{ "data": { "a": { "slug": "celesto", "name": "Celesto (formerly SmolVM)", "vendor": "Celesto AI, Inc.", "vendorUrl": "https://celesto.ai", "kind": "sdk", "category": "code-sandboxes", "summary": "Celesto, formerly SmolVM, is an open-source Python SDK and CLI from Celesto AI that runs disposable Firecracker or QEMU microVMs on the owner's machine for agent code, browsers and desktops, with an optional paid Celesto Cloud.", "url": "https://www.anchorterminal.com/tools/celesto", "markdownUrl": "https://www.anchorterminal.com/tools/celesto.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/celesto.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/celesto.json", "dns": "celesto.grade.anchorterminal.com", "repo": "https://github.com/CelestoAI/Celesto", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "pypi", "name": "celesto" } ], "auth": "none", "authNotes": "Local use needs no account or key. The local API server and dashboard each require a bearer token, generated at start or read from CELESTO_SERVER_TOKEN and CELESTO_DASHBOARD_TOKEN. Celesto Cloud uses an organisation-bound CELESTO_API_KEY with named permissions (see, execute, delete) set in the dashboard.", "pricing": "freemium", "pricingNotes": "The local SDK and CLI are free under Apache-2.0. Celesto Cloud bills sandboxes by the running hour from $0.015 (Micro, 1 vCPU, 2 GB) to $0.16 (XL, 8 vCPU, 32 GB), prepaid from $2.01, with a one-time $5 Micro credit and no card.", "priceSummary": "$0.015 / session-hr", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the repository, the docs, llms.txt or the pricing page (checked 2026-11-06). Cloud runtime is prepaid by card under Settings \u003e Billing.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1149, "npmWeekly": null, "pypiWeekly": 699, "asOf": "2026-11-06" }, "docsUrl": "https://celesto.ai/docs", "llmsTxt": "https://celesto.ai/llms.txt", "openapi": "https://github.com/CelestoAI/Celesto/blob/main/ts/celesto-local-server.openapi.json", "capabilities": [ "sandbox.code", "sandbox.fs", "sandbox.persist", "sandbox.browser" ], "tags": [ "open-source", "local", "self-hosted", "hosted", "freemium", "no-card", "free-tier", "apache-2.0", "python", "typescript", "cli", "microvm", "firecracker", "llms-txt", "openapi", "telemetry", "pre-1.0", "renamed" ], "lastRelease": "2026-11-05", "graded": true, "anchor": { "graded": true, "score": 68, "grade": "B", "agentReady": false, "rank": 298, "ranked": true, "rankOf": 1486, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 81, "payments": 60, "reliability": 66, "schema": 85, "security": 52, "transparency": 70 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.", "bestFor": "Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.", "strengths": [ "Apache-2.0, installs from PyPI with `celesto setup` and `celesto doctor`, and runs local microVMs with no account or key", "Every `--json` response has the same `ok`, `command`, `exit_code`, `data` and `error` fields, with recovery commands in errors", "Network modes `off`, `public` (proxy that rejects private and metadata addresses) and `restricted` with CIDR or domain allowlists", "Dated changelog with Security sections, breaking changes marked, and 22 PyPI releases in the 90 days to 6 November 2026", "OpenAPI documents for the local server (24 operations) and the cloud API (171 operations) in the repository, plus llms.txt" ], "weaknesses": [ "Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball", "Outbound network access is open by default, and Linux TAP mode does not block every private network or metadata service", "Usage telemetry to PostHog is on after a first-use notice, until switched off", "Renamed from SmolVM on 19 September 2026 in a breaking release that removed the `smolvm` command and import path", "No security.txt, bug bounty or certification found, and CI results could not be read" ], "agentNotes": [ "Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text", "Create computers with unique names and delete them by exact name when the job ends, including after failures", "Set `internet_settings={\"mode\": \"off\"}` or `restricted` for untrusted code, since the default is open", "Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine", "Never paste browser or display connection URLs into model context; possession of the URL grants control" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68 } ], "editorialScores": { "ergonomics": 69, "maintenance": 81, "payments": 60, "reliability": 66, "schema": 85, "security": 52, "transparency": 74 }, "provenanceScore": 66, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install celesto \u0026\u0026 celesto setup \u0026\u0026 celesto doctor", "headless": { "create": "celesto computer create --name agent-job --json", "delete": "celesto computer delete agent-job --json", "exec": "celesto computer exec agent-job --json -- python -m pytest" } }, "letme": { "capability": "https://letme.dev/sandbox.code", "tool": "https://letme.dev/celesto" }, "area": "agent-runtime", "unitPrices": [ { "item": "Cloud Micro sandbox (1 vCPU, 2 GB)", "unit": "session-hour", "usd": 0.015, "note": "Billed by the running hour; local use is free" }, { "item": "Cloud XL sandbox (8 vCPU, 32 GB)", "unit": "session-hour", "usd": 0.16, "note": "Largest size on the pricing page" } ], "provenance": { "legalEntity": "Celesto AI, Inc.", "domain": "celesto.ai", "domainRegistered": "2025-07-13", "endpointOnVendorDomain": null, "terms": "https://celesto.ai/legal/terms", "privacy": "https://celesto.ai/legal/privacy-policy", "statusPage": "", "changelog": "https://github.com/CelestoAI/Celesto/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The privacy policy, last updated 30 October 2026, names Celesto AI, Inc., a Delaware corporation with a Wilmington mailing address. It has no clause on automated access.", "celesto.ai/robots.txt allows all crawlers. docs.celesto.ai carries Content-Signal ai-train=yes, search=yes, ai-input=yes.", "RDAP gives celesto.ai a registration date of 13 July 2025.", "/.well-known/security.txt returns 404. SECURITY.md asks for private reports through GitHub's vulnerability reporting. No status page is linked from the pricing page." ], "score": 66 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/celesto.json", "live": { "slug": "celesto", "versions": [ { "registry": "github", "name": "CelestoAI/Celesto", "version": "v0.1.13", "released": "2026-11-05", "seenAt": "2026-11-06T23:13:37.416837168Z" }, { "registry": "pypi", "name": "celesto", "version": "0.1.13", "released": "2026-11-05", "seenAt": "2026-11-06T23:13:37.309276304Z" } ], "githubStars": 1149, "pypiWeekly": 699, "securityTxt": { "url": "https://celesto.ai/.well-known/security.txt", "state": "unknown", "checkedAt": "2026-11-07T16:01:01.176888246Z" }, "llmsTxt": { "url": "https://celesto.