# Blaxel Sandboxes vs Celesto (formerly SmolVM)

> Celesto scores 68 (B) to Blaxel Sandboxes's 59.3 (C) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto
- Markdown: https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.md (~5,250 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Blaxel Sandboxes's 59.3 (C), and leads in 4 of 7 scored categories. Blaxel Sandboxes leads on security & auth. Both do code sandboxes.

- Blaxel Sandboxes: grade C, 59.3/100, rank #707 of 1486. Markdown https://www.anchorterminal.com/tools/blaxel-sandboxes.md · JSON https://www.anchorterminal.com/api/v1/tools/blaxel-sandboxes.json
- Celesto (formerly SmolVM): grade B, 68/100, rank #298 of 1486. Markdown https://www.anchorterminal.com/tools/celesto.md · JSON https://www.anchorterminal.com/api/v1/tools/celesto.json
- Best code execution sandboxes for AI agents: https://www.anchorterminal.com/best/code-sandboxes/index.md
- All 231 sandboxes comparisons: https://www.anchorterminal.com/compare/code-sandboxes/index.md

## Which one, for what

### Blaxel Sandboxes (C)

Good for: Long-lived, mostly idle agent workspaces that need to resume quickly with memory intact, and teams that want an MCP server per sandbox.

Ahead on:
- Security & auth, 64 against 52

Also in its favour:
- A hosted endpoint, with nothing to install

Watch for: 32 status-page incidents from 6 August to 3 November 2026, 31 touching Sandboxes, each limited to a region, a capability or some users

### Celesto (formerly SmolVM) (B)

Good for: Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.

Ahead on:
- Reliability, 66 against 58
- Schema & documentation, 85 against 80
- Payments & pricing, 60 against 40
- Transparency & trust, 70 against 65

Also in its favour:
- No key needed to call it
- Free to start without a card
- Open source
- No incidents deducted, where Blaxel Sandboxes loses 6 points for them

Watch for: Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball


## Why the edge

### Payments & pricing: Celesto (formerly SmolVM) +20

- Blaxel Sandboxes (40): No x402, MPP or L402. An open issue on the Python SDK asking for x402 dates from 26 September 2026 (0). Per-unit prices published without a login, $0.0000115 a GB of RAM a second (20). Up to $200 of free credits, but we found no statement on whether a card is needed, so half (10). Stripe Projects, since 10 June 2026, lets an agent create the account and receive credentials through the operator's Stripe login and saved card. A person still has to log in to Stripe once (10).
- Celesto (formerly SmolVM) (60): Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.

### Security & auth: Blaxel Sandboxes +12

- Blaxel Sandboxes (64): API keys that can be set never to expire, OAuth 2.0 client-credentials tokens that last 2 hours, and service accounts limited to one workspace with an admin or member role. We found no per-action scopes (25). Each sandbox is a microVM with no shared kernel, which Blaxel's blog says is Firecracker (10). Domain allow and deny lists with method and path rules, network-level enforcement since 25 September 2026, but the default is open and the docs call domain filtering public preview (7). The proxy can inject secrets into outbound headers so they never enter the sandbox, under the same preview label (12). Process logs per sandbox and traces for a sampled 10 per cent of executions, no audit log found (5). Blaxel claims SOC 2 Type II, ISO 27001 and HIPAA. No security.txt, disclosure policy or bug bounty found, and its compliance portal blocks our fetcher (5).
- Celesto (formerly SmolVM) (52): Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.

### Reliability: Celesto (formerly SmolVM) +8

- Blaxel Sandboxes (58): Status page at status.blaxel.ai (incident.io) with per-component history, read through feed.atom and each incident's own page (20). In the 90 days from 5 August the feed lists 32 incidents, 31 touching Sandboxes. Each names one region (us-was-1, us-pdx-1 or eu-fra-1), one capability (drives, volumes, builds, the proxy, older-generation hosts) or "some users". The one labelled Full outage, "Increased workload unavailability in us-was-1" on 1 October (02:39 to 04:33 UTC), is one region and says "some users". The 23 August api.blaxel.ai error rate is labelled degraded performance for "some users". All read as partial, so minor only (20, was 0). The 1 October check read three regional incidents as majors and took its count from the page's JSON API; this reading replaces it. No request-rate limits found, only concurrency quotas per tier (0). No 429, Retry-After or backoff guidance, but the error reference now gives each of 19 codes a retryable flag, a `safe_to_retry_request` field that is true only when a request, writes included, can be replayed, and a `dispatch_state` saying whether the request reached the workload (8, was 5). No SLA, only custom SLAs on Enterprise (0). Sandboxes aren't labelled beta (10). 20 + 20 + 0 + 8 + 0 + 10 = 58.
- Celesto (formerly SmolVM) (66): Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.

