Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK

Celesto (formerly SmolVM) 60

Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.

Cloudflare Sandbox SDK 30

No x402 or other machine payment on anything the SDK exposes (0). Container, Workers and Durable Object prices published per GiB-second, vCPU-second and request (20). Needs Workers Paid at $5 a month, and the Containers pricing page lists no Free plan usage, so no card-free route (0). Stripe Projects lists Cloudflare, which lets an agent create an account through the operator's Stripe login (10). 0 + 20 + 0 + 10 = 30.

Celesto (formerly SmolVM) 66

Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as celesto with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.

Cloudflare Sandbox SDK 90

Scored on the SDK checklist, since the listing is a library. Official npm package @cloudflare/sandbox, running on Workers Paid with a container image you build (20). Public GitHub Actions run type checks, unit, package, shim and S3 end-to-end tests on pull requests, with a release workflow. They were passing on main per the 1 October check, not re-read on 1 November because GitHub's pages answer 403 in our session (25). Open issues weren't readable on 1 November. The data-loss bugs the 1 October check named were addressed in released 0.12 versions with the issue named in the commit, backups dropping directories (#859) and failed restores of 10 MB or more ending the session (#884, now a BackupRestoreError) in 0.12.11, and tunnels.get() (#874) in 0.12.12, among 12 issues closed by name on the 0.x branch since August. allowedHosts failing closed (#844) wasn't found among them (15 of 25). Release notes flag breaking changes, and 1.0.0 shipped as a major with a migration guide and an API map from 0.12 (15). 1.0.3 is current, and 0.x gets fixes until 31 December 2026 (15). Cloudflare's own status page isn't scored on these lines. 20 + 25 + 15 + 15 + 15 = 90.

Celesto (formerly SmolVM) 52

Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). computer logs shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.

Cloudflare Sandbox SDK 73

There's no hosted credential to score. Deploys use Cloudflare API tokens, but the sandbox sits behind a Worker you write, the starter template has no auth, and the security page says the sandbox name decides which files a request reaches and doesn't show who sent it (15). Each sandbox is a separate VM with its own filesystem, process space and network stack (10). Outbound traffic can be cut off with enableInternet = false or limited with a deny-by-default allowedHosts list and deniedHosts, all GA, though internet access is on by default (10). Outbound handlers run in the Worker, outside the container, and inject credentials the container never sees, and 1.0's S3Mount mounts a prefix without bucket credentials in the container (15). Sandbox labels for analytics, and since 0.12.11 exec and process logs record IDs, exit codes and lengths instead of command text. Account audit logs weren't read (5). security.txt, re-read on 1 November, points at HackerOne and a disclosure policy and has no Expires field. Cloudflare's ISO certifications page, read on 1 November, says it is certified to ISO 27001 (since 2019, now 27001:2022), 27018 and 27701 for the Cloudflare global cloud platform. 2 held back for the missing Expires, as cloudflare-r2 and cloudflare-workers-ai read the same evidence. OSV lists no advisory for @cloudflare/sandbox (18). 15 + 20 + 15 + 5 + 18 = 73.

Celesto (formerly SmolVM) 70

Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.

Cloudflare Sandbox SDK 86

The SDK and its container image are Apache-2.0. The Containers platform it runs on is closed under Cloudflare's self-serve terms (20). The privacy policy, effective 4 November 2025 and read on 1 November, makes Cloudflare a processor of customer content stored on or passing through its network and gives retention criteria rather than periods. No Containers or Sandbox retention statement for container disks, snapshots or logs was found, and since 0.12.11 the SDK keeps command text and output out of Workers Logs (16). A dated notice that 0.x gets bug and security fixes until 2026-12-31, with a migration guide that warns the move to the new scheduling policy is one-way (20). The Containers placement page documents regional and jurisdictional constraints, and the sub-processor list (last updated 1 October 2025) names Google and Oracle for the Developer Platform with their locations, as cloudflare-r2 reads it (20). 20 + 16 + 20 + 20 = 76.

Celesto (formerly SmolVM) 81

0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.

Cloudflare Sandbox SDK 90

@cloudflare/sandbox 1.0.3 and 0.12.14 tagged on 22 October 2026 (30). 14 releases in the 90 days from 3 August, from 0.12.5 (7 August) to 1.0.3, plus three 1.0.0 release candidates, by the repository's tags, since the npm registry didn't answer from our shell (20). Reply times weren't visible, and GitHub's pages answer 403 in our session. Fixes on both release lines name the issues they close, and the 0.x line gets fixes until 31 December 2026 (15). It's Cloudflare's official SDK and current (15). Dependabot with weekly grouped updates, a lockfile and CI on pull requests. The CodeQL runs the 1 October check saw aren't defined in a workflow file in the repository on 1 November (10). 30 + 20 + 15 + 15 + 10 = 90.

Celesto (formerly SmolVM) 85

Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer exec and keep shell, ssh and desktop for interactive work (14 of 20). Network modes are closed values (open, off, public, restricted) and the SDK takes typed keyword arguments, though internet_settings is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as required_scope, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.

Cloudflare Sandbox SDK 77

No OpenAPI for the library. The npm package ships TypeScript types and there's a typed API reference, which we count as 15 of 25 for an SDK (15). llms.txt (122 Sandbox pages on 1 November) and Markdown pages for every doc (10). Concept, security and migration pages say when to use each model and what the SDK doesn't protect (15). Typed option objects, few free-form blobs (12). Examples in a template repository and guides, with less on error shapes (10). Dated changelog, a CHANGELOG.md per release line and a 1.0 migration guide with an API map (15). 15 + 10 + 15 + 12 + 10 + 15 = 77.