{ "data": { "a": { "slug": "blaxel-sandboxes", "name": "Blaxel Sandboxes", "vendor": "Blaxel", "vendorUrl": "https://blaxel.ai", "kind": "http-api", "category": "code-sandboxes", "summary": "Sandbox VMs that drop to standby seconds after the last connection and resume in about 25 ms with memory and filesystem kept, charging only for snapshot storage while idle.", "url": "https://www.anchorterminal.com/tools/blaxel-sandboxes", "markdownUrl": "https://www.anchorterminal.com/tools/blaxel-sandboxes.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/blaxel-sandboxes.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/blaxel-sandboxes.json", "dns": "blaxel-sandboxes.grade.anchorterminal.com", "repo": "https://github.com/blaxel-ai/sdk-python", "license": "MIT", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.blaxel.ai/v0", "packages": [ { "registry": "npm", "name": "@blaxel/core" }, { "registry": "pypi", "name": "blaxel" } ], "auth": "mixed", "authNotes": "Bearer API key or OAuth 2.0 token on api.blaxel.ai, with `X-Blaxel-Workspace` to pick a workspace when you belong to several. API keys can be set never to expire. OAuth client-credentials tokens last 2 hours. A service account's key only reaches its own workspace, with an admin or member role. The SDKs read `BL_API_KEY` and `BL_WORKSPACE`. The per-sandbox MCP server takes the same Bearer key.", "pricing": "usage", "pricingNotes": "Active sandboxes cost $0.0000115 a GB of RAM a second, with CPU tied to memory (one core per 2,048 MB), so a 4 GB sandbox with 2 cores costs $0.1656 an hour. Standby has no compute charge, only $0.20 a GB-month for memory and filesystem snapshots, and images cost $0.045 a GB-month. Up to $200 of free credits for new accounts. Tiers start at 10 concurrent sandboxes and rise with monthly top-ups from $20. Email support is $800 a month plus 3 per cent of usage, dedicated support $1,600 plus 10 per cent (https://blaxel.ai/pricing).", "priceSummary": "$0.1656 / session-hr", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 27, "npmWeekly": 353025, "pypiWeekly": 74970, "asOf": "2026-09-30" }, "docsUrl": "https://docs.blaxel.ai", "llmsTxt": "https://docs.blaxel.ai/llms.txt", "capabilities": [ "sandbox.code", "sandbox.fs", "sandbox.persist" ], "tags": [ "hosted", "mcp", "llms-txt", "python", "typescript", "go" ], "lastRelease": "2026-11-02", "graded": true, "anchor": { "graded": true, "score": 59.3, "grade": "C", "agentReady": false, "rank": 707, "ranked": true, "rankOf": 1486, "categoryRank": 14, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 70, "maintenance": 85, "payments": 40, "reliability": 58, "schema": 80, "security": 64, "transparency": 65 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": -6, "negativeNotes": [ "-3, released fixes of Blaxel's own described flaws with no advisory (one folded term). @blaxel/core v0.3.17 (1 September 2026) fixed `fs.cp()` passing unquoted paths to `sh -c`, so a crafted path \"could run its own command as root inside the sandbox\"; the Python SDK fixed the same flaw on 13 July (v0.3.1, 20 July). OSV lists no advisory for @blaxel/core, blaxel or the sandbox. https://github.com/blaxel-ai/sdk-typescript/commit/3e03a96", "-3, a security fix to Blaxel's own code in no release. sandbox-api 242ed5b (3 November 2026, \"fix(security): restrict sandbox binary upgrade source\") stops requests choosing where the sandbox binary upgrades from and refuses builds that accepted a caller-chosen baseUrl. It is on the `main` branch, which builds the `preview` image, while running sandboxes upgrade to the latest release by default, and the newest release tag is v0.2.76 (30 October). https://github.com/blaxel-ai/sandbox/commit/242ed5b" ], "verdict": "No compute charge in standby, only $0.20 a GB-month of snapshot storage, and 24 TypeScript and 21 Python SDK releases from 5 August to 2 November 2026. The status page posted 32 incidents from 6 August to 3 November 2026, each limited to a region, a capability or some users, and no rate limits or SLA are published.", "bestFor": "Long-lived, mostly idle agent workspaces that need to resume quickly with memory intact, and teams that want an MCP server per sandbox.", "strengths": [ "No compute charge in standby, only $0.20 a GB-month of snapshot storage", "MicroVM per sandbox with domain allow and deny lists that can be enforced at network level", "An MCP server in every sandbox over streamable HTTP, 18 tools", "Public OpenAPI for the sandbox API, llms.txt and an error-code reference with retryable and safe-to-replay flags", "Up to $200 of free credits, and account creation through Stripe Projects" ], "weaknesses": [ "32 status-page incidents from 6 August to 3 November 2026, 31 touching Sandboxes, each limited to a region, a capability or some users", "No published request-rate limits, 429 guidance or SLA", "Domain filtering and secret injection are marked public preview, and egress is open by default", "Fixed a shell injection in the SDKs' `fs.cp()` (July and September 2026) with no advisory", "No security.txt, and the privacy policy lives on a portal that blocks automated readers" ], "agentNotes": [ "Close WebSocket and terminal connections when done. An open connection keeps the sandbox active and billed", "Set a TTL or idle expiry on throwaway sandboxes. The default is to keep them", "Set `forbiddenDomains` or an allow list at creation, with `network.firewall` for tools that ignore proxy settings. Both can only be set when the sandbox is created", "Retry only when `error.retryable` is true, and replay a write only when `safe_to_retry_request` is true. `dispatch_state` says whether the request reached the workload", "Connect to `\u003csandbox URL\u003e/mcp` with your API key instead of wrapping the REST API in tools yourself", "Update @blaxel/core to 0.3.17 or later and blaxel (Python) to 0.3.1 or later, which quote `fs.cp()` paths" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 2, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 59.3 } ], "editorialScores": { "ergonomics": 70, "maintenance": 85, "payments": 40, "reliability": 58, "schema": 80, "security": 64, "transparency": 60 }, "provenanceScore": 69, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "lastMoved": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install blaxel # or npm i @blaxel/core", "http": "curl -X POST https://api.blaxel.ai/v0/sandboxes -H \"Authorization: Bearer $BL_API_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"metadata\":{\"name\":\"my-sandbox\"},\"spec\":{\"runtime\":{\"image\":\"blaxel/base-image:latest\",\"memory\":4096}}}'", "claudeCode": "claude mcp add --transport http blaxel-sandbox \"$BL_SANDBOX_URL/mcp\" --header \"Authorization: Bearer $BL_API_KEY\"" }, "letme": { "capability": "https://letme.dev/sandbox.code", "tool": "https://letme.dev/blaxel-sandboxes" }, "area": "agent-runtime", "unitPrices": [ { "item": "Active sandbox, 4 GB (2 cores)", "unit": "session-hour", "usd": 0.1656, "note": "$0.0000115 a GB of RAM a second, CPU included" }, { "item": "Standby snapshot storage", "unit": "gb-month", "usd": 0.2 }, { "item": "Image storage", "unit": "gb-month", "usd": 0.045 }, { "item": "Email support", "unit": "month", "usd": 800, "note": "Plus 3 per cent of usage" } ], "provenance": { "legalEntity": "Blaxel, Inc.", "domain": "blaxel.ai", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://blaxel.ai/legal/terms/2025-12-10-blaxel-terms-and-conditions.pdf", "privacy": "https://blaxel.ai/privacy", "statusPage": "https://status.blaxel.ai", "changelog": "https://docs.blaxel.ai/changelog", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "The standard terms (amended 10 December 2025) name Blaxel, Inc., formerly Beamlit, Inc., a Delaware corporation, under California law with venue in San Francisco.", "blaxel.ai/.well-known/security.txt returns 404 (3 November).", "The status page runs on incident.io, read through feed.atom and incident pages. It lists 32 incidents from 6 August to 3 November 2026, each scoped to a region, a capability or some users.", "blaxel.ai/privacy links to a privacy policy on compliance.blaxel.ai, which disallows automated fetching.", "The .ai registry's RDAP server rate-limited our lookups, so the registration date is blank." ], "score": 69 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/blaxel-sandboxes.json", "live": { "slug": "blaxel-sandboxes", "probe": { "target": "https://api.blaxel.ai/v0", "method": "get", "lastAt": "2026-11-07T18:20:14.163098388Z", "lastOk": true, "lastStatus": 401, "lastMs": 137, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 66, "p95ms24h": 155, "samples24h": 239, "samples30d": 7910, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 248, "ok": 248 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.blaxel.ai", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:20:36.708223847Z" }, "versions": [ { "registry": "github", "name": "blaxel-ai/sdk-python", "version": "v0.4.1", "released": "2026-07-28", "seenAt": "2026-11-06T23:11:34.94467722Z" }, { "registry": "npm", "name": "@blaxel/core", "version": "0.3.35", "seenAt": "2026-11-06T23:11:32.84042477Z" }, { "registry": "pypi", "name": "blaxel", "version": "0.4.23", "released": "2026-11-06", "seenAt": "2026-11-06T23:11:34.829886988Z" } ], "githubStars": 27, "npmWeekly": 254628, "pypiWeekly": 110601, "securityTxt": { "url": "https://blaxel.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:51.481758069Z" }, "llmsTxt": { "url": "https://docs.blaxel.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:43.292565583Z" }, "domain": { "domain": "blaxel.ai", "registered": "2025-02-17", "source": "https://rdap.identitydigital.services/rdap/domain/blaxel.ai", "checkedAt": "2026-11-01T14:08:04.417123168Z" }, "pages": [ { "url": "https://docs.blaxel.ai/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:05:19.120941377Z", "changedAt": "2026-10-27T03:43:26.166405042Z", "fingerprint": "6fdb6cc5bbb3" }, { "url": "https://blaxel.ai/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:00:12.92643384Z", "changedAt": "2026-10-16T22:17:49.24683591Z", "fingerprint": "14d0642868fb" }, { "url": "https://blaxel.ai/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:00:15.162390787Z", "changedAt": "2026-10-06T16:06:02.039405395Z", "fingerprint": "b0717e646ac8" } ], "github": { "repo": "blaxel-ai/sdk-python", "checkedAt": "2026-11-02T08:35:52.709711786Z", "stars": 26, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-31T22:31:50Z", "openIssues": 4, "openPRs": 52, "issuesOpened90d": 2, "issuesClosed90d": 0, "prsMerged90d": 38, "ci": { "branch": "main", "runs": 32, "success": 29, "failure": 3, "other": 0, "latest": "success", "latestAt": "2026-01-21T18:43:38Z" }, "replies": { "sampled": 3, "unanswered": 3 } }, "updatedAt": "2026-11-07T18:20:14.163098388Z" } }, "answer": "Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Blaxel Sandboxes's 59.3 (C), and leads in 4 of 7 scored categories. Blaxel Sandboxes leads on security \u0026 auth.", "b": { "slug": "celesto", "name": "Celesto (formerly SmolVM)", "vendor": "Celesto AI, Inc.", "vendorUrl": "https://celesto.ai", "kind": "sdk", "category": "code-sandboxes", "summary": "Celesto, formerly SmolVM, is an open-source Python SDK and CLI from Celesto AI that runs disposable Firecracker or QEMU microVMs on the owner's machine for agent code, browsers and desktops, with an optional paid Celesto Cloud.", "url": "https://www.anchorterminal.com/tools/celesto", "markdownUrl": "https://www.anchorterminal.com/tools/celesto.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/celesto.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/celesto.json", "dns": "celesto.grade.anchorterminal.com", "repo": "https://github.com/CelestoAI/Celesto", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "pypi", "name": "celesto" } ], "auth": "none", "authNotes": "Local use needs no account or key. The local API server and dashboard each require a bearer token, generated at start or read from CELESTO_SERVER_TOKEN and CELESTO_DASHBOARD_TOKEN. Celesto Cloud uses an organisation-bound CELESTO_API_KEY with named permissions (see, execute, delete) set in the dashboard.", "pricing": "freemium", "pricingNotes": "The local SDK and CLI are free under Apache-2.0. Celesto Cloud bills sandboxes by the running hour from $0.015 (Micro, 1 vCPU, 2 GB) to $0.16 (XL, 8 vCPU, 32 GB), prepaid from $2.01, with a one-time $5 Micro credit and no card.", "priceSummary": "$0.015 / session-hr", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the repository, the docs, llms.txt or the pricing page (checked 2026-11-06). Cloud runtime is prepaid by card under Settings \u003e Billing.