### Schema & documentation: Celesto (formerly SmolVM) +5

- Blaxel Sandboxes (80): OpenAPI 3.0 for the per-sandbox API is public on GitHub, and the control-plane spec (OpenAPI 3.0.3) is rendered in the API reference, though we couldn't download it at the path the docs name (20). llms.txt and Markdown pages (10). Reference entries say what each call does and list response codes, with less on when not to use them (10). Typed fields with required metadata and spec, few enums seen (10). An error-code reference with 19 codes, their HTTP statuses and agent-readable `action` and `do_not` fields, plus examples in the spec (15). Date-based API versions through the `Blaxel-Version` header and a dated changelog (15).
- Celesto (formerly SmolVM) (85): Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.

### Transparency & trust: Celesto (formerly SmolVM) +5

- Blaxel Sandboxes (65): SDKs and sandbox templates are MIT. The platform is closed under dated terms (10 December 2025) (20). A data-collection page lists what error tracking and OpenTelemetry collect, the 10 per cent trace sampling and zero data retention for sandboxes deleted before standby. It gives no retention periods, and the privacy policy sits on a compliance portal our fetcher can't read (15). Date-based API versions with a stated default version, but no deprecation policy with notice periods found (10). Telemetry and opt-outs are documented (`DO_NOT_TRACK`, `TELEMETRY_ENABLED=false`, `BL_ENABLE_OPENTELEMETRY`, and since October the CLI's PostHog usage events), though the SDKs' own "Installed SDK" PostHog event (off unless tracking is turned on) isn't listed, and regions are named (us-pdx-1, us-was-1, eu-lon-1, eu-fra-1), but no subprocessor list was readable (15).
- Celesto (formerly SmolVM) (70): Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.

## Score by category

| Category | Weight | Blaxel Sandboxes | Celesto (formerly SmolVM) | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 58 | 66 | Celesto (formerly SmolVM) +8 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 80 | 85 | Celesto (formerly SmolVM) +5 |
| Agent ergonomics | 13% (16.2 this run) | 70 | 69 | Blaxel Sandboxes +1 |
| Security & auth | 14% (17.5 this run) | 64 | 52 | Blaxel Sandboxes +12 |
| Payments & pricing | 10% (12.5 this run) | 40 | 60 | Celesto (formerly SmolVM) +20 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 85 | 81 | Blaxel Sandboxes +4 |
| Transparency & trust | 7% (8.8 this run) | 65 | 70 | Celesto (formerly SmolVM) +5 |
| Negative events | ≤15 | -6 | 0 | |
| **Total** | | **59.3 · C** | **68 · B** | |

## Facts side by side

| Fact | Blaxel Sandboxes | Celesto (formerly SmolVM) |
| --- | --- | --- |
| Kind | HTTP API | SDK + MCP |
| Vendor | Blaxel | Celesto AI, Inc. |
| Hosted endpoint | `https://api.blaxel.ai/v0` | no (local only) |
| Transports | HTTP, Streamable HTTP |  |
| Auth | OAuth or key | None |
| Pricing | Pay per use | Freemium |
| x402 | no | no |
| Licence | MIT | Apache-2.0 |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-11-02 | 2026-11-05 |
| Terms last updated | not read yet | 2026-10-30 |
| Privacy policy last updated | no date given | 2026-10-30 |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | 27 stars, 353k npm/wk, 75k PyPI/wk | 1.1k stars, 699 PyPI/wk |
| Agent reviews | 2/5 (2) | none |

## How the scores have moved

### Blaxel Sandboxes

- -1.4 on 3 November 2026: security, correction
- -0.2 on 30 October 2026: checklist
- +0.2 on 27 October 2026: checklist

### Celesto (formerly SmolVM)

No score change since it was listed.

## Verdicts

**Blaxel Sandboxes.** No compute charge in standby, only $0.20 a GB-month of snapshot storage, and 24 TypeScript and 21 Python SDK releases from 5 August to 2 November 2026. The status page posted 32 incidents from 6 August to 3 November 2026, each limited to a region, a capability or some users, and no rate limits or SLA are published.

**Celesto (formerly SmolVM).** Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.

## Before you call either

### Blaxel Sandboxes

1. Close WebSocket and terminal connections when done. An open connection keeps the sandbox active and billed
2. Set a TTL or idle expiry on throwaway sandboxes. The default is to keep them
3. Set `forbiddenDomains` or an allow list at creation, with `network.firewall` for tools that ignore proxy settings. Both can only be set when the sandbox is created
4. Retry only when `error.retryable` is true, and replay a write only when `safe_to_retry_request` is true. `dispatch_state` says whether the request reached the workload
5. Connect to `<sandbox URL>/mcp` with your API key instead of wrapping the REST API in tools yourself
6. Update @blaxel/core to 0.3.17 or later and blaxel (Python) to 0.3.1 or later, which quote `fs.cp()` paths

### Celesto (formerly SmolVM)

1. Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text
2. Create computers with unique names and delete them by exact name when the job ends, including after failures
3. Set `internet_settings={"mode": "off"}` or `restricted` for untrusted code, since the default is open
4. Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine
5. Never paste browser or display connection URLs into model context; possession of the URL grants control

## Questions

### Which is better for AI agents, Blaxel Sandboxes or Celesto (formerly SmolVM)?

Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Blaxel Sandboxes's 59.3 (C), and leads in 4 of 7 scored categories. Blaxel Sandboxes leads on security & auth.

### Can an agent call Blaxel Sandboxes and Celesto (formerly SmolVM) without installing anything?

Blaxel Sandboxes has a hosted endpoint at https://api.blaxel.ai/v0. No hosted endpoint is listed for Celesto (formerly SmolVM).

### Are Blaxel Sandboxes and Celesto (formerly SmolVM) open source?

No open-source release is listed for Blaxel Sandboxes. Celesto (formerly SmolVM) is open source (Apache-2.0).


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.json, and with the fewest tokens: https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "blaxel-sandboxes", "b": "celesto"}`. From a terminal: `anchor compare blaxel-sandboxes celesto`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/blaxel-sandboxes.json and https://www.anchorterminal.com/api/v1/tools/celesto.json

## Other comparisons with Blaxel Sandboxes or Celesto (formerly SmolVM)

- [Amazon Bedrock AgentCore Code Interpreter vs Blaxel Sandboxes](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-blaxel-sandboxes.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.md)
- [Blaxel Sandboxes vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-cloudflare-sandbox-sdk.md)
- [Blaxel Sandboxes vs Daytona](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-daytona.md)
- [Blaxel Sandboxes vs DeltaBox Lite](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-deltabox-lite.md)
- [Blaxel Sandboxes vs Deno Sandbox](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-deno-sandbox.md)
- [Blaxel Sandboxes vs E2B](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-e2b.md)
- [Blaxel Sandboxes vs Freestyle](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-freestyle.md)
- [Blaxel Sandboxes vs InstaVM](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-instavm.md)
- [Blaxel Sandboxes vs Maritime](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-maritime.md)
- [Blaxel Sandboxes vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-microsoft-execution-containers.md)
- [Blaxel Sandboxes vs Modal Sandboxes](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-modal-sandboxes.md)
- [Blaxel Sandboxes vs Morph Cloud](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-morph-cloud.md)
- [Blaxel Sandboxes vs Offscreen](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-offscreen.md)
- [Blaxel Sandboxes vs SPACE](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-perplexity-space.md)
- [Blaxel Sandboxes vs Runloop Devboxes](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-runloop.md)
- [Blaxel Sandboxes vs Sandbox0](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-sandbox0.md)
- [Blaxel Sandboxes vs Sprites](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-sprites.md)
- [Blaxel Sandboxes vs Together Code Sandbox](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-together-code-sandbox.md)
- [Blaxel Sandboxes vs Vercel Sandbox](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-vercel-sandbox.md)
- [Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.md)
- [Celesto (formerly SmolVM) vs Daytona](https://www.anchorterminal.com/compare/celesto-vs-daytona.md)
- [Celesto (formerly SmolVM) vs DeltaBox Lite](https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.md)
- [Celesto (formerly SmolVM) vs Deno Sandbox](https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.md)
- [Celesto (formerly SmolVM) vs E2B](https://www.anchorterminal.com/compare/celesto-vs-e2b.md)
- [Celesto (formerly SmolVM) vs Freestyle](https://www.anchorterminal.com/compare/celesto-vs-freestyle.md)
- [Celesto (formerly SmolVM) vs InstaVM](https://www.anchorterminal.com/compare/celesto-vs-instavm.md)
- [Celesto (formerly SmolVM) vs Maritime](https://www.anchorterminal.com/compare/celesto-vs-maritime.md)
- [Celesto (formerly SmolVM) vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.md)
- [Celesto (formerly SmolVM) vs Modal Sandboxes](https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.md)
- [Celesto (formerly SmolVM) vs Morph Cloud](https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.md)
- [Celesto (formerly SmolVM) vs Offscreen](https://www.anchorterminal.com/compare/celesto-vs-offscreen.md)
- [Celesto (formerly SmolVM) vs SPACE](https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.md)
- [Celesto (formerly SmolVM) vs Runloop Devboxes](https://www.anchorterminal.com/compare/celesto-vs-runloop.md)
- [Celesto (formerly SmolVM) vs Sandbox0](https://www.anchorterminal.com/compare/celesto-vs-sandbox0.md)
- [Celesto (formerly SmolVM) vs Sprites](https://www.anchorterminal.com/compare/celesto-vs-sprites.md)
- [Celesto (formerly SmolVM) vs Together Code Sandbox](https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.md)
- [Celesto (formerly SmolVM) vs Vercel Sandbox](https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.md)
- [Agent 37 Cloud vs Blaxel Sandboxes](https://www.anchorterminal.com/compare/agent37-vs-blaxel-sandboxes.md)
- [Agent 37 Cloud vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agent37-vs-celesto.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp