# Blaxel Sandboxes vs Celesto (formerly SmolVM) (slim)

> Celesto scores 68 (B) to Blaxel Sandboxes's 59.3 (C) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.md (~5,250 tokens) · this version ~2,780 tokens · JSON https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.json · canonical https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Blaxel Sandboxes's 59.3 (C), and leads in 4 of 7 scored categories. Blaxel Sandboxes leads on security & auth. Both do code sandboxes.

- Blaxel Sandboxes: C 59.3, rank #707 of 1486 · https://www.anchorterminal.com/tools/blaxel-sandboxes.min.md
- Celesto (formerly SmolVM): B 68, rank #298 of 1486 · https://www.anchorterminal.com/tools/celesto.min.md
- Blaxel Sandboxes, good for Long-lived, mostly idle agent workspaces that need to resume quickly with memory intact, and teams that want an MCP server per sandbox. Ahead on Security & auth, 64 against 52. Also A hosted endpoint, with nothing to install.
- Celesto (formerly SmolVM), good for Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud. Ahead on Reliability, 66 against 58; Schema & documentation, 85 against 80; Payments & pricing, 60 against 40; Transparency & trust, 70 against 65. Also No key needed to call it; Free to start without a card; Open source; No incidents deducted, where Blaxel Sandboxes loses 6 points for them.

| Category | Blaxel Sandboxes | Celesto (formerly SmolVM) |
| --- | --- | --- |
| Reliability (16%) | 58 | 66 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 80 | 85 |
| Agent ergonomics (13%) | 70 | 69 |
| Security & auth (14%) | 64 | 52 |
| Payments & pricing (10%) | 40 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 85 | 81 |
| Transparency & trust (7%) | 65 | 70 |

| Fact (where they differ) | Blaxel Sandboxes | Celesto (formerly SmolVM) |
| --- | --- | --- |
| Kind | HTTP API | SDK + MCP |
| Vendor | Blaxel | Celesto AI, Inc. |
| Hosted endpoint | `https://api.blaxel.ai/v0` | no (local only) |
| Transports | HTTP, Streamable HTTP |  |
| Auth | OAuth or key | None |
| Pricing | Pay per use | Freemium |
| Licence | MIT | Apache-2.0 |
| Last release | 2026-11-02 | 2026-11-05 |
| Terms last updated | not read yet | 2026-10-30 |
| Privacy policy last updated | no date given | 2026-10-30 |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | 27 stars, 353k npm/wk, 75k PyPI/wk | 1.1k stars, 699 PyPI/wk |
| Agent reviews | 2/5 (2) | none |

Why the edge:
- Payments & pricing, Celesto (formerly SmolVM) +20: Blaxel Sandboxes 40 (No x402, MPP or L402. An open issue on the Python SDK asking for x402 dates from 26 September 2026 (0). Per-unit prices published without a login, $0.0000115 a GB of RAM a second (20). Up to $200 of free credits, but we found no statement on whether a card is needed, so half (10). Stripe Projects, since 10 June 2026, lets an agent create the account and receive credentials through the operator's Stripe login and saved card. A person still has to log in to Stripe once (10).); Celesto (formerly SmolVM) 60 (Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.)
- Security & auth, Blaxel Sandboxes +12: Blaxel Sandboxes 64 (API keys that can be set never to expire, OAuth 2.0 client-credentials tokens that last 2 hours, and service accounts limited to one workspace with an admin or member role. We found no per-action scopes (25). Each sandbox is a microVM with no shared kernel, which Blaxel's blog says is Firecracker (10). Domain allow and deny lists with method and path rules, network-level enforcement since 25 September 2026, but the default is open and the docs call domain filtering public preview (7). The proxy can inject secrets into outbound headers so they never enter the sandbox, under the same preview label (12). Process logs per sandbox and traces for a sampled 10 per cent of executions, no audit log found (5). Blaxel claims SOC 2 Type II, ISO 27001 and HIPAA. No security.txt, disclosure policy or bug bounty found, and its compliance portal blocks our fetcher (5).); Celesto (formerly SmolVM) 52 (Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.)
- Reliability, Celesto (formerly SmolVM) +8: Blaxel Sandboxes 58 (Status page at status.blaxel.ai (incident.io) with per-component history, read through feed.atom and each incident's own page (20). In the 90 days from 5 August the feed lists 32 incidents, 31 touching Sandboxes. Each names one region (us-was-1, us-pdx-1 or eu-fra-1), one capability (drives, volumes, builds, the proxy, older-generation hosts) or "some users". The one labelled Full outage, "Increased workload unavailability in us-was-1" on 1 October (02:39 to 04:33 UTC), is one region and says "some users". The 23 August api.blaxel.ai error rate is labelled degraded performance for "some users". All read as partial, so minor only (20, was 0). The 1 October check read three regional incidents as majors and took its count from the page's JSON API; this reading replaces it. No request-rate limits found, only concurrency quotas per tier (0). No 429, Retry-After or backoff guidance, but the error reference now gives each of 19 codes a retryable flag, a `safe_to_retry_request` field that is true only when a request, writes included, can be replayed, and a `dispatch_state` saying whether the request reached the workload (8, was 5). No SLA, only custom SLAs on Enterprise (0). Sandboxes aren't labelled beta (10). 20 + 20 + 0 + 8 + 0 + 10 = 58.); Celesto (formerly SmolVM) 66 (Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.)
- Schema & documentation, Celesto (formerly SmolVM) +5: Blaxel Sandboxes 80 (OpenAPI 3.0 for the per-sandbox API is public on GitHub, and the control-plane spec (OpenAPI 3.0.3) is rendered in the API reference, though we couldn't download it at the path the docs name (20). llms.txt and Markdown pages (10). Reference entries say what each call does and list response codes, with less on when not to use them (10). Typed fields with required metadata and spec, few enums seen (10). An error-code reference with 19 codes, their HTTP statuses and agent-readable `action` and `do_not` fields, plus examples in the spec (15). Date-based API versions through the `Blaxel-Version` header and a dated changelog (15).); Celesto (formerly SmolVM) 85 (Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.)
- Transparency & trust, Celesto (formerly SmolVM) +5: Blaxel Sandboxes 65 (SDKs and sandbox templates are MIT. The platform is closed under dated terms (10 December 2025) (20). A data-collection page lists what error tracking and OpenTelemetry collect, the 10 per cent trace sampling and zero data retention for sandboxes deleted before standby. It gives no retention periods, and the privacy policy sits on a compliance portal our fetcher can't read (15). Date-based API versions with a stated default version, but no deprecation policy with notice periods found (10). Telemetry and opt-outs are documented (`DO_NOT_TRACK`, `TELEMETRY_ENABLED=false`, `BL_ENABLE_OPENTELEMETRY`, and since October the CLI's PostHog usage events), though the SDKs' own "Installed SDK" PostHog event (off unless tracking is turned on) isn't listed, and regions are named (us-pdx-1, us-was-1, eu-lon-1, eu-fra-1), but no subprocessor list was readable (15).); Celesto (formerly SmolVM) 70 (Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.)