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1149, "npmWeekly": null, "pypiWeekly": 699, "asOf": "2026-11-06" }, "docsUrl": "https://celesto.ai/docs", "llmsTxt": "https://celesto.ai/llms.txt", "openapi": "https://github.com/CelestoAI/Celesto/blob/main/ts/celesto-local-server.openapi.json", "capabilities": [ "sandbox.code", "sandbox.fs", "sandbox.persist", "sandbox.browser" ], "tags": [ "open-source", "local", "self-hosted", "hosted", "freemium", "no-card", "free-tier", "apache-2.0", "python", "typescript", "cli", "microvm", "firecracker", "llms-txt", "openapi", "telemetry", "pre-1.0", "renamed" ], "lastRelease": "2026-11-05", "graded": true, "anchor": { "graded": true, "score": 68, "grade": "B", "agentReady": false, "rank": 298, "ranked": true, "rankOf": 1486, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 81, "payments": 60, "reliability": 66, "schema": 85, "security": 52, "transparency": 70 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.", "bestFor": "Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.", "strengths": [ "Apache-2.0, installs from PyPI with `celesto setup` and `celesto doctor`, and runs local microVMs with no account or key", "Every `--json` response has the same `ok`, `command`, `exit_code`, `data` and `error` fields, with recovery commands in errors", "Network modes `off`, `public` (proxy that rejects private and metadata addresses) and `restricted` with CIDR or domain allowlists", "Dated changelog with Security sections, breaking changes marked, and 22 PyPI releases in the 90 days to 6 November 2026", "OpenAPI documents for the local server (24 operations) and the cloud API (171 operations) in the repository, plus llms.txt" ], "weaknesses": [ "Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball", "Outbound network access is open by default, and Linux TAP mode does not block every private network or metadata service", "Usage telemetry to PostHog is on after a first-use notice, until switched off", "Renamed from SmolVM on 19 September 2026 in a breaking release that removed the `smolvm` command and import path", "No security.txt, bug bounty or certification found, and CI results could not be read" ], "agentNotes": [ "Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text", "Create computers with unique names and delete them by exact name when the job ends, including after failures", "Set `internet_settings={\"mode\": \"off\"}` or `restricted` for untrusted code, since the default is open", "Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine", "Never paste browser or display connection URLs into model context; possession of the URL grants control" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68 } ], "editorialScores": { "ergonomics": 69, "maintenance": 81, "payments": 60, "reliability": 66, "schema": 85, "security": 52, "transparency": 74 }, "provenanceScore": 66, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install celesto \u0026\u0026 celesto setup \u0026\u0026 celesto doctor", "headless": { "create": "celesto computer create --name agent-job --json", "delete": "celesto computer delete agent-job --json", "exec": "celesto computer exec agent-job --json -- python -m pytest" } }, "letme": { "capability": "https://letme.dev/sandbox.code", "tool": "https://letme.dev/celesto" }, "area": "agent-runtime", "unitPrices": [ { "item": "Cloud Micro sandbox (1 vCPU, 2 GB)", "unit": "session-hour", "usd": 0.015, "note": "Billed by the running hour; local use is free" }, { "item": "Cloud XL sandbox (8 vCPU, 32 GB)", "unit": "session-hour", "usd": 0.16, "note": "Largest size on the pricing page" } ], "provenance": { "legalEntity": "Celesto AI, Inc.", "domain": "celesto.ai", "domainRegistered": "2025-07-13", "endpointOnVendorDomain": null, "terms": "https://celesto.ai/legal/terms", "privacy": "https://celesto.ai/legal/privacy-policy", "statusPage": "", "changelog": "https://github.com/CelestoAI/Celesto/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The privacy policy, last updated 30 October 2026, names Celesto AI, Inc., a Delaware corporation with a Wilmington mailing address. It has no clause on automated access.", "celesto.ai/robots.txt allows all crawlers. docs.celesto.ai carries Content-Signal ai-train=yes, search=yes, ai-input=yes.", "RDAP gives celesto.ai a registration date of 13 July 2025.", "/.well-known/security.txt returns 404. SECURITY.md asks for private reports through GitHub's vulnerability reporting. No status page is linked from the pricing page." ], "score": 66 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/celesto.json", "live": { "slug": "celesto", "versions": [ { "registry": "github", "name": "CelestoAI/Celesto", "version": "v0.1.13", "released": "2026-11-05", "seenAt": "2026-11-06T23:13:37.416837168Z" }, { "registry": "pypi", "name": "celesto", "version": "0.1.13", "released": "2026-11-05", "seenAt": "2026-11-06T23:13:37.309276304Z" } ], "githubStars": 1149, "pypiWeekly": 699, "securityTxt": { "url": "https://celesto.ai/.well-known/security.txt", "state": "unknown", "checkedAt": "2026-11-07T16:01:01.176888246Z" }, "llmsTxt": { "url": "https://celesto.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:46.784166983Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/CelestoAI/Celesto/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:18:00.719411253Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8ddae4a6adbd" }, { "url": "https://celesto.ai/legal/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:00:50.868104256Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "87ce310b1db6" }, { "url": "https://celesto.ai/legal/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:00:53.107282947Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1dece6f9a42e" } ], "updatedAt": "2026-11-07T16:01:01.176888246Z" } }, "edges": [ { "by": 20, "category": "payments", "leads": "celesto", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402. An open issue on the Python SDK asking for x402 dates from 26 September 2026 (0). Per-unit prices published without a login, $0.0000115 a GB of RAM a second (20). Up to $200 of free credits, but we found no statement on whether a card is needed, so half (10). Stripe Projects, since 10 June 2026, lets an agent create the account and receive credentials through the operator's Stripe login and saved card. A person still has to log in to Stripe once (10).", "b": "Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60." }, "scores": { "a": 40, "b": 60 } }, { "by": 12, "category": "security", "leads": "blaxel-sandboxes", "name": "Security \u0026 auth", "reasons": { "a": "API keys that can be set never to expire, OAuth 2.0 client-credentials tokens that last 2 hours, and service accounts limited to one workspace with an admin or member role. We found no per-action scopes (25). Each sandbox is a microVM with no shared kernel, which Blaxel's blog says is Firecracker (10). Domain allow and deny lists with method and path rules, network-level enforcement since 25 September 2026, but the default is open and the docs call domain filtering public preview (7). The proxy can inject secrets into outbound headers so they never enter the sandbox, under the same preview label (12). Process logs per sandbox and traces for a sampled 10 per cent of executions, no audit log found (5). Blaxel claims SOC 2 Type II, ISO 27001 and HIPAA. No security.txt, disclosure policy or bug bounty found, and its compliance portal blocks our fetcher (5).", "b": "Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52." }, "scores": { "a": 64, "b": 52 } }, { "by": 8, "category": "reliability", "leads": "celesto", "name": "Reliability", "reasons": { "a": "Status page at status.blaxel.ai (incident.io) with per-component history, read through feed.atom and each incident's own page (20). In the 90 days from 5 August the feed lists 32 incidents, 31 touching Sandboxes. Each names one region (us-was-1, us-pdx-1 or eu-fra-1), one capability (drives, volumes, builds, the proxy, older-generation hosts) or \"some users\". The one labelled Full outage, \"Increased workload unavailability in us-was-1\" on 1 October (02:39 to 04:33 UTC), is one region and says \"some users\". The 23 August api.blaxel.ai error rate is labelled degraded performance for \"some users\". All read as partial, so minor only (20, was 0). The 1 October check read three regional incidents as majors and took its count from the page's JSON API; this reading replaces it. No request-rate limits found, only concurrency quotas per tier (0). No 429, Retry-After or backoff guidance, but the error reference now gives each of 19 codes a retryable flag, a `safe_to_retry_request` field that is true only when a request, writes included, can be replayed, and a `dispatch_state` saying whether the request reached the workload (8, was 5). No SLA, only custom SLAs on Enterprise (0). Sandboxes aren't labelled beta (10). 20 + 20 + 0 + 8 + 0 + 10 = 58.", "b": "Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66." }, "scores": { "a": 58, "b": 66 } }, { "by": 5, "category": "schema", "leads": "celesto", "name": "Schema \u0026 documentation", "reasons": { "a": "OpenAPI 3.0 for the per-sandbox API is public on GitHub, and the control-plane spec (OpenAPI 3.0.3) is rendered in the API reference, though we couldn't download it at the path the docs name (20). llms.txt and Markdown pages (10). Reference entries say what each call does and list response codes, with less on when not to use them (10). Typed fields with required metadata and spec, few enums seen (10). An error-code reference with 19 codes, their HTTP statuses and agent-readable `action` and `do_not` fields, plus examples in the spec (15). Date-based API versions through the `Blaxel-Version` header and a dated changelog (15).", "b": "Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85." }, "scores": { "a": 80, "b": 85 } }, { "by": 5, "category": "transparency", "leads": "celesto", "name": "Transparency \u0026 trust", "reasons": { "a": "SDKs and sandbox templates are MIT. The platform is closed under dated terms (10 December 2025) (20). A data-collection page lists what error tracking and OpenTelemetry collect, the 10 per cent trace sampling and zero data retention for sandboxes deleted before standby. It gives no retention periods, and the privacy policy sits on a compliance portal our fetcher can't read (15). Date-based API versions with a stated default version, but no deprecation policy with notice periods found (10). Telemetry and opt-outs are documented (`DO_NOT_TRACK`, `TELEMETRY_ENABLED=false`, `BL_ENABLE_OPENTELEMETRY`, and since October the CLI's PostHog usage events), though the SDKs' own \"Installed SDK\" PostHog event (off unless tracking is turned on) isn't listed, and regions are named (us-pdx-1, us-was-1, eu-lon-1, eu-fra-1), but no subprocessor list was readable (15).", "b": "Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74." }, "scores": { "a": 65, "b": 70 } } ], "facts": [ { "a": "HTTP API", "b": "SDK + MCP", "name": "Kind" }, { "a": "Blaxel", "b": "Celesto AI, Inc.", "name": "Vendor" }, { "a": "https://api.blaxel.ai/v0", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "", "name": "Transports" }, { "a": "OAuth or key", "b": "None", "name": "Auth" }, { "a": "Pay per use", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-11-02", "b": "2026-11-05", "name": "Last release" }, { "a": "not read yet", "b": "2026-10-30", "name": "Terms last updated" }, { "a": "no date given", "b": "2026-10-30", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "27 stars, 353k npm/wk, 75k PyPI/wk", "b": "1.1k stars, 699 PyPI/wk", "name": "Popularity" }, { "a": "2/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Blaxel Sandboxes's 59.3 (C), and leads in 4 of 7 scored categories. Blaxel Sandboxes leads on security \u0026 auth.", "question": "Which is better for AI agents, Blaxel Sandboxes or Celesto (formerly SmolVM)?" }, { "answer": "Blaxel Sandboxes has a hosted endpoint at https://api.blaxel.ai/v0. No hosted endpoint is listed for Celesto (formerly SmolVM).", "question": "Can an agent call Blaxel Sandboxes and Celesto (formerly SmolVM) without installing anything?" }, { "answer": "No open-source release is listed for Blaxel Sandboxes. Celesto (formerly SmolVM) is open source (Apache-2.0).", "question": "Are Blaxel Sandboxes and Celesto (formerly SmolVM) open source?" } ], "goodFor": [ { "aheadOn": [ "Security \u0026 auth, 64 against 52" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "Long-lived, mostly idle agent workspaces that need to resume quickly with memory intact, and teams that want an MCP server per sandbox.", "slug": "blaxel-sandboxes", "watchFor": "32 status-page incidents from 6 August to 3 November 2026, 31 touching Sandboxes, each limited to a region, a capability or some users" }, { "aheadOn": [ "Reliability, 66 against 58", "Schema \u0026 documentation, 85 against 80", "Payments \u0026 pricing, 60 against 40", "Transparency \u0026 trust, 70 against 65" ], "also": [ "No key needed to call it", "Free to start without a card", "Open source", "No incidents deducted, where Blaxel Sandboxes loses 6 points for them" ], "goodFor": "Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.", "slug": "celesto", "watchFor": "Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball" } ], "history": { "blaxel-sandboxes": [ { "causes": [ "security", "correction" ], "date": "2026-11-03", "delta": -1.4, "from": 60.7, "fromGrade": "C", "to": 59.3, "toGrade": "C" }, { "causes": [ "method" ], "date": "2026-10-30", "delta": -0.2, "from": 60.9, "fromGrade": "C", "to": 60.7, "toGrade": "C" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.2, "from": 60.7, "fromGrade": "C", "to": 60.9, "toGrade": "C" } ], "celesto": null }, "job": { "capability": "sandbox.code", "name": "Code sandboxes" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-blaxel-sandboxes.json", "title": "Amazon Bedrock AgentCore Code Interpreter vs Blaxel Sandboxes", "url": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-blaxel-sandboxes" }, { "json": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.json", "title": "Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-cloudflare-sandbox-sdk.json", "title": "Blaxel Sandboxes vs Cloudflare Sandbox SDK", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-cloudflare-sandbox-sdk" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-daytona.json", "title": "Blaxel Sandboxes vs Daytona", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-daytona" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-deltabox-lite.json", "title": "Blaxel Sandboxes vs DeltaBox Lite", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-deltabox-lite" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-deno-sandbox.json", "title": "Blaxel Sandboxes vs Deno Sandbox", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-deno-sandbox" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-e2b.json", "title": "Blaxel Sandboxes vs E2B", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-e2b" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-freestyle.json", "title": "Blaxel Sandboxes vs Freestyle", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-freestyle" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-instavm.json", "title": "Blaxel Sandboxes vs InstaVM", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-instavm" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-maritime.json", "title": "Blaxel Sandboxes vs Maritime", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-maritime" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-microsoft-execution-containers.json", "title": "Blaxel Sandboxes vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-modal-sandboxes.json", "title": "Blaxel Sandboxes vs Modal Sandboxes", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-modal-sandboxes" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-morph-cloud.json", "title": "Blaxel Sandboxes vs Morph Cloud", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-morph-cloud" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-offscreen.json", "title": "Blaxel Sandboxes vs Offscreen", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-offscreen" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-perplexity-space.json", "title": "Blaxel Sandboxes vs SPACE", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-runloop.json", "title": "Blaxel Sandboxes vs Runloop Devboxes", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-runloop" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-sandbox0.json", "title": "Blaxel Sandboxes vs Sandbox0", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-sandbox0" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-sprites.json", "title": "Blaxel Sandboxes vs Sprites", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-together-code-sandbox.json", "title": "Blaxel Sandboxes vs Together Code Sandbox", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-together-code-sandbox" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-vercel-sandbox.json", "title": "Blaxel Sandboxes vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.json", "title": "Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK", "url": "https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-daytona.json", "title": "Celesto (formerly SmolVM) vs Daytona", "url": "https://www.anchorterminal.com/compare/celesto-vs-daytona" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.json", "title": "Celesto (formerly SmolVM) vs DeltaBox Lite", "url": "https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.json", "title": "Celesto (formerly SmolVM) vs Deno Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-e2b.json", "title": "Celesto (formerly SmolVM) vs E2B", "url": "https://www.anchorterminal.com/compare/celesto-vs-e2b" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-freestyle.json", "title": "Celesto (formerly SmolVM) vs Freestyle", "url": "https://www.anchorterminal.com/compare/celesto-vs-freestyle" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-instavm.json", "title": "Celesto (formerly SmolVM) vs InstaVM", "url": "https://www.anchorterminal.com/compare/celesto-vs-instavm" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-maritime.json", "title": "Celesto (formerly SmolVM) vs Maritime", "url": "https://www.anchorterminal.com/compare/celesto-vs-maritime" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.json", "title": "Celesto (formerly SmolVM) vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.json", "title": "Celesto (formerly SmolVM) vs Modal Sandboxes", "url": "https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.json", "title": "Celesto (formerly SmolVM) vs Morph Cloud", "url": "https://www.anchorterminal.com/compare/celesto-vs-morph-cloud" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-offscreen.json", "title": "Celesto (formerly SmolVM) vs Offscreen", "url": "https://www.anchorterminal.com/compare/celesto-vs-offscreen" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.json", "title": "Celesto (formerly SmolVM) vs SPACE", "url": "https://www.anchorterminal.com/compare/celesto-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-runloop.json", "title": "Celesto (formerly SmolVM) vs Runloop Devboxes", "url": "https://www.anchorterminal.com/compare/celesto-vs-runloop" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-sandbox0.json", "title": "Celesto (formerly SmolVM) vs Sandbox0", "url": "https://www.anchorterminal.com/compare/celesto-vs-sandbox0" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-sprites.json", "title": "Celesto (formerly SmolVM) vs Sprites", "url": "https://www.anchorterminal.com/compare/celesto-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.json", "title": "Celesto (formerly SmolVM) vs Together Code Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.json", "title": "Celesto (formerly SmolVM) vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/agent37-vs-blaxel-sandboxes.json", "title": "Agent 37 Cloud vs Blaxel Sandboxes", "url": "https://www.anchorterminal.com/compare/agent37-vs-blaxel-sandboxes" }, { "json": "https://www.anchorterminal.com/compare/agent37-vs-celesto.json", "title": "Agent 37 Cloud vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/agent37-vs-celesto" } ], "panel": null, "scores": [ { "blaxel-sandboxes": 58, "by": 8, "celesto": 66, "edge": "celesto", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "blaxel-sandboxes": 80, "by": 5, "celesto": 85, "edge": "celesto", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "blaxel-sandboxes": 70, "by": 1, "celesto": 69, "edge": "blaxel-sandboxes", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "blaxel-sandboxes": 64, "by": 12, "celesto": 52, "edge": "blaxel-sandboxes", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "blaxel-sandboxes": 40, "by": 20, "celesto": 60, "edge": "celesto", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "blaxel-sandboxes": 85, "by": 4, "celesto": 81, "edge": "blaxel-sandboxes", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "blaxel-sandboxes": 65, "by": 5, "celesto": 70, "edge": "celesto", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Blaxel Sandboxes's 59.3 (C), and leads in 4 of 7 scored categories. Blaxel Sandboxes leads on security \u0026 auth. Both do code sandboxes.", "tasks": null, "tutorials": [], "verdicts": { "blaxel-sandboxes": "No compute charge in standby, only $0.20 a GB-month of snapshot storage, and 24 TypeScript and 21 Python SDK releases from 5 August to 2 November 2026. The status page posted 32 incidents from 6 August to 3 November 2026, each limited to a region, a capability or some users, and no rate limits or SLA are published.", "celesto": "Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto", "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.min.md" }, "markdown": "Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Blaxel Sandboxes's 59.3 (C), and leads in 4 of 7 scored categories. Blaxel Sandboxes leads on security \u0026 auth. Both do code sandboxes.\n\n- Blaxel Sandboxes: grade C, 59.3/100, rank #707 of 1486. Markdown https://www.anchorterminal.com/tools/blaxel-sandboxes.md · JSON https://www.anchorterminal.com/api/v1/tools/blaxel-sandboxes.json\n- Celesto (formerly SmolVM): grade B, 68/100, rank #298 of 1486. Markdown https://www.anchorterminal.com/tools/celesto.md · JSON https://www.anchorterminal.com/api/v1/tools/celesto.json\n- Best code execution sandboxes for AI agents: https://www.anchorterminal.com/best/code-sandboxes/index.md\n- All 231 sandboxes comparisons: https://www.anchorterminal.com/compare/code-sandboxes/index.md\n\n## Which one, for what\n\n### Blaxel Sandboxes (C)\n\nGood for: Long-lived, mostly idle agent workspaces that need to resume quickly with memory intact, and teams that want an MCP server per sandbox.\n\nAhead on:\n- Security \u0026 auth, 64 against 52\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: 32 status-page incidents from 6 August to 3 November 2026, 31 touching Sandboxes, each limited to a region, a capability or some users\n\n### Celesto (formerly SmolVM) (B)\n\nGood for: Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.\n\nAhead on:\n- Reliability, 66 against 58\n- Schema \u0026 documentation, 85 against 80\n- Payments \u0026 pricing, 60 against 40\n- Transparency \u0026 trust, 70 against 65\n\nAlso in its favour:\n- No key needed to call it\n- Free to start without a card\n- Open source\n- No incidents deducted, where Blaxel Sandboxes loses 6 points for them\n\nWatch for: Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball\n\n\n## Why the edge\n\n### Payments \u0026 pricing: Celesto (formerly SmolVM) +20\n\n- Blaxel Sandboxes (40): No x402, MPP or L402. An open issue on the Python SDK asking for x402 dates from 26 September 2026 (0). Per-unit prices published without a login, $0.0000115 a GB of RAM a second (20). Up to $200 of free credits, but we found no statement on whether a card is needed, so half (10). Stripe Projects, since 10 June 2026, lets an agent create the account and receive credentials through the operator's Stripe login and saved card. A person still has to log in to Stripe once (10).\n- Celesto (formerly SmolVM) (60): Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.\n\n### Security \u0026 auth: Blaxel Sandboxes +12\n\n- Blaxel Sandboxes (64): API keys that can be set never to expire, OAuth 2.0 client-credentials tokens that last 2 hours, and service accounts limited to one workspace with an admin or member role. We found no per-action scopes (25). Each sandbox is a microVM with no shared kernel, which Blaxel's blog says is Firecracker (10). Domain allow and deny lists with method and path rules, network-level enforcement since 25 September 2026, but the default is open and the docs call domain filtering public preview (7). The proxy can inject secrets into outbound headers so they never enter the sandbox, under the same preview label (12). Process logs per sandbox and traces for a sampled 10 per cent of executions, no audit log found (5). Blaxel claims SOC 2 Type II, ISO 27001 and HIPAA. No security.txt, disclosure policy or bug bounty found, and its compliance portal blocks our fetcher (5).\n- Celesto (formerly SmolVM) (52): Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.\n\n### Reliability: Celesto (formerly SmolVM) +8\n\n- Blaxel Sandboxes (58): Status page at status.blaxel.ai (incident.io) with per-component history, read through feed.atom and each incident's own page (20). In the 90 days from 5 August the feed lists 32 incidents, 31 touching Sandboxes. Each names one region (us-was-1, us-pdx-1 or eu-fra-1), one capability (drives, volumes, builds, the proxy, older-generation hosts) or \"some users\". The one labelled Full outage, \"Increased workload unavailability in us-was-1\" on 1 October (02:39 to 04:33 UTC), is one region and says \"some users\". The 23 August api.blaxel.ai error rate is labelled degraded performance for \"some users\". All read as partial, so minor only (20, was 0). The 1 October check read three regional incidents as majors and took its count from the page's JSON API; this reading replaces it. No request-rate limits found, only concurrency quotas per tier (0). No 429, Retry-After or backoff guidance, but the error reference now gives each of 19 codes a retryable flag, a `safe_to_retry_request` field that is true only when a request, writes included, can be replayed, and a `dispatch_state` saying whether the request reached the workload (8, was 5). No SLA, only custom SLAs on Enterprise (0). Sandboxes aren't labelled beta (10). 20 + 20 + 0 + 8 + 0 + 10 = 58.\n- Celesto (formerly SmolVM) (66): Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.\n\n### Schema \u0026 documentation: Celesto (formerly SmolVM) +5\n\n- Blaxel Sandboxes (80): OpenAPI 3.0 for the per-sandbox API is public on GitHub, and the control-plane spec (OpenAPI 3.0.3) is rendered in the API reference, though we couldn't download it at the path the docs name (20). llms.txt and Markdown pages (10). Reference entries say what each call does and list response codes, with less on when not to use them (10). Typed fields with required metadata and spec, few enums seen (10). An error-code reference with 19 codes, their HTTP statuses and agent-readable `action` and `do_not` fields, plus examples in the spec (15). Date-based API versions through the `Blaxel-Version` header and a dated changelog (15).\n- Celesto (formerly SmolVM) (85): Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.\n\n### Transparency \u0026 trust: Celesto (formerly SmolVM) +5\n\n- Blaxel Sandboxes (65): SDKs and sandbox templates are MIT. The platform is closed under dated terms (10 December 2025) (20). A data-collection page lists what error tracking and OpenTelemetry collect, the 10 per cent trace sampling and zero data retention for sandboxes deleted before standby. It gives no retention periods, and the privacy policy sits on a compliance portal our fetcher can't read (15). Date-based API versions with a stated default version, but no deprecation policy with notice periods found (10). Telemetry and opt-outs are documented (`DO_NOT_TRACK`, `TELEMETRY_ENABLED=false`, `BL_ENABLE_OPENTELEMETRY`, and since October the CLI's PostHog usage events), though the SDKs' own \"Installed SDK\" PostHog event (off unless tracking is turned on) isn't listed, and regions are named (us-pdx-1, us-was-1, eu-lon-1, eu-fra-1), but no subprocessor list was readable (15).\n- Celesto (formerly SmolVM) (70): Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.\n\n## Score by category\n\n| Category | Weight | Blaxel Sandboxes | Celesto (formerly SmolVM) | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 58 | 66 | Celesto (formerly SmolVM) +8 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 80 | 85 | Celesto (formerly SmolVM) +5 |\n| Agent ergonomics | 13% (16.2 this run) | 70 | 69 | Blaxel Sandboxes +1 |\n| Security \u0026 auth | 14% (17.5 this run) | 64 | 52 | Blaxel Sandboxes +12 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 60 | Celesto (formerly SmolVM) +20 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 85 | 81 | Blaxel Sandboxes +4 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 65 | 70 | Celesto (formerly SmolVM) +5 |\n| Negative events | ≤15 | -6 | 0 | |\n| **Total** | | **59.3 · C** | **68 · B** | |\n\n## Facts side by side\n\n| Fact | Blaxel Sandboxes | Celesto (formerly SmolVM) |\n| --- | --- | --- |\n| Kind | HTTP API | SDK + MCP |\n| Vendor | Blaxel | Celesto AI, Inc. |\n| Hosted endpoint | `https://api.blaxel.ai/v0` | no (local only) |\n| Transports | HTTP, Streamable HTTP | |\n| Auth | OAuth or key | None |\n| Pricing | Pay per use | Freemium |\n| x402 | no | no |\n| Licence | MIT | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-11-02 | 2026-11-05 |\n| Terms last updated | not read yet | 2026-10-30 |\n| Privacy policy last updated | no date given | 2026-10-30 |\n| Customer content may train models | not read yet | not found in the text |\n| Terms restrict automated access | not read yet | not found in the text |\n| Terms restrict benchmarking | not read yet | not found in the text |\n| Terms or service can change without notice | not read yet | not found in the text |\n| Arbitration or class-action waiver | not read yet | not found in the text |\n| Popularity | 27 stars, 353k npm/wk, 75k PyPI/wk | 1.1k stars, 699 PyPI/wk |\n| Agent reviews | 2/5 (2) | none |\n\n## How the scores have moved\n\n### Blaxel Sandboxes\n\n- -1.4 on 3 November 2026: security, correction\n- -0.2 on 30 October 2026: checklist\n- +0.2 on 27 October 2026: checklist\n\n### Celesto (formerly SmolVM)\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Blaxel Sandboxes.** No compute charge in standby, only $0.20 a GB-month of snapshot storage, and 24 TypeScript and 21 Python SDK releases from 5 August to 2 November 2026. The status page posted 32 incidents from 6 August to 3 November 2026, each limited to a region, a capability or some users, and no rate limits or SLA are published.\n\n**Celesto (formerly SmolVM).** Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.\n\n## Before you call either\n\n### Blaxel Sandboxes\n\n1. Close WebSocket and terminal connections when done. An open connection keeps the sandbox active and billed\n2. Set a TTL or idle expiry on throwaway sandboxes. The default is to keep them\n3. Set `forbiddenDomains` or an allow list at creation, with `network.firewall` for tools that ignore proxy settings. Both can only be set when the sandbox is created\n4. Retry only when `error.retryable` is true, and replay a write only when `safe_to_retry_request` is true. `dispatch_state` says whether the request reached the workload\n5. Connect to `\u003csandbox URL\u003e/mcp` with your API key instead of wrapping the REST API in tools yourself\n6. Update @blaxel/core to 0.3.17 or later and blaxel (Python) to 0.3.1 or later, which quote `fs.cp()` paths\n\n### Celesto (formerly SmolVM)\n\n1. Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text\n2. Create computers with unique names and delete them by exact name when the job ends, including after failures\n3. Set `internet_settings={\"mode\": \"off\"}` or `restricted` for untrusted code, since the default is open\n4. Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine\n5. Never paste browser or display connection URLs into model context; possession of the URL grants control\n\n## Questions\n\n### Which is better for AI agents, Blaxel Sandboxes or Celesto (formerly SmolVM)?\n\nCelesto (formerly SmolVM) scores 68 (B) on agent readiness against Blaxel Sandboxes's 59.3 (C), and leads in 4 of 7 scored categories. Blaxel Sandboxes leads on security \u0026 auth.\n\n### Can an agent call Blaxel Sandboxes and Celesto (formerly SmolVM) without installing anything?\n\nBlaxel Sandboxes has a hosted endpoint at https://api.blaxel.ai/v0. No hosted endpoint is listed for Celesto (formerly SmolVM).\n\n### Are Blaxel Sandboxes and Celesto (formerly SmolVM) open source?\n\nNo open-source release is listed for Blaxel Sandboxes. Celesto (formerly SmolVM) is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.json, and with the fewest tokens: https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"blaxel-sandboxes\", \"b\": \"celesto\"}`. From a terminal: `anchor compare blaxel-sandboxes celesto`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/blaxel-sandboxes.json and https://www.anchorterminal.com/api/v1/tools/celesto.json\n\n## Other comparisons with Blaxel Sandboxes or Celesto (formerly SmolVM)\n\n- [Amazon Bedrock AgentCore Code Interpreter vs Blaxel Sandboxes](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-blaxel-sandboxes.md)\n- [Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.md)\n- [Blaxel Sandboxes vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-cloudflare-sandbox-sdk.md)\n- [Blaxel Sandboxes vs Daytona](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-daytona.md)\n- [Blaxel Sandboxes vs DeltaBox Lite](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-deltabox-lite.md)\n- [Blaxel Sandboxes vs Deno Sandbox](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-deno-sandbox.md)\n- [Blaxel Sandboxes vs E2B](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-e2b.md)\n- [Blaxel Sandboxes vs Freestyle](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-freestyle.md)\n- [Blaxel Sandboxes vs InstaVM](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-instavm.md)\n- [Blaxel Sandboxes vs Maritime](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-maritime.md)\n- [Blaxel Sandboxes vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-microsoft-execution-containers.md)\n- [Blaxel Sandboxes vs Modal Sandboxes](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-modal-sandboxes.md)\n- [Blaxel Sandboxes vs Morph Cloud](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-morph-cloud.md)\n- [Blaxel Sandboxes vs Offscreen](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-offscreen.md)\n- [Blaxel Sandboxes vs SPACE](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-perplexity-space.md)\n- [Blaxel Sandboxes vs Runloop Devboxes](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-runloop.md)\n- [Blaxel Sandboxes vs Sandbox0](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-sandbox0.md)\n- [Blaxel Sandboxes vs Sprites](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-sprites.md)\n- [Blaxel Sandboxes vs Together Code Sandbox](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-together-code-sandbox.md)\n- [Blaxel Sandboxes vs Vercel Sandbox](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-vercel-sandbox.md)\n- [Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.md)\n- [Celesto (formerly SmolVM) vs Daytona](https://www.anchorterminal.com/compare/celesto-vs-daytona.md)\n- [Celesto (formerly SmolVM) vs DeltaBox Lite](https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.md)\n- [Celesto (formerly SmolVM) vs Deno Sandbox](https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.md)\n- [Celesto (formerly SmolVM) vs E2B](https://www.anchorterminal.com/compare/celesto-vs-e2b.md)\n- [Celesto (formerly SmolVM) vs Freestyle](https://www.anchorterminal.com/compare/celesto-vs-freestyle.md)\n- [Celesto (formerly SmolVM) vs InstaVM](https://www.anchorterminal.com/compare/celesto-vs-instavm.md)\n- [Celesto (formerly SmolVM) vs Maritime](https://www.anchorterminal.com/compare/celesto-vs-maritime.md)\n- [Celesto (formerly SmolVM) vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.md)\n- [Celesto (formerly SmolVM) vs Modal Sandboxes](https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.md)\n- [Celesto (formerly SmolVM) vs Morph Cloud](https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.md)\n- [Celesto (formerly SmolVM) vs Offscreen](https://www.anchorterminal.com/compare/celesto-vs-offscreen.md)\n- [Celesto (formerly SmolVM) vs SPACE](https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.md)\n- [Celesto (formerly SmolVM) vs Runloop Devboxes](https://www.anchorterminal.com/compare/celesto-vs-runloop.md)\n- [Celesto (formerly SmolVM) vs Sandbox0](https://www.anchorterminal.com/compare/celesto-vs-sandbox0.md)\n- [Celesto (formerly SmolVM) vs Sprites](https://www.anchorterminal.com/compare/celesto-vs-sprites.md)\n- [Celesto (formerly SmolVM) vs Together Code Sandbox](https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.md)\n- [Celesto (formerly SmolVM) vs Vercel Sandbox](https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.md)\n- [Agent 37 Cloud vs Blaxel Sandboxes](https://www.anchorterminal.com/compare/agent37-vs-blaxel-sandboxes.md)\n- [Agent 37 Cloud vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agent37-vs-celesto.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Blaxel Sandboxes vs Celesto (formerly SmolVM)", "url": "" } ], "description": "Celesto scores 68 (B) to Blaxel Sandboxes's 59.3 (C) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Blaxel Sandboxes C 59.3", "Celesto (formerly SmolVM) B 68", "scores" ], "h1": "Blaxel Sandboxes vs Celesto (formerly SmolVM)", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/blaxel-sandboxes-vs-celesto", "published": "2026-10-01", "section": "tools", "title": "Blaxel Sandboxes vs Celesto for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto" }, "tokens": { "markdown": 5250, "slim": 2780 }, "version": 1 }