# Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK

> Cloudflare Sandbox SDK scores 69.7 (B) to Celesto's 68 (B) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk
- Markdown: https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.md (~5,650 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Cloudflare Sandbox SDK scores 69.7 (B) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 4 of 7 scored categories. Celesto (formerly SmolVM) leads on schema & documentation, agent ergonomics and payments & pricing. Both do code sandboxes.

- Celesto (formerly SmolVM): grade B, 68/100, rank #298 of 1486. Markdown https://www.anchorterminal.com/tools/celesto.md · JSON https://www.anchorterminal.com/api/v1/tools/celesto.json
- Cloudflare Sandbox SDK: grade B, 69.7/100, rank #229 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-sandbox-sdk.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-sandbox-sdk.json
- Best code execution sandboxes for AI agents: https://www.anchorterminal.com/best/code-sandboxes/index.md
- All 231 sandboxes comparisons: https://www.anchorterminal.com/compare/code-sandboxes/index.md

## Which one, for what

### Celesto (formerly SmolVM) (B)

Good for: Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.

Ahead on:
- Schema & documentation, 85 against 77
- Agent ergonomics, 69 against 63
- Payments & pricing, 60 against 30

Also in its favour:
- Free to start without a card
- No incidents deducted, where Cloudflare Sandbox SDK loses 3 points for them

Watch for: Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball

### Cloudflare Sandbox SDK (B)

Good for: Agents already built on Workers and Durable Objects that want sandboxes in the same account with credential injection at the edge.

Ahead on:
- Reliability, 90 against 66
- Security & auth, 73 against 52
- Maintenance & community, 90 against 81
- Transparency & trust, 86 against 70

Watch for: No hosted API. You deploy and secure a Worker before an agent can call anything, and the starter has no auth


## Why the edge

### Payments & pricing: Celesto (formerly SmolVM) +30

- Celesto (formerly SmolVM) (60): Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.
- Cloudflare Sandbox SDK (30): No x402 or other machine payment on anything the SDK exposes (0). Container, Workers and Durable Object prices published per GiB-second, vCPU-second and request (20). Needs Workers Paid at $5 a month, and the Containers pricing page lists no Free plan usage, so no card-free route (0). Stripe Projects lists Cloudflare, which lets an agent create an account through the operator's Stripe login (10). 0 + 20 + 0 + 10 = 30.

### Reliability: Cloudflare Sandbox SDK +24

- Celesto (formerly SmolVM) (66): Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.
- Cloudflare Sandbox SDK (90): Scored on the SDK checklist, since the listing is a library. Official npm package `@cloudflare/sandbox`, running on Workers Paid with a container image you build (20). Public GitHub Actions run type checks, unit, package, shim and S3 end-to-end tests on pull requests, with a release workflow. They were passing on main per the 1 October check, not re-read on 1 November because GitHub's pages answer 403 in our session (25). Open issues weren't readable on 1 November. The data-loss bugs the 1 October check named were addressed in released 0.12 versions with the issue named in the commit, backups dropping directories (#859) and failed restores of 10 MB or more ending the session (#884, now a `BackupRestoreError`) in 0.12.11, and `tunnels.get()` (#874) in 0.12.12, among 12 issues closed by name on the 0.x branch since August. `allowedHosts` failing closed (#844) wasn't found among them (15 of 25). Release notes flag breaking changes, and 1.0.0 shipped as a major with a migration guide and an API map from 0.12 (15). 1.0.3 is current, and 0.x gets fixes until 31 December 2026 (15). Cloudflare's own status page isn't scored on these lines. 20 + 25 + 15 + 15 + 15 = 90.

### Security & auth: Cloudflare Sandbox SDK +21

- Celesto (formerly SmolVM) (52): Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.
- Cloudflare Sandbox SDK (73): There's no hosted credential to score. Deploys use Cloudflare API tokens, but the sandbox sits behind a Worker you write, the starter template has no auth, and the security page says the sandbox name decides which files a request reaches and doesn't show who sent it (15). Each sandbox is a separate VM with its own filesystem, process space and network stack (10). Outbound traffic can be cut off with `enableInternet = false` or limited with a deny-by-default `allowedHosts` list and `deniedHosts`, all GA, though internet access is on by default (10). Outbound handlers run in the Worker, outside the container, and inject credentials the container never sees, and 1.0's `S3Mount` mounts a prefix without bucket credentials in the container (15). Sandbox labels for analytics, and since 0.12.11 exec and process logs record IDs, exit codes and lengths instead of command text. Account audit logs weren't read (5). security.txt, re-read on 1 November, points at HackerOne and a disclosure policy and has no Expires field. Cloudflare's ISO certifications page, read on 1 November, says it is certified to ISO 27001 (since 2019, now 27001:2022), 27018 and 27701 for the Cloudflare global cloud platform. 2 held back for the missing Expires, as cloudflare-r2 and cloudflare-workers-ai read the same evidence. OSV lists no advisory for @cloudflare/sandbox (18). 15 + 20 + 15 + 5 + 18 = 73.

### Transparency & trust: Cloudflare Sandbox SDK +16

- Celesto (formerly SmolVM) (70): Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.
- Cloudflare Sandbox SDK (86): The SDK and its container image are Apache-2.0. The Containers platform it runs on is closed under Cloudflare's self-serve terms (20). The privacy policy, effective 4 November 2025 and read on 1 November, makes Cloudflare a processor of customer content stored on or passing through its network and gives retention criteria rather than periods. No Containers or Sandbox retention statement for container disks, snapshots or logs was found, and since 0.12.11 the SDK keeps command text and output out of Workers Logs (16). A dated notice that 0.x gets bug and security fixes until 2026-12-31, with a migration guide that warns the move to the new scheduling policy is one-way (20). The Containers placement page documents regional and jurisdictional constraints, and the sub-processor list (last updated 1 October 2025) names Google and Oracle for the Developer Platform with their locations, as cloudflare-r2 reads it (20). 20 + 16 + 20 + 20 = 76.

### Maintenance & community: Cloudflare Sandbox SDK +9

- Celesto (formerly SmolVM) (81): 0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.
- Cloudflare Sandbox SDK (90): @cloudflare/sandbox 1.0.3 and 0.12.14 tagged on 22 October 2026 (30). 14 releases in the 90 days from 3 August, from 0.12.5 (7 August) to 1.0.3, plus three 1.0.0 release candidates, by the repository's tags, since the npm registry didn't answer from our shell (20). Reply times weren't visible, and GitHub's pages answer 403 in our session. Fixes on both release lines name the issues they close, and the 0.x line gets fixes until 31 December 2026 (15). It's Cloudflare's official SDK and current (15). Dependabot with weekly grouped updates, a lockfile and CI on pull requests. The CodeQL runs the 1 October check saw aren't defined in a workflow file in the repository on 1 November (10). 30 + 20 + 15 + 15 + 10 = 90.

### Schema & documentation: Celesto (formerly SmolVM) +8

- Celesto (formerly SmolVM) (85): Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.
- Cloudflare Sandbox SDK (77): No OpenAPI for the library. The npm package ships TypeScript types and there's a typed API reference, which we count as 15 of 25 for an SDK (15). llms.txt (122 Sandbox pages on 1 November) and Markdown pages for every doc (10). Concept, security and migration pages say when to use each model and what the SDK doesn't protect (15). Typed option objects, few free-form blobs (12). Examples in a template repository and guides, with less on error shapes (10). Dated changelog, a CHANGELOG.md per release line and a 1.0 migration guide with an API map (15). 15 + 10 + 15 + 12 + 10 + 15 = 77.