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:46.784166983Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/CelestoAI/Celesto/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:18:00.719411253Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8ddae4a6adbd" }, { "url": "https://celesto.ai/legal/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:00:50.868104256Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "87ce310b1db6" }, { "url": "https://celesto.ai/legal/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:00:53.107282947Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1dece6f9a42e" } ], "updatedAt": "2026-11-07T16:01:01.176888246Z" } }, "answer": "Cloudflare Sandbox SDK scores 69.7 (B) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 4 of 7 scored categories. Celesto (formerly SmolVM) leads on schema \u0026 documentation, agent ergonomics and payments \u0026 pricing.", "b": { "slug": "cloudflare-sandbox-sdk", "name": "Cloudflare Sandbox SDK", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/sandbox/", "kind": "sdk", "category": "code-sandboxes", "summary": "TypeScript library for running sandboxed Linux containers from a Cloudflare Worker.", "url": "https://www.anchorterminal.com/tools/cloudflare-sandbox-sdk", "markdownUrl": "https://www.anchorterminal.com/tools/cloudflare-sandbox-sdk.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cloudflare-sandbox-sdk.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cloudflare-sandbox-sdk.json", "dns": "cloudflare-sandbox-sdk.grade.anchorterminal.com", "repo": "https://github.com/cloudflare/sandbox-sdk", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "npm", "name": "@cloudflare/sandbox" } ], "auth": "none", "authNotes": "There's no hosted API. The sandbox sits behind a Worker you deploy, so it has whatever auth you put in front of it, and the starter template has none. Deploying needs a Cloudflare account through Wrangler. Version 1.0 adds preview ports with custom hostnames and authentication.", "pricing": "paid", "pricingNotes": "Needs the Workers Paid plan, $5 a month minimum (https://developers.cloudflare.com/workers/platform/pricing/). Billed as Containers plus Workers and Durable Objects. Containers include 25 GiB-hours of memory, 375 vCPU-minutes and 200 GB-hours of disk a month, then $0.0000025 a GiB-second of memory, $0.000020 a vCPU-second of CPU used and $0.00000007 a GB-second of disk, in 10 ms steps while the container runs. Egress is $0.025 a GB in North America and Europe after 1 TB (https://developers.cloudflare.com/containers/pricing/). Durable Objects add $0.15 per million requests and $12.50 per million GB-seconds after the included amounts (https://developers.cloudflare.com/workers/platform/pricing/).", "priceSummary": "$0.072 / vCPU-hr", "where": "local", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1100, "npmWeekly": 722733, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://developers.cloudflare.com/sandbox/", "llmsTxt": "https://developers.cloudflare.com/sandbox/llms.txt", "capabilities": [ "sandbox.code", "sandbox.fs", "sandbox.persist" ], "tags": [ "hosted", "typescript", "open-source", "llms-txt" ], "lastRelease": "2026-10-22", "graded": true, "anchor": { "graded": true, "score": 69.7, "grade": "B", "agentReady": false, "rank": 229, "ranked": true, "rankOf": 1486, "categoryRank": 5, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 63, "maintenance": 90, "payments": 30, "reliability": 90, "schema": 77, "security": 73, "transparency": 86 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -3, "negativeNotes": [ "20 October 2026. @cloudflare/sandbox 0.12.12 fixed a flaw its release notes describe, the s3fs password file for `mountBucket()` was readable by other users in the container long enough for a non-root process to read the bucket credentials (#1016). Earlier 0.12 releases (13 August, 24 August, 23 September) enforced `credentialProxy` bucket and prefix boundaries that copies and bucket-level writes could cross. OSV lists no advisory for the package on 1 November, so these are released fixes of described flaws without an advisory, folded into one term (-3). https://github.com/cloudflare/sandbox-sdk/blob/v0/packages/sandbox/CHANGELOG.md" ], "verdict": "Each sandbox runs in its own VM with a separate filesystem, process space and network stack, and credentials can stay in the Worker. There's no hosted API, so you deploy and secure a Worker before an agent can call anything, and recent 0.12 releases fixed credential exposures without a published advisory.", "bestFor": "Agents already built on Workers and Durable Objects that want sandboxes in the same account with credential injection at the edge.", "strengths": [ "Each sandbox runs in its own VM with a separate filesystem, process space and network stack", "Outbound handlers hold credentials in the Worker and inject them, so the container never sees them", "Egress can be turned off or limited to a deny-by-default `allowedHosts` list", "14 releases from 7 August to 22 October 2026 across the 1.0 and 0.12 lines, with fixes naming the issues they close", "Apache-2.0, with type, unit and S3 end-to-end tests run on pull requests" ], "weaknesses": [ "No hosted API. You deploy and secure a Worker before an agent can call anything, and the starter has no auth", "0.12.12 fixed bucket credentials readable inside the container, and earlier 0.12 releases fixed `credentialProxy` boundary gaps, with no advisory published", "Needs Workers Paid at $5 a month, with no card-free route", "TypeScript only", "Two models to learn while 0.x and 1.0 overlap until 31 December 2026" ], "agentNotes": [ "Derive the sandbox name from the authenticated user, as the docs advise. Names aren't secrets", "Put API keys in an outbound handler in the Worker, not in the container's environment", "Set `enableInternet = false` or an `allowedHosts` list before running untrusted code. Internet access is on by default", "On 0.12, upgrade the SDK and the container image together to 0.12.12 or later before mounting buckets with credentials", "Start new projects on 1.0. The 0.x library only gets fixes until 31 December 2026" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 69.7 } ], "editorialScores": { "ergonomics": 63, "maintenance": 90, "payments": 30, "reliability": 90, "schema": 77, "security": 73, "transparency": 76 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm create cloudflare@latest -- my-sandbox --template=cloudflare/sandbox-sdk/examples/minimal" }, "letme": { "capability": "https://letme.dev/sandbox.code", "tool": "https://letme.dev/cloudflare-sandbox-sdk" }, "sameCompany": [ "cloudflare-ai-gateway", "cloudflare-workers-ai", "cloudflare-workers-oauth-provider", "cloudflare-web-search", "cloudflare-clairic", "cloudflare-ai-search", "cloudflare-cli", "cloudflare-mcp", "cloudflare-email-service", "cloudflare-r2", "cloudflare-clef" ], "area": "agent-runtime", "unitPrices": [ { "item": "Container CPU", "unit": "vcpu-hour", "usd": 0.072, "note": "$0.000020 a vCPU-second of CPU used, after 375 vCPU-minutes a month" }, { "item": "Workers Paid plan", "unit": "month", "usd": 5, "note": "Minimum charge" }, { "item": "Egress, North America and Europe", "unit": "gb", "usd": 0.025, "note": "After 1 TB a month" } ], "provenance": { "legalEntity": "Cloudflare, Inc.", "domain": "cloudflare.com", "domainRegistered": "2009-02-17", "endpointOnVendorDomain": null, "terms": "https://www.cloudflare.com/terms/", "privacy": "https://www.cloudflare.com/privacypolicy/", "statusPage": "https://www.cloudflarestatus.com", "changelog": "https://developers.cloudflare.com/changelog/?product=sandbox", "securityTxt": "valid", "checked": "2026-11-01", "notes": [ "The self-serve subscription agreement (updated 12 September 2025) names Cloudflare, Inc., 101 Townsend St., San Francisco.", "There's no vendor endpoint to check. Sandboxes are reached through a Worker on your own route or workers.dev subdomain.", "security.txt lists HackerOne and a disclosure policy, with no Expires field (re-read on 1 November).", "The README no longer carries the pre-1.0 warning. The repository tags 1.0.3 and 0.12.14 on 22 October 2026, with 1.0 on main and 0.x on the v0 branch." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cloudflare-sandbox-sdk.json", "live": { "slug": "cloudflare-sandbox-sdk", "vendorStatus": { "page": "https://www.cloudflarestatus.com", "indicator": "major", "summary": "Partial System Outage", "checkedAt": "2026-11-07T18:20:45.910144936Z" }, "versions": [ { "registry": "github", "name": "cloudflare/sandbox-sdk", "version": "@cloudflare/sandbox@1.0.3", "released": "2026-10-22", "seenAt": "2026-11-06T23:15:55.591650516Z" }, { "registry": "npm", "name": "@cloudflare/sandbox", "version": "1.0.3", "seenAt": "2026-11-06T23:15:55.255317871Z" } ], "githubStars": 1160, "npmWeekly": 1308892, "securityTxt": { "url": "https://cloudflare.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:23.467095484Z" }, "llmsTxt": { "url": "https://developers.cloudflare.com/sandbox/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:06.989329265Z" }, "domain": { "domain": "cloudflare.com", "registered": "2009-02-17", "source": "https://rdap.verisign.com/com/v1/domain/cloudflare.com", "checkedAt": "2026-11-01T14:18:56.122446983Z" }, "pages": [ { "url": "https://developers.cloudflare.com/changelog/?product=sandbox", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:03:52.867867101Z", "changedAt": "2026-11-07T14:03:52.867867101Z", "fingerprint": "e7de4f5aaa53" }, { "url": "https://developers.cloudflare.com/containers/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:04:06.976245077Z", "changedAt": "2026-10-06T16:07:26.756927967Z", "fingerprint": "f742d2e03f78" }, { "url": "https://developers.cloudflare.com/workers/platform/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-10-16T22:20:45.228619459Z", "changedAt": "2026-10-16T22:20:45.228619459Z", "fingerprint": "fa680c96ce62" } ], "github": { "repo": "cloudflare/sandbox-sdk", "checkedAt": "2026-11-02T08:40:02.314202906Z", "stars": 1156, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-29T10:33:06Z", "openIssues": 2, "openPRs": 2, "issuesOpened90d": 34, "issuesClosed90d": 47, "prsMerged90d": 155, "ci": { "branch": "main", "runs": 50, "success": 44, "failure": 6, "other": 0, "latest": "success", "latestAt": "2026-10-29T10:33:25Z" }, "advisories": [ { "ghsa": "GHSA-pr6p-92vv-ffv2", "severity": "critical", "published": "2026-10-26T17:04:19Z" } ], "replies": { "sampled": 25, "unanswered": 2, "medianDays": 21.3 } }, "updatedAt": "2026-11-07T18:20:45.910144936Z" } }, "edges": [ { "by": 30, "category": "payments", "leads": "celesto", "name": "Payments \u0026 pricing", "reasons": { "a": "Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.", "b": "No x402 or other machine payment on anything the SDK exposes (0). Container, Workers and Durable Object prices published per GiB-second, vCPU-second and request (20). Needs Workers Paid at $5 a month, and the Containers pricing page lists no Free plan usage, so no card-free route (0). Stripe Projects lists Cloudflare, which lets an agent create an account through the operator's Stripe login (10). 0 + 20 + 0 + 10 = 30." }, "scores": { "a": 60, "b": 30 } }, { "by": 24, "category": "reliability", "leads": "cloudflare-sandbox-sdk", "name": "Reliability", "reasons": { "a": "Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.", "b": "Scored on the SDK checklist, since the listing is a library. Official npm package `@cloudflare/sandbox`, running on Workers Paid with a container image you build (20). Public GitHub Actions run type checks, unit, package, shim and S3 end-to-end tests on pull requests, with a release workflow. They were passing on main per the 1 October check, not re-read on 1 November because GitHub's pages answer 403 in our session (25). Open issues weren't readable on 1 November. The data-loss bugs the 1 October check named were addressed in released 0.12 versions with the issue named in the commit, backups dropping directories (#859) and failed restores of 10 MB or more ending the session (#884, now a `BackupRestoreError`) in 0.12.11, and `tunnels.get()` (#874) in 0.12.12, among 12 issues closed by name on the 0.x branch since August. `allowedHosts` failing closed (#844) wasn't found among them (15 of 25). Release notes flag breaking changes, and 1.0.0 shipped as a major with a migration guide and an API map from 0.12 (15). 1.0.3 is current, and 0.x gets fixes until 31 December 2026 (15). Cloudflare's own status page isn't scored on these lines. 20 + 25 + 15 + 15 + 15 = 90." }, "scores": { "a": 66, "b": 90 } }, { "by": 21, "category": "security", "leads": "cloudflare-sandbox-sdk", "name": "Security \u0026 auth", "reasons": { "a": "Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.", "b": "There's no hosted credential to score. Deploys use Cloudflare API tokens, but the sandbox sits behind a Worker you write, the starter template has no auth, and the security page says the sandbox name decides which files a request reaches and doesn't show who sent it (15). Each sandbox is a separate VM with its own filesystem, process space and network stack (10). Outbound traffic can be cut off with `enableInternet = false` or limited with a deny-by-default `allowedHosts` list and `deniedHosts`, all GA, though internet access is on by default (10). Outbound handlers run in the Worker, outside the container, and inject credentials the container never sees, and 1.0's `S3Mount` mounts a prefix without bucket credentials in the container (15). Sandbox labels for analytics, and since 0.12.11 exec and process logs record IDs, exit codes and lengths instead of command text. Account audit logs weren't read (5). security.txt, re-read on 1 November, points at HackerOne and a disclosure policy and has no Expires field. Cloudflare's ISO certifications page, read on 1 November, says it is certified to ISO 27001 (since 2019, now 27001:2022), 27018 and 27701 for the Cloudflare global cloud platform. 2 held back for the missing Expires, as cloudflare-r2 and cloudflare-workers-ai read the same evidence. OSV lists no advisory for @cloudflare/sandbox (18). 15 + 20 + 15 + 5 + 18 = 73." }, "scores": { "a": 52, "b": 73 } }, { "by": 16, "category": "transparency", "leads": "cloudflare-sandbox-sdk", "name": "Transparency \u0026 trust", "reasons": { "a": "Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.", "b": "The SDK and its container image are Apache-2.0. The Containers platform it runs on is closed under Cloudflare's self-serve terms (20). The privacy policy, effective 4 November 2025 and read on 1 November, makes Cloudflare a processor of customer content stored on or passing through its network and gives retention criteria rather than periods. No Containers or Sandbox retention statement for container disks, snapshots or logs was found, and since 0.12.11 the SDK keeps command text and output out of Workers Logs (16). A dated notice that 0.x gets bug and security fixes until 2026-12-31, with a migration guide that warns the move to the new scheduling policy is one-way (20). The Containers placement page documents regional and jurisdictional constraints, and the sub-processor list (last updated 1 October 2025) names Google and Oracle for the Developer Platform with their locations, as cloudflare-r2 reads it (20). 20 + 16 + 20 + 20 = 76." }, "scores": { "a": 70, "b": 86 } }, { "by": 9, "category": "maintenance", "leads": "cloudflare-sandbox-sdk", "name": "Maintenance \u0026 community", "reasons": { "a": "0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.", "b": "@cloudflare/sandbox 1.0.3 and 0.12.14 tagged on 22 October 2026 (30). 14 releases in the 90 days from 3 August, from 0.12.5 (7 August) to 1.0.3, plus three 1.0.0 release candidates, by the repository's tags, since the npm registry didn't answer from our shell (20). Reply times weren't visible, and GitHub's pages answer 403 in our session. Fixes on both release lines name the issues they close, and the 0.x line gets fixes until 31 December 2026 (15). It's Cloudflare's official SDK and current (15). Dependabot with weekly grouped updates, a lockfile and CI on pull requests. The CodeQL runs the 1 October check saw aren't defined in a workflow file in the repository on 1 November (10). 30 + 20 + 15 + 15 + 10 = 90." }, "scores": { "a": 81, "b": 90 } }, { "by": 8, "category": "schema", "leads": "celesto", "name": "Schema \u0026 documentation", "reasons": { "a": "Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.", "b": "No OpenAPI for the library. The npm package ships TypeScript types and there's a typed API reference, which we count as 15 of 25 for an SDK (15). llms.txt (122 Sandbox pages on 1 November) and Markdown pages for every doc (10). Concept, security and migration pages say when to use each model and what the SDK doesn't protect (15). Typed option objects, few free-form blobs (12). Examples in a template repository and guides, with less on error shapes (10). Dated changelog, a CHANGELOG.md per release line and a 1.0 migration guide with an API map (15). 15 + 10 + 15 + 12 + 10 + 15 = 77." }, "scores": { "a": 85, "b": 77 } } ], "facts": [ { "a": "SDK + MCP", "b": "SDK + MCP", "name": "Kind" }, { "a": "Celesto AI, Inc.", "b": "Cloudflare", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "None", "b": "None", "name": "Auth" }, { "a": "Freemium", "b": "Paid", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-11-05", "b": "2026-10-22", "name": "Last release" }, { "a": "2026-10-30", "b": "2025-09-12", "name": "Terms last updated" }, { "a": "2026-10-30", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "1.1k stars, 699 PyPI/wk", "b": "1.1k stars, 723k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "Cloudflare Sandbox SDK scores 69.7 (B) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 4 of 7 scored categories. Celesto (formerly SmolVM) leads on schema \u0026 documentation, agent ergonomics and payments \u0026 pricing.", "question": "Which is better for AI agents, Celesto (formerly SmolVM) or Cloudflare Sandbox SDK?" }, { "answer": "Yes. Celesto (formerly SmolVM) is open source (Apache-2.0). Cloudflare Sandbox SDK is open source (Apache-2.0).", "question": "Are Celesto (formerly SmolVM) and Cloudflare Sandbox SDK open source?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 85 against 77", "Agent ergonomics, 69 against 63", "Payments \u0026 pricing, 60 against 30" ], "also": [ "Free to start without a card", "No incidents deducted, where Cloudflare Sandbox SDK loses 3 points for them" ], "goodFor": "Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.", "slug": "celesto", "watchFor": "Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball" }, { "aheadOn": [ "Reliability, 90 against 66", "Security \u0026 auth, 73 against 52", "Maintenance \u0026 community, 90 against 81", "Transparency \u0026 trust, 86 against 70" ], "also": null, "goodFor": "Agents already built on Workers and Durable Objects that want sandboxes in the same account with credential injection at the edge.", "slug": "cloudflare-sandbox-sdk", "watchFor": "No hosted API. You deploy and secure a Worker before an agent can call anything, and the starter has no auth" } ], "history": { "celesto": null, "cloudflare-sandbox-sdk": [ { "causes": [ "security", "evidence", "correction" ], "date": "2026-11-01", "delta": 2.2, "from": 67.5, "fromGrade": "B", "to": 69.7, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.3, "from": 67.8, "fromGrade": "B", "to": 67.5, "toGrade": "B" } ] }, "job": { "capability": "sandbox.code", "name": "Code sandboxes" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.json", "title": "Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-cloudflare-sandbox-sdk.json", "title": "Amazon Bedrock AgentCore Code Interpreter vs Cloudflare Sandbox SDK", "url": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-cloudflare-sandbox-sdk" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.json", "title": "Blaxel Sandboxes vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-cloudflare-sandbox-sdk.json", "title": "Blaxel Sandboxes vs Cloudflare Sandbox SDK", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-cloudflare-sandbox-sdk" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-daytona.json", "title": "Celesto (formerly SmolVM) vs Daytona", "url": "https://www.anchorterminal.com/compare/celesto-vs-daytona" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.json", "title": "Celesto (formerly SmolVM) vs DeltaBox Lite", "url": "https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.json", "title": "Celesto (formerly SmolVM) vs Deno Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-e2b.json", "title": "Celesto (formerly SmolVM) vs E2B", "url": "https://www.anchorterminal.com/compare/celesto-vs-e2b" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-freestyle.json", "title": "Celesto (formerly SmolVM) vs Freestyle", "url": "https://www.anchorterminal.com/compare/celesto-vs-freestyle" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-instavm.json", "title": "Celesto (formerly SmolVM) vs InstaVM", "url": "https://www.anchorterminal.com/compare/celesto-vs-instavm" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-maritime.json", "title": "Celesto (formerly SmolVM) vs Maritime", "url": "https://www.anchorterminal.com/compare/celesto-vs-maritime" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.json", "title": "Celesto (formerly SmolVM) vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.json", "title": "Celesto (formerly SmolVM) vs Modal Sandboxes", "url": "https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.json", "title": "Celesto (formerly SmolVM) vs Morph Cloud", "url": "https://www.anchorterminal.com/compare/celesto-vs-morph-cloud" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-offscreen.json", "title": "Celesto (formerly SmolVM) vs Offscreen", "url": "https://www.anchorterminal.com/compare/celesto-vs-offscreen" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.json", "title": "Celesto (formerly SmolVM) vs SPACE", "url": "https://www.anchorterminal.com/compare/celesto-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-runloop.json", "title": "Celesto (formerly SmolVM) vs Runloop Devboxes", "url": "https://www.anchorterminal.com/compare/celesto-vs-runloop" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-sandbox0.json", "title": "Celesto (formerly SmolVM) vs Sandbox0", "url": "https://www.anchorterminal.com/compare/celesto-vs-sandbox0" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-sprites.json", "title": "Celesto (formerly SmolVM) vs Sprites", "url": "https://www.anchorterminal.com/compare/celesto-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.json", "title": "Celesto (formerly SmolVM) vs Together Code Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.json", "title": "Celesto (formerly SmolVM) vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-daytona.json", "title": "Cloudflare Sandbox SDK vs Daytona", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-daytona" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-deltabox-lite.json", "title": "Cloudflare Sandbox SDK vs DeltaBox Lite", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-deltabox-lite" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-deno-sandbox.json", "title": "Cloudflare Sandbox SDK vs Deno Sandbox", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-deno-sandbox" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-e2b.json", "title": "Cloudflare Sandbox SDK vs E2B", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-e2b" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-freestyle.json", "title": "Cloudflare Sandbox SDK vs Freestyle", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-freestyle" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-instavm.json", "title": "Cloudflare Sandbox SDK vs InstaVM", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-instavm" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-maritime.json", "title": "Cloudflare Sandbox SDK vs Maritime", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-maritime" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-microsoft-execution-containers.json", "title": "Cloudflare Sandbox SDK vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-modal-sandboxes.json", "title": "Cloudflare Sandbox SDK vs Modal Sandboxes", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-modal-sandboxes" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-morph-cloud.json", "title": "Cloudflare Sandbox SDK vs Morph Cloud", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-morph-cloud" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-offscreen.json", "title": "Cloudflare Sandbox SDK vs Offscreen", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-offscreen" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-perplexity-space.json", "title": "Cloudflare Sandbox SDK vs SPACE", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-runloop.json", "title": "Cloudflare Sandbox SDK vs Runloop Devboxes", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-runloop" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-sandbox0.json", "title": "Cloudflare Sandbox SDK vs Sandbox0", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-sandbox0" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-sprites.json", "title": "Cloudflare Sandbox SDK vs Sprites", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-together-code-sandbox.json", "title": "Cloudflare Sandbox SDK vs Together Code Sandbox", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-together-code-sandbox" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-vercel-sandbox.json", "title": "Cloudflare Sandbox SDK vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/agent37-vs-celesto.json", "title": "Agent 37 Cloud vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/agent37-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/agent37-vs-cloudflare-sandbox-sdk.json", "title": "Agent 37 Cloud vs Cloudflare Sandbox SDK", "url": "https://www.anchorterminal.com/compare/agent37-vs-cloudflare-sandbox-sdk" } ], "panel": null, "scores": [ { "by": 24, "celesto": 66, "cloudflare-sandbox-sdk": 90, "edge": "cloudflare-sandbox-sdk", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 8, "celesto": 85, "cloudflare-sandbox-sdk": 77, "edge": "celesto", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 6, "celesto": 69, "cloudflare-sandbox-sdk": 63, "edge": "celesto", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "by": 21, "celesto": 52, "cloudflare-sandbox-sdk": 73, "edge": "cloudflare-sandbox-sdk", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "by": 30, "celesto": 60, "cloudflare-sandbox-sdk": 30, "edge": "celesto", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 9, "celesto": 81, "cloudflare-sandbox-sdk": 90, "edge": "cloudflare-sandbox-sdk", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 16, "celesto": 70, "cloudflare-sandbox-sdk": 86, "edge": "cloudflare-sandbox-sdk", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Cloudflare Sandbox SDK scores 69.7 (B) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 4 of 7 scored categories. Celesto (formerly SmolVM) leads on schema \u0026 documentation, agent ergonomics and payments \u0026 pricing. Both do code sandboxes.", "tasks": null, "tutorials": [], "verdicts": { "celesto": "Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.", "cloudflare-sandbox-sdk": "Each sandbox runs in its own VM with a separate filesystem, process space and network stack, and credentials can stay in the Worker. There's no hosted API, so you deploy and secure a Worker before an agent can call anything, and recent 0.12 releases fixed credential exposures without a published advisory." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk", "json": "https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.min.md" }, "markdown": "Cloudflare Sandbox SDK scores 69.7 (B) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 4 of 7 scored categories. Celesto (formerly SmolVM) leads on schema \u0026 documentation, agent ergonomics and payments \u0026 pricing. Both do code sandboxes.\n\n- Celesto (formerly SmolVM): grade B, 68/100, rank #298 of 1486. Markdown https://www.anchorterminal.com/tools/celesto.md · JSON https://www.anchorterminal.com/api/v1/tools/celesto.json\n- Cloudflare Sandbox SDK: grade B, 69.7/100, rank #229 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-sandbox-sdk.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-sandbox-sdk.json\n- Best code execution sandboxes for AI agents: https://www.anchorterminal.com/best/code-sandboxes/index.md\n- All 231 sandboxes comparisons: https://www.anchorterminal.com/compare/code-sandboxes/index.md\n\n## Which one, for what\n\n### Celesto (formerly SmolVM) (B)\n\nGood for: Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.\n\nAhead on:\n- Schema \u0026 documentation, 85 against 77\n- Agent ergonomics, 69 against 63\n- Payments \u0026 pricing, 60 against 30\n\nAlso in its favour:\n- Free to start without a card\n- No incidents deducted, where Cloudflare Sandbox SDK loses 3 points for them\n\nWatch for: Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball\n\n### Cloudflare Sandbox SDK (B)\n\nGood for: Agents already built on Workers and Durable Objects that want sandboxes in the same account with credential injection at the edge.\n\nAhead on:\n- Reliability, 90 against 66\n- Security \u0026 auth, 73 against 52\n- Maintenance \u0026 community, 90 against 81\n- Transparency \u0026 trust, 86 against 70\n\nWatch for: No hosted API. You deploy and secure a Worker before an agent can call anything, and the starter has no auth\n\n\n## Why the edge\n\n### Payments \u0026 pricing: Celesto (formerly SmolVM) +30\n\n- Celesto (formerly SmolVM) (60): Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.\n- Cloudflare Sandbox SDK (30): No x402 or other machine payment on anything the SDK exposes (0). Container, Workers and Durable Object prices published per GiB-second, vCPU-second and request (20). Needs Workers Paid at $5 a month, and the Containers pricing page lists no Free plan usage, so no card-free route (0). Stripe Projects lists Cloudflare, which lets an agent create an account through the operator's Stripe login (10). 0 + 20 + 0 + 10 = 30.\n\n### Reliability: Cloudflare Sandbox SDK +24\n\n- Celesto (formerly SmolVM) (66): Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.\n- Cloudflare Sandbox SDK (90): Scored on the SDK checklist, since the listing is a library. Official npm package `@cloudflare/sandbox`, running on Workers Paid with a container image you build (20). Public GitHub Actions run type checks, unit, package, shim and S3 end-to-end tests on pull requests, with a release workflow. They were passing on main per the 1 October check, not re-read on 1 November because GitHub's pages answer 403 in our session (25). Open issues weren't readable on 1 November. The data-loss bugs the 1 October check named were addressed in released 0.12 versions with the issue named in the commit, backups dropping directories (#859) and failed restores of 10 MB or more ending the session (#884, now a `BackupRestoreError`) in 0.12.11, and `tunnels.get()` (#874) in 0.12.12, among 12 issues closed by name on the 0.x branch since August. `allowedHosts` failing closed (#844) wasn't found among them (15 of 25). Release notes flag breaking changes, and 1.0.0 shipped as a major with a migration guide and an API map from 0.12 (15). 1.0.3 is current, and 0.x gets fixes until 31 December 2026 (15). Cloudflare's own status page isn't scored on these lines. 20 + 25 + 15 + 15 + 15 = 90.\n\n### Security \u0026 auth: Cloudflare Sandbox SDK +21\n\n- Celesto (formerly SmolVM) (52): Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.\n- Cloudflare Sandbox SDK (73): There's no hosted credential to score. Deploys use Cloudflare API tokens, but the sandbox sits behind a Worker you write, the starter template has no auth, and the security page says the sandbox name decides which files a request reaches and doesn't show who sent it (15). Each sandbox is a separate VM with its own filesystem, process space and network stack (10). Outbound traffic can be cut off with `enableInternet = false` or limited with a deny-by-default `allowedHosts` list and `deniedHosts`, all GA, though internet access is on by default (10). Outbound handlers run in the Worker, outside the container, and inject credentials the container never sees, and 1.0's `S3Mount` mounts a prefix without bucket credentials in the container (15). Sandbox labels for analytics, and since 0.12.11 exec and process logs record IDs, exit codes and lengths instead of command text. Account audit logs weren't read (5). security.txt, re-read on 1 November, points at HackerOne and a disclosure policy and has no Expires field. Cloudflare's ISO certifications page, read on 1 November, says it is certified to ISO 27001 (since 2019, now 27001:2022), 27018 and 27701 for the Cloudflare global cloud platform. 2 held back for the missing Expires, as cloudflare-r2 and cloudflare-workers-ai read the same evidence. OSV lists no advisory for @cloudflare/sandbox (18). 15 + 20 + 15 + 5 + 18 = 73.\n\n### Transparency \u0026 trust: Cloudflare Sandbox SDK +16\n\n- Celesto (formerly SmolVM) (70): Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.\n- Cloudflare Sandbox SDK (86): The SDK and its container image are Apache-2.0. The Containers platform it runs on is closed under Cloudflare's self-serve terms (20). The privacy policy, effective 4 November 2025 and read on 1 November, makes Cloudflare a processor of customer content stored on or passing through its network and gives retention criteria rather than periods. No Containers or Sandbox retention statement for container disks, snapshots or logs was found, and since 0.12.11 the SDK keeps command text and output out of Workers Logs (16). A dated notice that 0.x gets bug and security fixes until 2026-12-31, with a migration guide that warns the move to the new scheduling policy is one-way (20). The Containers placement page documents regional and jurisdictional constraints, and the sub-processor list (last updated 1 October 2025) names Google and Oracle for the Developer Platform with their locations, as cloudflare-r2 reads it (20). 20 + 16 + 20 + 20 = 76.\n\n### Maintenance \u0026 community: Cloudflare Sandbox SDK +9\n\n- Celesto (formerly SmolVM) (81): 0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.\n- Cloudflare Sandbox SDK (90): @cloudflare/sandbox 1.0.3 and 0.12.14 tagged on 22 October 2026 (30). 14 releases in the 90 days from 3 August, from 0.12.5 (7 August) to 1.0.3, plus three 1.0.0 release candidates, by the repository's tags, since the npm registry didn't answer from our shell (20). Reply times weren't visible, and GitHub's pages answer 403 in our session. Fixes on both release lines name the issues they close, and the 0.x line gets fixes until 31 December 2026 (15). It's Cloudflare's official SDK and current (15). Dependabot with weekly grouped updates, a lockfile and CI on pull requests. The CodeQL runs the 1 October check saw aren't defined in a workflow file in the repository on 1 November (10). 30 + 20 + 15 + 15 + 10 = 90.\n\n### Schema \u0026 documentation: Celesto (formerly SmolVM) +8\n\n- Celesto (formerly SmolVM) (85): Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.\n- Cloudflare Sandbox SDK (77): No OpenAPI for the library. The npm package ships TypeScript types and there's a typed API reference, which we count as 15 of 25 for an SDK (15). llms.txt (122 Sandbox pages on 1 November) and Markdown pages for every doc (10). Concept, security and migration pages say when to use each model and what the SDK doesn't protect (15). Typed option objects, few free-form blobs (12). Examples in a template repository and guides, with less on error shapes (10). Dated changelog, a CHANGELOG.md per release line and a 1.0 migration guide with an API map (15). 15 + 10 + 15 + 12 + 10 + 15 = 77.\n\n## Score by category\n\n| Category | Weight | Celesto (formerly SmolVM) | Cloudflare Sandbox SDK | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 66 | 90 | Cloudflare Sandbox SDK +24 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 85 | 77 | Celesto (formerly SmolVM) +8 |\n| Agent ergonomics | 13% (16.2 this run) | 69 | 63 | Celesto (formerly SmolVM) +6 |\n| Security \u0026 auth | 14% (17.5 this run) | 52 | 73 | Cloudflare Sandbox SDK +21 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 30 | Celesto (formerly SmolVM) +30 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 81 | 90 | Cloudflare Sandbox SDK +9 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 70 | 86 | Cloudflare Sandbox SDK +16 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **68 · B** | **69.7 · B** | |\n\n## Facts side by side\n\n| Fact | Celesto (formerly SmolVM) | Cloudflare Sandbox SDK |\n| --- | --- | --- |\n| Kind | SDK + MCP | SDK + MCP |\n| Vendor | Celesto AI, Inc. | Cloudflare |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | None | None |\n| Pricing | Freemium | Paid |\n| x402 | no | no |\n| Licence | Apache-2.0 | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-11-05 | 2026-10-22 |\n| Terms last updated | 2026-10-30 | 2025-09-12 |\n| Privacy policy last updated | 2026-10-30 | no date given |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | yes |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | not found in the text | yes |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | 1.1k stars, 699 PyPI/wk | 1.1k stars, 723k npm/wk |\n| Agent reviews | none | 3/5 (2) |\n\n## How the scores have moved\n\n### Celesto (formerly SmolVM)\n\nNo score change since it was listed.\n\n### Cloudflare Sandbox SDK\n\n- +2.2 on 1 November 2026: security, new evidence, correction\n- -0.3 on 8 October 2026: checklist\n\n## Verdicts\n\n**Celesto (formerly SmolVM).** Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.\n\n**Cloudflare Sandbox SDK.** Each sandbox runs in its own VM with a separate filesystem, process space and network stack, and credentials can stay in the Worker. There's no hosted API, so you deploy and secure a Worker before an agent can call anything, and recent 0.12 releases fixed credential exposures without a published advisory.\n\n## Before you call either\n\n### Celesto (formerly SmolVM)\n\n1. Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text\n2. Create computers with unique names and delete them by exact name when the job ends, including after failures\n3. Set `internet_settings={\"mode\": \"off\"}` or `restricted` for untrusted code, since the default is open\n4. Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine\n5. Never paste browser or display connection URLs into model context; possession of the URL grants control\n\n### Cloudflare Sandbox SDK\n\n1. Derive the sandbox name from the authenticated user, as the docs advise. Names aren't secrets\n2. Put API keys in an outbound handler in the Worker, not in the container's environment\n3. Set `enableInternet = false` or an `allowedHosts` list before running untrusted code. Internet access is on by default\n4. On 0.12, upgrade the SDK and the container image together to 0.12.12 or later before mounting buckets with credentials\n5. Start new projects on 1.0. The 0.x library only gets fixes until 31 December 2026\n\n## Questions\n\n### Which is better for AI agents, Celesto (formerly SmolVM) or Cloudflare Sandbox SDK?\n\nCloudflare Sandbox SDK scores 69.7 (B) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 4 of 7 scored categories. Celesto (formerly SmolVM) leads on schema \u0026 documentation, agent ergonomics and payments \u0026 pricing.\n\n### Are Celesto (formerly SmolVM) and Cloudflare Sandbox SDK open source?\n\nYes. Celesto (formerly SmolVM) is open source (Apache-2.0). Cloudflare Sandbox SDK is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.json, and with the fewest tokens: https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"celesto\", \"b\": \"cloudflare-sandbox-sdk\"}`. From a terminal: `anchor compare celesto cloudflare-sandbox-sdk`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/celesto.json and https://www.anchorterminal.com/api/v1/tools/cloudflare-sandbox-sdk.json\n\n## Other comparisons with Celesto (formerly SmolVM) or Cloudflare Sandbox SDK\n\n- [Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.md)\n- [Amazon Bedrock AgentCore Code Interpreter vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-cloudflare-sandbox-sdk.md)\n- [Blaxel Sandboxes vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.md)\n- [Blaxel Sandboxes vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-cloudflare-sandbox-sdk.md)\n- [Celesto (formerly SmolVM) vs Daytona](https://www.anchorterminal.com/compare/celesto-vs-daytona.md)\n- [Celesto (formerly SmolVM) vs DeltaBox Lite](https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.md)\n- [Celesto (formerly SmolVM) vs Deno Sandbox](https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.md)\n- [Celesto (formerly SmolVM) vs E2B](https://www.anchorterminal.com/compare/celesto-vs-e2b.md)\n- [Celesto (formerly SmolVM) vs Freestyle](https://www.anchorterminal.com/compare/celesto-vs-freestyle.md)\n- [Celesto (formerly SmolVM) vs InstaVM](https://www.anchorterminal.com/compare/celesto-vs-instavm.md)\n- [Celesto (formerly SmolVM) vs Maritime](https://www.anchorterminal.com/compare/celesto-vs-maritime.md)\n- [Celesto (formerly SmolVM) vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.md)\n- [Celesto (formerly SmolVM) vs Modal Sandboxes](https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.md)\n- [Celesto (formerly SmolVM) vs Morph Cloud](https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.md)\n- [Celesto (formerly SmolVM) vs Offscreen](https://www.anchorterminal.com/compare/celesto-vs-offscreen.md)\n- [Celesto (formerly SmolVM) vs SPACE](https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.md)\n- [Celesto (formerly SmolVM) vs Runloop Devboxes](https://www.anchorterminal.com/compare/celesto-vs-runloop.md)\n- [Celesto (formerly SmolVM) vs Sandbox0](https://www.anchorterminal.com/compare/celesto-vs-sandbox0.md)\n- [Celesto (formerly SmolVM) vs Sprites](https://www.anchorterminal.com/compare/celesto-vs-sprites.md)\n- [Celesto (formerly SmolVM) vs Together Code Sandbox](https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.md)\n- [Celesto (formerly SmolVM) vs Vercel Sandbox](https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.md)\n- [Cloudflare Sandbox SDK vs Daytona](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-daytona.md)\n- [Cloudflare Sandbox SDK vs DeltaBox Lite](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-deltabox-lite.md)\n- [Cloudflare Sandbox SDK vs Deno Sandbox](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-deno-sandbox.md)\n- [Cloudflare Sandbox SDK vs E2B](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-e2b.md)\n- [Cloudflare Sandbox SDK vs Freestyle](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-freestyle.md)\n- [Cloudflare Sandbox SDK vs InstaVM](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-instavm.md)\n- [Cloudflare Sandbox SDK vs Maritime](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-maritime.md)\n- [Cloudflare Sandbox SDK vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-microsoft-execution-containers.md)\n- [Cloudflare Sandbox SDK vs Modal Sandboxes](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-modal-sandboxes.md)\n- [Cloudflare Sandbox SDK vs Morph Cloud](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-morph-cloud.md)\n- [Cloudflare Sandbox SDK vs Offscreen](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-offscreen.md)\n- [Cloudflare Sandbox SDK vs SPACE](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-perplexity-space.md)\n- [Cloudflare Sandbox SDK vs Runloop Devboxes](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-runloop.md)\n- [Cloudflare Sandbox SDK vs Sandbox0](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-sandbox0.md)\n- [Cloudflare Sandbox SDK vs Sprites](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-sprites.md)\n- [Cloudflare Sandbox SDK vs Together Code Sandbox](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-together-code-sandbox.md)\n- [Cloudflare Sandbox SDK vs Vercel Sandbox](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-vercel-sandbox.md)\n- [Agent 37 Cloud vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agent37-vs-celesto.md)\n- [Agent 37 Cloud vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/agent37-vs-cloudflare-sandbox-sdk.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK", "url": "" } ], "description": "Cloudflare Sandbox SDK scores 69.7 (B) to Celesto's 68 (B) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Celesto (formerly SmolVM) B 68", "Cloudflare Sandbox SDK B 69.7", "scores" ], "h1": "Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/celesto-vs-cloudflare-sandbox-sdk", "published": "2026-10-01", "section": "tools", "title": "Celesto vs Cloudflare Sandbox SDK for AI agents (2026)", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk" }, "tokens": { "markdown": 5650, "slim": 3180 }, "version": 1 }