Blaxel Sandboxes vs Celesto (formerly SmolVM)

Blaxel Sandboxes 40

No x402, MPP or L402. An open issue on the Python SDK asking for x402 dates from 26 September 2026 (0). Per-unit prices published without a login, $0.0000115 a GB of RAM a second (20). Up to $200 of free credits, but we found no statement on whether a card is needed, so half (10). Stripe Projects, since 10 June 2026, lets an agent create the account and receive credentials through the operator's Stripe login and saved card. A person still has to log in to Stripe once (10).

Celesto (formerly SmolVM) 60

Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.

Blaxel Sandboxes 64

API keys that can be set never to expire, OAuth 2.0 client-credentials tokens that last 2 hours, and service accounts limited to one workspace with an admin or member role. We found no per-action scopes (25). Each sandbox is a microVM with no shared kernel, which Blaxel's blog says is Firecracker (10). Domain allow and deny lists with method and path rules, network-level enforcement since 25 September 2026, but the default is open and the docs call domain filtering public preview (7). The proxy can inject secrets into outbound headers so they never enter the sandbox, under the same preview label (12). Process logs per sandbox and traces for a sampled 10 per cent of executions, no audit log found (5). Blaxel claims SOC 2 Type II, ISO 27001 and HIPAA. No security.txt, disclosure policy or bug bounty found, and its compliance portal blocks our fetcher (5).

Celesto (formerly SmolVM) 52

Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). computer logs shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.

Blaxel Sandboxes 58

Status page at status.blaxel.ai (incident.io) with per-component history, read through feed.atom and each incident's own page (20). In the 90 days from 5 August the feed lists 32 incidents, 31 touching Sandboxes. Each names one region (us-was-1, us-pdx-1 or eu-fra-1), one capability (drives, volumes, builds, the proxy, older-generation hosts) or "some users". The one labelled Full outage, "Increased workload unavailability in us-was-1" on 1 October (02:39 to 04:33 UTC), is one region and says "some users". The 23 August api.blaxel.ai error rate is labelled degraded performance for "some users". All read as partial, so minor only (20, was 0). The 1 October check read three regional incidents as majors and took its count from the page's JSON API; this reading replaces it. No request-rate limits found, only concurrency quotas per tier (0). No 429, Retry-After or backoff guidance, but the error reference now gives each of 19 codes a retryable flag, a safe_to_retry_request field that is true only when a request, writes included, can be replayed, and a dispatch_state saying whether the request reached the workload (8, was 5). No SLA, only custom SLAs on Enterprise (0). Sandboxes aren't labelled beta (10). 20 + 20 + 0 + 8 + 0 + 10 = 58.

Celesto (formerly SmolVM) 66

Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as celesto with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.

Blaxel Sandboxes 80

OpenAPI 3.0 for the per-sandbox API is public on GitHub, and the control-plane spec (OpenAPI 3.0.3) is rendered in the API reference, though we couldn't download it at the path the docs name (20). llms.txt and Markdown pages (10). Reference entries say what each call does and list response codes, with less on when not to use them (10). Typed fields with required metadata and spec, few enums seen (10). An error-code reference with 19 codes, their HTTP statuses and agent-readable action and do_not fields, plus examples in the spec (15). Date-based API versions through the Blaxel-Version header and a dated changelog (15).

Celesto (formerly SmolVM) 85

Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer exec and keep shell, ssh and desktop for interactive work (14 of 20). Network modes are closed values (open, off, public, restricted) and the SDK takes typed keyword arguments, though internet_settings is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as required_scope, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.

Blaxel Sandboxes 65

SDKs and sandbox templates are MIT. The platform is closed under dated terms (10 December 2025) (20). A data-collection page lists what error tracking and OpenTelemetry collect, the 10 per cent trace sampling and zero data retention for sandboxes deleted before standby. It gives no retention periods, and the privacy policy sits on a compliance portal our fetcher can't read (15). Date-based API versions with a stated default version, but no deprecation policy with notice periods found (10). Telemetry and opt-outs are documented (DO_NOT_TRACK, TELEMETRY_ENABLED=false, BL_ENABLE_OPENTELEMETRY, and since October the CLI's PostHog usage events), though the SDKs' own "Installed SDK" PostHog event (off unless tracking is turned on) isn't listed, and regions are named (us-pdx-1, us-was-1, eu-lon-1, eu-fra-1), but no subprocessor list was readable (15).

Celesto (formerly SmolVM) 70

Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.