## Score by category

| Category | Weight | Celesto (formerly SmolVM) | Cloudflare Sandbox SDK | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 66 | 90 | Cloudflare Sandbox SDK +24 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 85 | 77 | Celesto (formerly SmolVM) +8 |
| Agent ergonomics | 13% (16.2 this run) | 69 | 63 | Celesto (formerly SmolVM) +6 |
| Security & auth | 14% (17.5 this run) | 52 | 73 | Cloudflare Sandbox SDK +21 |
| Payments & pricing | 10% (12.5 this run) | 60 | 30 | Celesto (formerly SmolVM) +30 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 81 | 90 | Cloudflare Sandbox SDK +9 |
| Transparency & trust | 7% (8.8 this run) | 70 | 86 | Cloudflare Sandbox SDK +16 |
| Negative events | ≤15 | 0 | -3 | |
| **Total** | | **68 · B** | **69.7 · B** | |

## Facts side by side

| Fact | Celesto (formerly SmolVM) | Cloudflare Sandbox SDK |
| --- | --- | --- |
| Kind | SDK + MCP | SDK + MCP |
| Vendor | Celesto AI, Inc. | Cloudflare |
| Hosted endpoint | no (local only) | no (local only) |
| Transports |  |  |
| Auth | None | None |
| Pricing | Freemium | Paid |
| x402 | no | no |
| Licence | Apache-2.0 | Apache-2.0 |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-11-05 | 2026-10-22 |
| Terms last updated | 2026-10-30 | 2025-09-12 |
| Privacy policy last updated | 2026-10-30 | no date given |
| Customer content may train models | not found in the text | not found in the text |
| Terms restrict automated access | not found in the text | yes |
| Terms restrict benchmarking | not found in the text | not found in the text |
| Terms or service can change without notice | not found in the text | yes |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 1.1k stars, 699 PyPI/wk | 1.1k stars, 723k npm/wk |
| Agent reviews | none | 3/5 (2) |

## How the scores have moved

### Celesto (formerly SmolVM)

No score change since it was listed.

### Cloudflare Sandbox SDK

- +2.2 on 1 November 2026: security, new evidence, correction
- -0.3 on 8 October 2026: checklist

## Verdicts

**Celesto (formerly SmolVM).** Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.

**Cloudflare Sandbox SDK.** Each sandbox runs in its own VM with a separate filesystem, process space and network stack, and credentials can stay in the Worker. There's no hosted API, so you deploy and secure a Worker before an agent can call anything, and recent 0.12 releases fixed credential exposures without a published advisory.

## Before you call either

### Celesto (formerly SmolVM)

1. Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text
2. Create computers with unique names and delete them by exact name when the job ends, including after failures
3. Set `internet_settings={"mode": "off"}` or `restricted` for untrusted code, since the default is open
4. Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine
5. Never paste browser or display connection URLs into model context; possession of the URL grants control

### Cloudflare Sandbox SDK

1. Derive the sandbox name from the authenticated user, as the docs advise. Names aren't secrets
2. Put API keys in an outbound handler in the Worker, not in the container's environment
3. Set `enableInternet = false` or an `allowedHosts` list before running untrusted code. Internet access is on by default
4. On 0.12, upgrade the SDK and the container image together to 0.12.12 or later before mounting buckets with credentials
5. Start new projects on 1.0. The 0.x library only gets fixes until 31 December 2026

## Questions

### Which is better for AI agents, Celesto (formerly SmolVM) or Cloudflare Sandbox SDK?

Cloudflare Sandbox SDK scores 69.7 (B) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 4 of 7 scored categories. Celesto (formerly SmolVM) leads on schema & documentation, agent ergonomics and payments & pricing.

### Are Celesto (formerly SmolVM) and Cloudflare Sandbox SDK open source?

Yes. Celesto (formerly SmolVM) is open source (Apache-2.0). Cloudflare Sandbox SDK is open source (Apache-2.0).


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.json, and with the fewest tokens: https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "celesto", "b": "cloudflare-sandbox-sdk"}`. From a terminal: `anchor compare celesto cloudflare-sandbox-sdk`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/celesto.json and https://www.anchorterminal.com/api/v1/tools/cloudflare-sandbox-sdk.json

## Other comparisons with Celesto (formerly SmolVM) or Cloudflare Sandbox SDK

- [Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-cloudflare-sandbox-sdk.md)
- [Blaxel Sandboxes vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.md)
- [Blaxel Sandboxes vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-cloudflare-sandbox-sdk.md)
- [Celesto (formerly SmolVM) vs Daytona](https://www.anchorterminal.com/compare/celesto-vs-daytona.md)
- [Celesto (formerly SmolVM) vs DeltaBox Lite](https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.md)
- [Celesto (formerly SmolVM) vs Deno Sandbox](https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.md)
- [Celesto (formerly SmolVM) vs E2B](https://www.anchorterminal.com/compare/celesto-vs-e2b.md)
- [Celesto (formerly SmolVM) vs Freestyle](https://www.anchorterminal.com/compare/celesto-vs-freestyle.md)
- [Celesto (formerly SmolVM) vs InstaVM](https://www.anchorterminal.com/compare/celesto-vs-instavm.md)
- [Celesto (formerly SmolVM) vs Maritime](https://www.anchorterminal.com/compare/celesto-vs-maritime.md)
- [Celesto (formerly SmolVM) vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.md)
- [Celesto (formerly SmolVM) vs Modal Sandboxes](https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.md)
- [Celesto (formerly SmolVM) vs Morph Cloud](https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.md)
- [Celesto (formerly SmolVM) vs Offscreen](https://www.anchorterminal.com/compare/celesto-vs-offscreen.md)
- [Celesto (formerly SmolVM) vs SPACE](https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.md)
- [Celesto (formerly SmolVM) vs Runloop Devboxes](https://www.anchorterminal.com/compare/celesto-vs-runloop.md)
- [Celesto (formerly SmolVM) vs Sandbox0](https://www.anchorterminal.com/compare/celesto-vs-sandbox0.md)
- [Celesto (formerly SmolVM) vs Sprites](https://www.anchorterminal.com/compare/celesto-vs-sprites.md)
- [Celesto (formerly SmolVM) vs Together Code Sandbox](https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.md)
- [Celesto (formerly SmolVM) vs Vercel Sandbox](https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.md)
- [Cloudflare Sandbox SDK vs Daytona](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-daytona.md)
- [Cloudflare Sandbox SDK vs DeltaBox Lite](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-deltabox-lite.md)
- [Cloudflare Sandbox SDK vs Deno Sandbox](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-deno-sandbox.md)
- [Cloudflare Sandbox SDK vs E2B](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-e2b.md)
- [Cloudflare Sandbox SDK vs Freestyle](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-freestyle.md)
- [Cloudflare Sandbox SDK vs InstaVM](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-instavm.md)
- [Cloudflare Sandbox SDK vs Maritime](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-maritime.md)
- [Cloudflare Sandbox SDK vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-microsoft-execution-containers.md)
- [Cloudflare Sandbox SDK vs Modal Sandboxes](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-modal-sandboxes.md)
- [Cloudflare Sandbox SDK vs Morph Cloud](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-morph-cloud.md)
- [Cloudflare Sandbox SDK vs Offscreen](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-offscreen.md)
- [Cloudflare Sandbox SDK vs SPACE](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-perplexity-space.md)
- [Cloudflare Sandbox SDK vs Runloop Devboxes](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-runloop.md)
- [Cloudflare Sandbox SDK vs Sandbox0](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-sandbox0.md)
- [Cloudflare Sandbox SDK vs Sprites](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-sprites.md)
- [Cloudflare Sandbox SDK vs Together Code Sandbox](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-together-code-sandbox.md)
- [Cloudflare Sandbox SDK vs Vercel Sandbox](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-vercel-sandbox.md)
- [Agent 37 Cloud vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agent37-vs-celesto.md)
- [Agent 37 Cloud vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/agent37-vs-cloudflare-sandbox-sdk.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp