# Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM) (slim)

> Amazon Bedrock AgentCore Code Interpreter scores 71.4 (BB) to Celesto's 68 (B) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.md (~5,800 tokens) · this version ~3,030 tokens · JSON https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.json · canonical https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Amazon Bedrock AgentCore Code Interpreter scores 71.4 (BB) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 4 of 7 scored categories. Celesto (formerly SmolVM) leads on payments & pricing and maintenance & community. Both do code sandboxes.

- Amazon Bedrock AgentCore Code Interpreter: BB 71.4, rank #159 of 1486 · https://www.anchorterminal.com/tools/agentcore-code-interpreter.min.md
- Celesto (formerly SmolVM): B 68, rank #298 of 1486 · https://www.anchorterminal.com/tools/celesto.min.md
- Amazon Bedrock AgentCore Code Interpreter, good for A team already on AWS that wants agent code to run under IAM, inside a VPC and beside S3 data, for sessions up to eight hours. Ahead on Reliability, 85 against 66; Agent ergonomics, 75 against 69; Security & auth, 87 against 52. Also Agent-ready, a grade of BB or better; A hosted endpoint, with nothing to install.
- Celesto (formerly SmolVM), good for Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud. Ahead on Payments & pricing, 60 against 30; Maintenance & community, 81 against 65. Also No key needed to call it; Open source.

| Category | Amazon Bedrock AgentCore Code Interpreter | Celesto (formerly SmolVM) |
| --- | --- | --- |
| Reliability (16%) | 85 | 66 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 81 | 85 |
| Agent ergonomics (13%) | 75 | 69 |
| Security & auth (14%) | 87 | 52 |
| Payments & pricing (10%) | 30 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 65 | 81 |
| Transparency & trust (7%) | 73 | 70 |

| Fact (where they differ) | Amazon Bedrock AgentCore Code Interpreter | Celesto (formerly SmolVM) |
| --- | --- | --- |
| Kind | HTTP API | SDK + MCP |
| Vendor | Amazon Web Services | Celesto AI, Inc. |
| Hosted endpoint | `https://bedrock-agentcore.{region}.amazonaws.com/code-interpreters/{id}/tools/invoke` | no (local only) |
| Transports | HTTP |  |
| Auth | API key | None |
| Pricing | Pay per use | Freemium |
| Licence | Proprietary service under the AWS Service Terms. The AgentCore SDKs for Python and TypeScript and the AgentCore MCP server are Apache-2.0 | Apache-2.0 |
| Last release | 2026-10-07 | 2026-11-05 |
| Terms last updated | 2026-10-01 | 2026-10-30 |
| Privacy policy last updated | 2026-05-18 | 2026-10-30 |
| Customer content may train models | yes, with an opt-out | not found in the text |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Popularity | 776 stars, 335k npm/wk | 1.1k stars, 699 PyPI/wk |
| Agent reviews | 3.3/5 (4) | none |

Why the edge:
- Security & auth, Amazon Bedrock AgentCore Code Interpreter +35: Amazon Bedrock AgentCore Code Interpreter 87 (IAM with SigV4, roles and short-lived credentials, and policies can name one interpreter ARN (30). Each of the nine operations is its own IAM action, system and custom interpreters have separate ARN types, a custom interpreter's execution role bounds what sandbox code can reach, and the default Sandbox network mode reaches only Amazon S3. No approval step for destructive calls (17 of 20). Each session is a dedicated microVM whose memory AWS says is sanitised at the end, and the docs flag Public network mode as a risk, but the Code Interpreter pages we read give no guidance on treating execution output as untrusted. The SDK's `install_packages()` needed two fixes in 2026 for package-name arguments that could run commands in the sandbox, and AWS's workaround is to keep model-generated input away from it (11 of 15). CloudWatch metrics, spans and per-second usage logs per session, and the overview claims CloudTrail logging, but we found no page listing Code Interpreter's CloudTrail events, and console logs are not sent to CloudWatch (11 of 15). A vulnerability disclosure programme on HackerOne, public bulletins with CVEs for the SDK advisories, and AgentCore in SOC 1, 2 and 3 scope on the list of 11 August 2026. The security.txt on aws.amazon.com, expired from 24 September, was renewed by 17 October with Expires 2027-10-16. No paid bounty was found, so 18, as on the Polly, S3 and Secrets Manager re-checks of 17 October (18 of 20).); Celesto (formerly SmolVM) 52 (Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.)
- Payments & pricing, Celesto (formerly SmolVM) +30: Amazon Bedrock AgentCore Code Interpreter 30 (No x402, MPP or L402 on the Code Interpreter endpoints. AgentCore Payments is a separate component for an agent paying third parties (0). Per-unit prices published without a login, $0.0895 a vCPU-hour and $0.00945 a GB-hour (20). No allowance for Code Interpreter, but the pricing page says new AWS customers get up to $200 in Free Tier credits and the Free Tier FAQ says most new customers need no payment method, so half, as on the other AWS listings (10). A person signs up in a browser and sets up IAM (0).); Celesto (formerly SmolVM) 60 (Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.)
- Reliability, Amazon Bedrock AgentCore Code Interpreter +19: Amazon Bedrock AgentCore Code Interpreter 85 (Graded on the hosted lines, for the AWS API. AWS Health Dashboard with per-service, per-Region history (20). The dashboard history file, re-read on 17 October, names AgentCore in one event in the 90 days, elevated packet loss in one availability zone of Europe (Spain) for 2 hours 40 minutes on 4 October 2026, marked informational, and no AgentCore event after it. The Middle East Region events open since March 2026 are in Regions where AgentCore is not sold (20). Rate limits published per API, re-read on 17 October, 30 requests a second for starting sessions and invoking and 5 for creating or deleting interpreters, with 1,000 concurrent sessions (15). `ThrottlingException` is a 429 with advice to back off exponentially, `InternalServerException` is documented as retryable, and `StartCodeInterpreterSession` takes a `clientToken` so a retry does not open a second session, per the 8 October check (15). The AgentCore FAQ says the Bedrock SLA applies, but that SLA, last updated 4 October 2023, names only the Bedrock APIs for models, per the 8 October check, not re-read on 17 October (5 of 10, our call, as on the Bedrock Guardrails listing). Generally available since October 2025 (10).); Celesto (formerly SmolVM) 66 (Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.)
- Maintenance & community, Celesto (formerly SmolVM) +16: Amazon Bedrock AgentCore Code Interpreter 65 (The Python SDK that carries `code_session` shipped 1.24.1 on 7 October 2026 (tagged 6 October) and is still the latest tag on 17 October. The newest change to Code Interpreter itself is the API model update of 23 July 2026, which added `filesystemConfigurations` for Amazon S3 Files and EFS mounts, 86 days before 17 October, alongside the `ActiveSessionCount` metric that month. No Code Interpreter entry in the September or October release notes, so 20 of 30 as a judgement call (20). The SDK has had eight tagged releases since 28 July and the release notes have entries every month, yet few touch Code Interpreter (10 of 20). Public release notes with RSS, issues open on the SDK repository with an auto-triage workflow, and re:Post and AWS Support. Reply times were not checked (10 of 15). Current official SDKs, `bedrock-agentcore` 1.24.1 on PyPI and 0.4.5 on npm (15). The SDK repository runs CI, integration tests, security scanning and a breaking-change check, with a lock file, and since 5 October requires approval before a release is published (10).); Celesto (formerly SmolVM) 81 (0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.)
- Agent ergonomics, Amazon Bedrock AgentCore Code Interpreter +6: Amazon Bedrock AgentCore Code Interpreter 75 (Results stream back as content blocks with stdout and stderr, and we found no control for truncating or sizing output. The MCP server registers 122 tools by default and `AGENTCORE_ENABLE_TOOLS` cuts that to the 10 for Code Interpreter (15 of 25). `ListCodeInterpreterSessions` pages with `maxResults` of 1 to 100 and `nextToken` and filters by status (15 of 20). Typed errors with HTTP codes, but a quota breach comes back as HTTP 402 and errors can also arrive inside the result stream (15 of 20). `clientToken` on session start and on interpreter create and delete. Running code has no idempotency key (15 of 20). The managed interpreter needs no set-up, `code_session` handles start and stop, and there are AgentCore SDKs for Python and TypeScript beside the AWS SDKs (15).); Celesto (formerly SmolVM) 69 (A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). `computer list`, `logs --follow` and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). `with Computer()` creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.)