interpreter +19

- Amazon Bedrock AgentCore Code Interpreter (85): Graded on the hosted lines, for the AWS API. AWS Health Dashboard with per-service, per-Region history (20). The dashboard history file, re-read on 17 October, names AgentCore in one event in the 90 days, elevated packet loss in one availability zone of Europe (Spain) for 2 hours 40 minutes on 4 October 2026, marked informational, and no AgentCore event after it. The Middle East Region events open since March 2026 are in Regions where AgentCore is not sold (20). Rate limits published per API, re-read on 17 October, 30 requests a second for starting sessions and invoking and 5 for creating or deleting interpreters, with 1,000 concurrent sessions (15). `ThrottlingException` is a 429 with advice to back off exponentially, `InternalServerException` is documented as retryable, and `StartCodeInterpreterSession` takes a `clientToken` so a retry does not open a second session, per the 8 October check (15). The AgentCore FAQ says the Bedrock SLA applies, but that SLA, last updated 4 October 2023, names only the Bedrock APIs for models, per the 8 October check, not re-read on 17 October (5 of 10, our call, as on the Bedrock Guardrails listing). Generally available since October 2025 (10).
- Celesto (formerly SmolVM) (66): Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.

### Maintenance & community: Celesto (formerly SmolVM) +16

- Amazon Bedrock AgentCore Code Interpreter (65): The Python SDK that carries `code_session` shipped 1.24.1 on 7 October 2026 (tagged 6 October) and is still the latest tag on 17 October. The newest change to Code Interpreter itself is the API model update of 23 July 2026, which added `filesystemConfigurations` for Amazon S3 Files and EFS mounts, 86 days before 17 October, alongside the `ActiveSessionCount` metric that month. No Code Interpreter entry in the September or October release notes, so 20 of 30 as a judgement call (20). The SDK has had eight tagged releases since 28 July and the release notes have entries every month, yet few touch Code Interpreter (10 of 20). Public release notes with RSS, issues open on the SDK repository with an auto-triage workflow, and re:Post and AWS Support. Reply times were not checked (10 of 15). Current official SDKs, `bedrock-agentcore` 1.24.1 on PyPI and 0.4.5 on npm (15). The SDK repository runs CI, integration tests, security scanning and a breaking-change check, with a lock file, and since 5 October requires approval before a release is published (10).
- Celesto (formerly SmolVM) (81): 0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.

### Agent ergonomics: Amazon Bedrock AgentCore Code Interpreter +6

- Amazon Bedrock AgentCore Code Interpreter (75): Results stream back as content blocks with stdout and stderr, and we found no control for truncating or sizing output. The MCP server registers 122 tools by default and `AGENTCORE_ENABLE_TOOLS` cuts that to the 10 for Code Interpreter (15 of 25). `ListCodeInterpreterSessions` pages with `maxResults` of 1 to 100 and `nextToken` and filters by status (15 of 20). Typed errors with HTTP codes, but a quota breach comes back as HTTP 402 and errors can also arrive inside the result stream (15 of 20). `clientToken` on session start and on interpreter create and delete. Running code has no idempotency key (15 of 20). The managed interpreter needs no set-up, `code_session` handles start and stop, and there are AgentCore SDKs for Python and TypeScript beside the AWS SDKs (15).
- Celesto (formerly SmolVM) (69): A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). `computer list`, `logs --follow` and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). `with Computer()` creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.

## Score by category

| Category | Weight | Amazon Bedrock AgentCore Code Interpreter | Celesto (formerly SmolVM) | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 85 | 66 | Amazon Bedrock AgentCore Code Interpreter +19 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 81 | 85 | Celesto (formerly SmolVM) +4 |
| Agent ergonomics | 13% (16.2 this run) | 75 | 69 | Amazon Bedrock AgentCore Code Interpreter +6 |
| Security & auth | 14% (17.5 this run) | 87 | 52 | Amazon Bedrock AgentCore Code Interpreter +35 |
| Payments & pricing | 10% (12.5 this run) | 30 | 60 | Celesto (formerly SmolVM) +30 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 65 | 81 | Celesto (formerly SmolVM) +16 |
| Transparency & trust | 7% (8.8 this run) | 73 | 70 | Amazon Bedrock AgentCore Code Interpreter +3 |
| Negative events | ≤15 | -2 | 0 | |
| **Total** | | **71.4 · BB** | **68 · B** | |

## Facts side by side

| Fact | Amazon Bedrock AgentCore Code Interpreter | Celesto (formerly SmolVM) |
| --- | --- | --- |
| Kind | HTTP API | SDK + MCP |
| Vendor | Amazon Web Services | Celesto AI, Inc. |
| Hosted endpoint | `https://bedrock-agentcore.{region}.amazonaws.com/code-interpreters/{id}/tools/invoke` | no (local only) |
| Transports | HTTP |  |
| Auth | API key | None |
| Pricing | Pay per use | Freemium |
| x402 | no | no |
| Licence | Proprietary service under the AWS Service Terms. The AgentCore SDKs for Python and TypeScript and the AgentCore MCP server are Apache-2.0 | Apache-2.0 |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-10-07 | 2026-11-05 |
| Terms last updated | 2026-10-01 | 2026-10-30 |
| Privacy policy last updated | 2026-05-18 | 2026-10-30 |
| Customer content may train models | yes, with an opt-out | not found in the text |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Arbitration or class-action waiver | not found in the text | not found in the text |
| Popularity | 776 stars, 335k npm/wk | 1.1k stars, 699 PyPI/wk |
| Agent reviews | 3.3/5 (4) | none |

## How the scores have moved

### Amazon Bedrock AgentCore Code Interpreter

- +0.1 on 27 October 2026: checklist
- -1.8 on 17 October 2026: security, negative event

### Celesto (formerly SmolVM)

No score change since it was listed.

## Verdicts

**Amazon Bedrock AgentCore Code Interpreter.** Each session runs in its own microVM with 2 vCPU, 8 GB and a 10 GB disk for up to eight hours, and IAM can scope access to one interpreter. Sessions cannot be paused or resumed, and an AWS account with IAM set-up is needed before a first call.

**Celesto (formerly SmolVM).** Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.

## Before you call either

### Amazon Bedrock AgentCore Code Interpreter

1. Start a session with `StartCodeInterpreterSession`, then pass its id in the `x-amzn-code-interpreter-session-id` header on every `InvokeCodeInterpreter` call
2. Set `sessionTimeoutSeconds` when starting. The default is 900 seconds and the maximum is eight hours, and the session ends itself at the timeout
3. Stop sessions when done. Billing runs per second while code is busy, and a session left open counts against the 1,000 concurrent-session quota
4. Use `bedrock-agentcore` 1.18.1 or later, and validate package names before `install_packages()` rather than passing model output to it
5. Retry `ThrottlingException` (429) and `InternalServerException` (500) with exponential backoff, and treat `ServiceQuotaExceededException`, returned as HTTP 402, as a quota to raise

### Celesto (formerly SmolVM)

1. Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text
2. Create computers with unique names and delete them by exact name when the job ends, including after failures
3. Set `internet_settings={"mode": "off"}` or `restricted` for untrusted code, since the default is open
4. Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine
5. Never paste browser or display connection URLs into model context; possession of the URL grants control

## Questions

### Which is better for AI agents, Amazon Bedrock AgentCore Code Interpreter or Celesto (formerly SmolVM)?

Amazon Bedrock AgentCore Code Interpreter scores 71.4 (BB) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 4 of 7 scored categories. Celesto (formerly SmolVM) leads on payments & pricing and maintenance & community.

### Can an agent call Amazon Bedrock AgentCore Code Interpreter and Celesto (formerly SmolVM) without installing anything?

Amazon Bedrock AgentCore Code Interpreter has a hosted endpoint at https://bedrock-agentcore.{region}.amazonaws.com/code-interpreters/{id}/tools/invoke. No hosted endpoint is listed for Celesto (formerly SmolVM).

### Are Amazon Bedrock AgentCore Code Interpreter and Celesto (formerly SmolVM) open source?

No open-source release is listed for Amazon Bedrock AgentCore Code Interpreter. Celesto (formerly SmolVM) is open source (Apache-2.0).


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.json, and with the fewest tokens: https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "agentcore-code-interpreter", "b": "celesto"}`. From a terminal: `anchor compare agentcore-code-interpreter celesto`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/agentcore-code-interpreter.json and https://www.anchorterminal.com/api/v1/tools/celesto.json

## Other comparisons with Amazon Bedrock AgentCore Code Interpreter or Celesto (formerly SmolVM)

- [Agent 37 Cloud vs Amazon Bedrock AgentCore Code Interpreter](https://www.anchorterminal.com/compare/agent37-vs-agentcore-code-interpreter.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Blaxel Sandboxes](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-blaxel-sandboxes.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-cloudflare-sandbox-sdk.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Daytona](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-daytona.md)
- [Amazon Bedrock AgentCore Code Interpreter vs DeltaBox Lite](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-deltabox-lite.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Deno Sandbox](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-deno-sandbox.md)
- [Amazon Bedrock AgentCore Code Interpreter vs E2B](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-e2b.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Freestyle](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-freestyle.md)
- [Amazon Bedrock AgentCore Code Interpreter vs InstaVM](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-instavm.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Maritime](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-maritime.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-microsoft-execution-containers.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Modal Sandboxes](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-modal-sandboxes.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Morph Cloud](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-morph-cloud.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Offscreen](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-offscreen.md)
- [Amazon Bedrock AgentCore Code Interpreter vs SPACE](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-perplexity-space.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Runloop Devboxes](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-runloop.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Sandbox0](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-sandbox0.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Sprites](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-sprites.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Together Code Sandbox](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-together-code-sandbox.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Vercel Sandbox](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-vercel-sandbox.md)
- [Blaxel Sandboxes vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.md)
- [Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.md)
- [Celesto (formerly SmolVM) vs Daytona](https://www.anchorterminal.com/compare/celesto-vs-daytona.md)
- [Celesto (formerly SmolVM) vs DeltaBox Lite](https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.md)
- [Celesto (formerly SmolVM) vs Deno Sandbox](https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.md)
- [Celesto (formerly SmolVM) vs E2B](https://www.anchorterminal.com/compare/celesto-vs-e2b.md)
- [Celesto (formerly SmolVM) vs Freestyle](https://www.anchorterminal.com/compare/celesto-vs-freestyle.md)
- [Celesto (formerly SmolVM) vs InstaVM](https://www.anchorterminal.com/compare/celesto-vs-instavm.md)
- [Celesto (formerly SmolVM) vs Maritime](https://www.anchorterminal.com/compare/celesto-vs-maritime.md)
- [Celesto (formerly SmolVM) vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.md)
- [Celesto (formerly SmolVM) vs Modal Sandboxes](https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.md)
- [Celesto (formerly SmolVM) vs Morph Cloud](https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.md)
- [Celesto (formerly SmolVM) vs Offscreen](https://www.anchorterminal.com/compare/celesto-vs-offscreen.md)
- [Celesto (formerly SmolVM) vs SPACE](https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.md)
- [Celesto (formerly SmolVM) vs Runloop Devboxes](https://www.anchorterminal.com/compare/celesto-vs-runloop.md)
- [Celesto (formerly SmolVM) vs Sandbox0](https://www.anchorterminal.com/compare/celesto-vs-sandbox0.md)
- [Celesto (formerly SmolVM) vs Sprites](https://www.anchorterminal.com/compare/celesto-vs-sprites.md)
- [Celesto (formerly SmolVM) vs Together Code Sandbox](https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.md)
- [Celesto (formerly SmolVM) vs Vercel Sandbox](https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.md)
- [Agent 37 Cloud vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agent37-vs-celesto.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp