{ "data": { "a": { "slug": "celesto", "name": "Celesto (formerly SmolVM)", "vendor": "Celesto AI, Inc.", "vendorUrl": "https://celesto.ai", "kind": "sdk", "category": "code-sandboxes", "summary": "Celesto, formerly SmolVM, is an open-source Python SDK and CLI from Celesto AI that runs disposable Firecracker or QEMU microVMs on the owner's machine for agent code, browsers and desktops, with an optional paid Celesto Cloud.", "url": "https://www.anchorterminal.com/tools/celesto", "markdownUrl": "https://www.anchorterminal.com/tools/celesto.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/celesto.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/celesto.json", "dns": "celesto.grade.anchorterminal.com", "repo": "https://github.com/CelestoAI/Celesto", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "pypi", "name": "celesto" } ], "auth": "none", "authNotes": "Local use needs no account or key. The local API server and dashboard each require a bearer token, generated at start or read from CELESTO_SERVER_TOKEN and CELESTO_DASHBOARD_TOKEN. Celesto Cloud uses an organisation-bound CELESTO_API_KEY with named permissions (see, execute, delete) set in the dashboard.", "pricing": "freemium", "pricingNotes": "The local SDK and CLI are free under Apache-2.0. Celesto Cloud bills sandboxes by the running hour from $0.015 (Micro, 1 vCPU, 2 GB) to $0.16 (XL, 8 vCPU, 32 GB), prepaid from $2.01, with a one-time $5 Micro credit and no card.", "priceSummary": "$0.015 / session-hr", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the repository, the docs, llms.txt or the pricing page (checked 2026-11-06). Cloud runtime is prepaid by card under Settings \u003e Billing.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1149, "npmWeekly": null, "pypiWeekly": 699, "asOf": "2026-11-06" }, "docsUrl": "https://celesto.ai/docs", "llmsTxt": "https://celesto.ai/llms.txt", "openapi": "https://github.com/CelestoAI/Celesto/blob/main/ts/celesto-local-server.openapi.json", "capabilities": [ "sandbox.code", "sandbox.fs", "sandbox.persist", "sandbox.browser" ], "tags": [ "open-source", "local", "self-hosted", "hosted", "freemium", "no-card", "free-tier", "apache-2.0", "python", "typescript", "cli", "microvm", "firecracker", "llms-txt", "openapi", "telemetry", "pre-1.0", "renamed" ], "lastRelease": "2026-11-05", "graded": true, "anchor": { "graded": true, "score": 68, "grade": "B", "agentReady": false, "rank": 298, "ranked": true, "rankOf": 1486, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 81, "payments": 60, "reliability": 66, "schema": 85, "security": 52, "transparency": 70 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.", "bestFor": "Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.", "strengths": [ "Apache-2.0, installs from PyPI with `celesto setup` and `celesto doctor`, and runs local microVMs with no account or key", "Every `--json` response has the same `ok`, `command`, `exit_code`, `data` and `error` fields, with recovery commands in errors", "Network modes `off`, `public` (proxy that rejects private and metadata addresses) and `restricted` with CIDR or domain allowlists", "Dated changelog with Security sections, breaking changes marked, and 22 PyPI releases in the 90 days to 6 November 2026", "OpenAPI documents for the local server (24 operations) and the cloud API (171 operations) in the repository, plus llms.txt" ], "weaknesses": [ "Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball", "Outbound network access is open by default, and Linux TAP mode does not block every private network or metadata service", "Usage telemetry to PostHog is on after a first-use notice, until switched off", "Renamed from SmolVM on 19 September 2026 in a breaking release that removed the `smolvm` command and import path", "No security.txt, bug bounty or certification found, and CI results could not be read" ], "agentNotes": [ "Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text", "Create computers with unique names and delete them by exact name when the job ends, including after failures", "Set `internet_settings={\"mode\": \"off\"}` or `restricted` for untrusted code, since the default is open", "Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine", "Never paste browser or display connection URLs into model context; possession of the URL grants control" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68 } ], "editorialScores": { "ergonomics": 69, "maintenance": 81, "payments": 60, "reliability": 66, "schema": 85, "security": 52, "transparency": 74 }, "provenanceScore": 66, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install celesto \u0026\u0026 celesto setup \u0026\u0026 celesto doctor", "headless": { "create": "celesto computer create --name agent-job --json", "delete": "celesto computer delete agent-job --json", "exec": "celesto computer exec agent-job --json -- python -m pytest" } }, "letme": { "capability": "https://letme.dev/sandbox.code", "tool": "https://letme.dev/celesto" }, "area": "agent-runtime", "unitPrices": [ { "item": "Cloud Micro sandbox (1 vCPU, 2 GB)", "unit": "session-hour", "usd": 0.015, "note": "Billed by the running hour; local use is free" }, { "item": "Cloud XL sandbox (8 vCPU, 32 GB)", "unit": "session-hour", "usd": 0.16, "note": "Largest size on the pricing page" } ], "provenance": { "legalEntity": "Celesto AI, Inc.", "domain": "celesto.ai", "domainRegistered": "2025-07-13", "endpointOnVendorDomain": null, "terms": "https://celesto.ai/legal/terms", "privacy": "https://celesto.ai/legal/privacy-policy", "statusPage": "", "changelog": "https://github.com/CelestoAI/Celesto/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The privacy policy, last updated 30 October 2026, names Celesto AI, Inc., a Delaware corporation with a Wilmington mailing address. It has no clause on automated access.", "celesto.ai/robots.txt allows all crawlers. docs.celesto.ai carries Content-Signal ai-train=yes, search=yes, ai-input=yes.", "RDAP gives celesto.ai a registration date of 13 July 2025.", "/.well-known/security.txt returns 404. SECURITY.md asks for private reports through GitHub's vulnerability reporting. No status page is linked from the pricing page." ], "score": 66 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/celesto.json", "live": { "slug": "celesto", "versions": [ { "registry": "github", "name": "CelestoAI/Celesto", "version": "v0.1.13", "released": "2026-11-05", "seenAt": "2026-11-06T23:13:37.416837168Z" }, { "registry": "pypi", "name": "celesto", "version": "0.1.13", "released": "2026-11-05", "seenAt": "2026-11-06T23:13:37.309276304Z" } ], "githubStars": 1149, "pypiWeekly": 699, "securityTxt": { "url": "https://celesto.ai/.well-known/security.txt", "state": "unknown", "checkedAt": "2026-11-07T16:01:01.176888246Z" }, "llmsTxt": { "url": "https://celesto.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:46.784166983Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/CelestoAI/Celesto/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:18:00.719411253Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8ddae4a6adbd" }, { "url": "https://celesto.ai/legal/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:00:50.868104256Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "87ce310b1db6" }, { "url": "https://celesto.ai/legal/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:00:53.107282947Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1dece6f9a42e" } ], "updatedAt": "2026-11-07T16:01:01.176888246Z" } }, "answer": "Celesto (formerly SmolVM) and Daytona score within a point of each other on agent readiness, 68 (B) and 67.7 (B). Daytona leads on reliability and security \u0026 auth.", "b": { "slug": "daytona", "name": "Daytona", "vendor": "Daytona", "vendorUrl": "https://www.daytona.io", "kind": "http-api", "category": "code-sandboxes", "summary": "Sandboxes for agent code in container, Linux VM, Windows and GPU classes, driven by SDKs for Python, TypeScript, Ruby, Go and Java or a REST API.", "url": "https://www.anchorterminal.com/tools/daytona", "markdownUrl": "https://www.anchorterminal.com/tools/daytona.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/daytona.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/daytona.json", "dns": "daytona.grade.anchorterminal.com", "repo": "https://github.com/daytona/clients", "license": "Apache-2.0 (SDKs and API clients), AGPL-3.0 (CLI)", "transports": [ "http", "stdio" ], "remoteUrl": "https://app.daytona.io/api", "packages": [ { "registry": "pypi", "name": "daytona" }, { "registry": "npm", "name": "@daytona/sdk" } ], "auth": "api-key", "authNotes": "Bearer API key in the `Authorization` header. The SDKs read `DAYTONA_API_KEY`, `DAYTONA_API_URL` (default https://app.daytona.io/api) and `DAYTONA_TARGET` (us or eu). Keys take scopes, so an agent's key can have `write:sandboxes` without `delete:sandboxes`. The MCP server uses the CLI session from `daytona login`.", "pricing": "usage", "pricingNotes": "Billed per second. $0.0504 a vCPU-hour, $0.0162 a GiB-hour of memory and $0.000108 a GiB-hour of storage after the first 5 GiB, Windows $0.0858 a vCPU-hour. GPUs from $0.57 an hour (RTX 4090, preemptible) to $6.25 (B300 or B200, on demand), with H100 at $2.27 preemptible or $3.95 on demand. $200 of free compute without a card, and up to $50,000 in startup credits (https://www.daytona.io/pricing). Higher limits unlock with a linked card and a $25 top-up (Tier 2), a $500 top-up (Tier 3) or $2,000 every 30 days (Tier 4) (https://www.daytona.io/docs/en/limits.md).", "priceSummary": "$0.0504 / vCPU-hr", "where": "both", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 6, "npmWeekly": 705790, "pypiWeekly": 1406178, "asOf": "2026-09-30" }, "docsUrl": "https://www.daytona.io/docs", "llmsTxt": "https://www.daytona.io/docs/llms.txt", "openapi": "https://www.daytona.io/docs/openapi.json", "capabilities": [ "sandbox.code", "sandbox.fs", "sandbox.persist", "sandbox.browser", "sandbox.gpu" ], "tags": [ "hosted", "no-card", "mcp", "openapi", "llms-txt", "python", "typescript", "go", "eu", "enterprise" ], "lastRelease": "2026-10-29", "graded": true, "anchor": { "graded": true, "score": 67.7, "grade": "B", "agentReady": false, "rank": 309, "ranked": true, "rankOf": 1486, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 55, "maintenance": 80, "payments": 50, "reliability": 85, "schema": 87, "security": 73, "transparency": 64 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-02" }, "negative": -4, "negativeNotes": [ "-4 for four advisories Daytona published against its platform code in June 2026, each fixed, counted per advisory as this run reads them. GHSA-qxvm-pcfm-qc39 (High, cross-organisation role update and delete, fixed in 0.185.0 of 9 June, published 16 June) and GHSA-ww63-pv5x-vfc8 (High, previews reachable after being made private, fixed in 0.184.0 of 3 June, published 16 June) cost 1 each as fixed Highs over two months old. GHSA-qwxf-2m7m-2m3x (Moderate, cross-tenant notification events, fixed in 0.185.0, published 17 June) and GHSA-fjv8-j4p5-cr9m (Moderate, volume path traversal, fixed in 0.186.0 of 10 June, published 18 June) cost 1 each as Moderates the vendor published itself (https://api.osv.dev/v1/vulns/GHSA-qxvm-pcfm-qc39)" ], "verdict": "API keys with per-action scopes let an agent create sandboxes without deleting them, and an SLA commits to 99.95% uptime. The container class shares the host kernel, only VM classes get their own, and Daytona fixed two High cross-tenant flaws in June 2026.", "bestFor": "Agents that need a choice of machine, including Windows desktops and GPUs, and operators who want least-privilege keys.", "strengths": [ "API keys with per-action scopes, so an agent can create sandboxes without being able to delete them", "Container, Linux VM, Windows and GPU sandbox classes behind one API", "Three public OpenAPI files, llms.txt and SDKs in five languages", "Rate limits published per tier, with Retry-After and rate-limit headers on 429s", "SLA of 99.95% monthly uptime, and $200 of compute without a card, billed per second" ], "weaknesses": [ "The container class shares the host kernel. Only the VM classes get their own", "Full internet access and per-sandbox allow lists need Tier 3", "Platform code went private in June 2026, and the old repository's issues won't be answered", "Four advisories in June 2026, two of them High cross-tenant flaws, all fixed", "No security.txt, and SLA service credits apply only from Tier 4" ], "agentNotes": [ "Pick a Linux VM class for untrusted code or when memory must survive a pause. Container sandboxes stop and archive instead", "Set autoStopInterval yourself. The 15-minute idle default can stop a sandbox while the agent is still thinking", "Give the agent a key without `delete:sandboxes` if it shouldn't destroy work", "Read `Retry-After-{throttler}` on a 429 before retrying sandbox creation", "Check the organisation's tier before relying on outbound calls from inside the sandbox" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.7 } ], "editorialScores": { "ergonomics": 55, "maintenance": 80, "payments": 50, "reliability": 85, "schema": 87, "security": 73, "transparency": 55 }, "provenanceScore": 73, "checked": { "categories": { "ergonomics": "2026-11-02", "maintenance": "2026-11-02", "payments": "2026-11-02", "reliability": "2026-11-02", "schema": "2026-11-02", "security": "2026-11-02", "transparency": "2026-11-02" }, "last": "2026-11-02", "lastMoved": "2026-11-02", "oldest": "2026-11-02", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install daytona # or npm i @daytona/sdk", "http": "curl -X POST https://app.daytona.io/api/sandbox -H \"Authorization: Bearer $DAYTONA_API_KEY\" \\\n -H \"Content-Type: application/json\" -d '{}'", "claudeCode": "claude mcp add daytona -- daytona mcp start", "config": { "mcpServers": { "daytona": { "args": [ "mcp", "start" ], "command": "daytona" } } } }, "letme": { "capability": "https://letme.dev/sandbox.code", "tool": "https://letme.dev/daytona" }, "area": "agent-runtime", "unitPrices": [ { "item": "vCPU", "unit": "vcpu-hour", "usd": 0.0504, "note": "Memory extra at $0.0162 a GiB-hour" }, { "item": "Nvidia H100, on demand", "unit": "gpu-hour", "usd": 3.95 }, { "item": "Nvidia H100, preemptible", "unit": "gpu-hour", "usd": 2.27 }, { "item": "Nvidia RTX 4090, preemptible", "unit": "gpu-hour", "usd": 0.57 } ], "provenance": { "legalEntity": "Daytona Platforms Inc.", "domain": "daytona.io", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.daytona.io/terms-of-service", "privacy": "https://www.daytona.io/privacy-policy", "statusPage": "https://status.app.daytona.io", "changelog": "https://www.daytona.io/changelog", "securityTxt": "none", "checked": "2026-11-02", "notes": [ "Terms and privacy policy (both updated 22 August 2025) name Daytona Platforms Inc., 224 W 35th St, New York, under Delaware law, per the 1 October check; their dates were re-read on 2 November.", "The Better Stack status page lists, within the 90 days from 4 August, a 17.5-hour degradation of sandbox creation in us-central-1 (11 August), sandbox listing degradations on 1 and 30 October and a provider outage on a subset of US runners (29 and 30 October). The Windows runner outages of 31 July and 1 August have left the window.", "www.daytona.io/.well-known/security.txt returns 404 (2 November). Security reports go to security@daytona.io or GitHub private reporting under the organisation-wide policy in daytona/.github.", "The .io registry's RDAP server rate-limited our lookups, so the registration date is blank." ], "score": 73 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/daytona.json", "live": { "slug": "daytona", "probe": { "target": "https://app.daytona.io/api", "method": "get", "lastAt": "2026-11-07T18:20:20.159647273Z", "lastOk": true, "lastStatus": 200, "lastMs": 106, "authRequired": false, "uptime24h": 100, "uptime30d": 99.97, "p50ms24h": 109, "p95ms24h": 255, "samples24h": 239, "samples30d": 7910, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 248, "ok": 248 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 246 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.app.daytona.io", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:47:36.346172975Z" }, "versions": [ { "registry": "github", "name": "daytona/clients", "version": "v0.230.0", "released": "2026-11-05", "seenAt": "2026-11-06T23:19:42.858959894Z" }, { "registry": "npm", "name": "@daytona/sdk", "version": "0.230.0", "seenAt": "2026-11-06T23:19:42.649696712Z" }, { "registry": "pypi", "name": "daytona", "version": "0.230.0", "released": "2026-11-05", "seenAt": "2026-11-06T23:19:42.50209547Z" } ], "githubStars": 16, "npmWeekly": 779388, "pypiWeekly": 2107075, "securityTxt": { "url": "https://daytona.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:37.747695845Z" }, "llmsTxt": { "url": "https://www.daytona.io/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:15.197707723Z" }, "domain": { "domain": "daytona.io", "checkedAt": "2026-11-01T14:13:53.133286817Z" }, "pages": [ { "url": "https://www.daytona.io/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:27:44.839950372Z", "changedAt": "2026-11-03T08:05:04.130824813Z", "fingerprint": "38263ab83cc6" }, { "url": "https://www.daytona.io/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:27:48.576765907Z", "changedAt": "2026-11-07T14:27:48.576765907Z", "fingerprint": "54f8d86ac2f8" }, { "url": "https://www.daytona.io/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:27:49.415466611Z", "changedAt": "2026-11-07T14:27:49.415466611Z", "fingerprint": "ea50f775171a" }, { "url": "https://www.daytona.io/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:27:51.432445461Z", "changedAt": "2026-11-07T14:27:51.432445461Z", "fingerprint": "ff72664275f0" } ], "github": { "repo": "daytona/clients", "checkedAt": "2026-11-02T08:43:16.232314341Z", "stars": 16, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T08:24:31Z", "openIssues": 11, "openPRs": 8, "issuesOpened90d": 25, "issuesClosed90d": 14, "prsMerged90d": 152, "ci": { "branch": "main", "runs": 50, "success": 49, "failure": 0, "other": 1, "latest": "success", "latestAt": "2026-11-02T07:16:11Z" }, "replies": { "sampled": 25, "unanswered": 10, "medianDays": 2.6 } }, "updatedAt": "2026-11-07T18:20:20.159647273Z" } }, "edges": [ { "by": 21, "category": "security", "leads": "daytona", "name": "Security \u0026 auth", "reasons": { "a": "Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.", "b": "API keys with per-action scopes (`write:sandboxes` separate from `delete:sandboxes`, plus snapshot, volume, audit, secret and billing scopes), an expiry date and immediate revocation, and manager keys that issue scoped child keys at runtime. The docs say any valid key in the organisation can reach a running sandbox whatever its scopes, so 27 of 30 (27). Container sandboxes get their own namespaces and resource limits on a shared kernel, while Linux VM and Windows classes get their own kernel (6). Tier 1 and 2 organisations get restricted network access that can't be changed per sandbox, and full internet with per-sandbox allow lists starts at Tier 3 (5). We found nothing on keeping credentials out of the sandbox or on running untrusted code (5). Audit logs behind their own key scope, log streaming and webhooks (15). An organisation-wide security policy (security@daytona.io or GitHub private reporting, acknowledgement within 5 business days, discretionary rewards) covers app.daytona.io and the clients repository. The SafeBase trust centre lists SOC 2 Type 1 and Type 2, ISO/IEC 27001 and HIPAA, with reports and a pen-test summary on request. Four advisories were published on GitHub in June 2026. No security.txt (404 on 2 November), and a discretionary reward doesn't count as a bounty. Read as modal-sandboxes' 15 (15). 27 + 6 + 5 + 5 + 15 + 15 = 73." }, "scores": { "a": 52, "b": 73 } }, { "by": 19, "category": "reliability", "leads": "daytona", "name": "Reliability", "reasons": { "a": "Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.", "b": "Better Stack status page at status.app.daytona.io with per-service history, read from its RSS feed and incident pages on 2 November (20). The two Windows runner outages (31 July and 1 August) have left the 90 days from 4 August. The window holds a degradation of new sandbox creation in us-central-1 (11 August, 17.5 hours), elevated creation errors for 4 minutes (4 September), a builder queue backlog (12 September), sandbox listing degraded on 1 and 30 October, reduced GPU capacity (16 October), some dashboard settings unavailable (22 October) and a provider outage on a subset of US runners (29 and 30 October). Each is one region, one endpoint or a subset of runners, so partial and minor (20). Rate limits published per tier, 10,000 to 50,000 general requests and 300 to 600 sandbox creations a minute (15). 429s carry `Retry-After-{throttler}` and `X-RateLimit-*` headers, and the docs advise exponential backoff (1s, 2s, 4s, 8s). No idempotency keys found (10). An SLA page (last updated 22 August 2025) commits to 99.95% monthly uptime with service credits for Tier 4 and above (10). GA (10). 20 + 20 + 15 + 10 + 10 + 10 = 85." }, "scores": { "a": 66, "b": 85 } }, { "by": 14, "category": "ergonomics", "leads": "celesto", "name": "Agent ergonomics", "reasons": { "a": "A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). `computer list`, `logs --follow` and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). `with Computer()` creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.", "b": "List and toolbox calls return whole objects or files, with no field selection found (15). Labels and list calls exist, but we didn't confirm documented filters or page sizes (10). JSON errors with `statusCode`, `message` and `error`, plus rate-limit headers, and since 0.220.0 the SDKs report queue timeouts and spot evictions as distinct errors (15). No idempotency keys or safe-retry guidance for creates found (0). SDKs in Python, TypeScript, Ruby, Go and Java, and a create call works with an empty body, though the 15-minute auto-stop default can stop a sandbox mid-task (15). We scored the API, not the local MCP server. Total 55." }, "scores": { "a": 69, "b": 55 } }, { "by": 10, "category": "payments", "leads": "celesto", "name": "Payments \u0026 pricing", "reasons": { "a": "Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.", "b": "No x402, MPP or L402 (0). Per-second prices published per vCPU, GiB of memory, GiB of storage and GPU, re-read on 2 November (20). $200 of compute, \"no credit card required\" (20). Stripe Projects lists Daytona, so an agent can create the account through the operator's Stripe login, per the 1 October check (10). Total 50." }, "scores": { "a": 60, "b": 50 } }, { "by": 6, "category": "transparency", "leads": "celesto", "name": "Transparency \u0026 trust", "reasons": { "a": "Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.", "b": "SDKs and API clients are Apache-2.0 and the CLI is AGPL-3.0, but the platform code went private in June 2026 (20). Privacy policy and terms (both updated 22 August 2025) and a DPA (last updated 13 October 2026) that returns or deletes customer personal data at termination or on request. The docs say stopped, paused and archived sandboxes are kept until you delete them, with no retention period after deletion (15). Breaking changes appear in release notes, with no deprecation policy or dated notices found (5). Shared regions in the US and EU are named, and the DPA points to a sub-processor list with service and location in the trust centre, with 30 days' email notice of changes. The trust centre shows Latitude.sh, Leaseweb, OVHcloud and Stripe, and we couldn't read the locations (15). 20 + 15 + 5 + 15 = 55." }, "scores": { "a": 70, "b": 64 } } ], "facts": [ { "a": "SDK + MCP", "b": "HTTP API", "name": "Kind" }, { "a": "Celesto AI, Inc.", "b": "Daytona", "name": "Vendor" }, { "a": "no (local only)", "b": "https://app.daytona.io/api", "name": "Hosted endpoint" }, { "a": "", "b": "HTTP, stdio", "name": "Transports" }, { "a": "None", "b": "API key", "name": "Auth" }, { "a": "Freemium", "b": "Pay per use", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0", "b": "Apache-2.0 (SDKs and API clients), AGPL-3.0 (CLI)", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-11-05", "b": "2026-10-29", "name": "Last release" }, { "a": "2026-10-30", "b": "2025-08-22", "name": "Terms last updated" }, { "a": "2026-10-30", "b": "2025-08-22", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "1.1k stars, 699 PyPI/wk", "b": "6 stars, 706k npm/wk, 1.4M PyPI/wk", "name": "Popularity" }, { "a": "none", "b": "3/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "Celesto (formerly SmolVM) and Daytona score within a point of each other on agent readiness, 68 (B) and 67.7 (B). Daytona leads on reliability and security \u0026 auth.", "question": "Which is better for AI agents, Celesto (formerly SmolVM) or Daytona?" }, { "answer": "No hosted endpoint is listed for Celesto (formerly SmolVM). Daytona has a hosted endpoint at https://app.daytona.io/api.", "question": "Can an agent call Celesto (formerly SmolVM) and Daytona without installing anything?" }, { "answer": "Celesto (formerly SmolVM) is open source (Apache-2.0). No open-source release is listed for Daytona.", "question": "Are Celesto (formerly SmolVM) and Daytona open source?" } ], "goodFor": [ { "aheadOn": [ "Agent ergonomics, 69 against 55", "Payments \u0026 pricing, 60 against 50", "Transparency \u0026 trust, 70 against 64" ], "also": [ "No key needed to call it", "Open source", "No incidents deducted, where Daytona loses 4 points for them" ], "goodFor": "Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.", "slug": "celesto", "watchFor": "Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball" }, { "aheadOn": [ "Reliability, 85 against 66", "Security \u0026 auth, 73 against 52" ], "also": [ "A hosted endpoint, with nothing to install", "Runs on your own machine" ], "goodFor": "Agents that need a choice of machine, including Windows desktops and GPUs, and operators who want least-privilege keys.", "slug": "daytona", "watchFor": "The container class shares the host kernel. Only the VM classes get their own" } ], "history": { "celesto": null, "daytona": [ { "causes": [ "terms", "evidence", "correction", "time" ], "date": "2026-11-02", "delta": 3.4, "from": 64.3, "fromGrade": "B", "to": 67.7, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0, "from": 64.3, "fromGrade": "B", "to": 64.3, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.1, "from": 64.4, "fromGrade": "B", "to": 64.3, "toGrade": "B" } ] }, "job": { "capability": "sandbox.code", "name": "Code sandboxes" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.json", "title": "Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-daytona.json", "title": "Amazon Bedrock AgentCore Code Interpreter vs Daytona", "url": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-daytona" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.json", "title": "Blaxel Sandboxes vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-daytona.json", "title": "Blaxel Sandboxes vs Daytona", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-daytona" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.json", "title": "Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK", "url": "https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.json", "title": "Celesto (formerly SmolVM) vs DeltaBox Lite", "url": "https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.json", "title": "Celesto (formerly SmolVM) vs Deno Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-e2b.json", "title": "Celesto (formerly SmolVM) vs E2B", "url": "https://www.anchorterminal.com/compare/celesto-vs-e2b" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-freestyle.json", "title": "Celesto (formerly SmolVM) vs Freestyle", "url": "https://www.anchorterminal.com/compare/celesto-vs-freestyle" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-instavm.json", "title": "Celesto (formerly SmolVM) vs InstaVM", "url": "https://www.anchorterminal.com/compare/celesto-vs-instavm" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-maritime.json", "title": "Celesto (formerly SmolVM) vs Maritime", "url": "https://www.anchorterminal.com/compare/celesto-vs-maritime" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.json", "title": "Celesto (formerly SmolVM) vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.json", "title": "Celesto (formerly SmolVM) vs Modal Sandboxes", "url": "https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.json", "title": "Celesto (formerly SmolVM) vs Morph Cloud", "url": "https://www.anchorterminal.com/compare/celesto-vs-morph-cloud" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-offscreen.json", "title": "Celesto (formerly SmolVM) vs Offscreen", "url": "https://www.anchorterminal.com/compare/celesto-vs-offscreen" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.json", "title": "Celesto (formerly SmolVM) vs SPACE", "url": "https://www.anchorterminal.com/compare/celesto-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-runloop.json", "title": "Celesto (formerly SmolVM) vs Runloop Devboxes", "url": "https://www.anchorterminal.com/compare/celesto-vs-runloop" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-sandbox0.json", "title": "Celesto (formerly SmolVM) vs Sandbox0", "url": "https://www.anchorterminal.com/compare/celesto-vs-sandbox0" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-sprites.json", "title": "Celesto (formerly SmolVM) vs Sprites", "url": "https://www.anchorterminal.com/compare/celesto-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.json", "title": "Celesto (formerly SmolVM) vs Together Code Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.json", "title": "Celesto (formerly SmolVM) vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-daytona.json", "title": "Cloudflare Sandbox SDK vs Daytona", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-daytona" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-deltabox-lite.json", "title": "Daytona vs DeltaBox Lite", "url": "https://www.anchorterminal.com/compare/daytona-vs-deltabox-lite" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-deno-sandbox.json", "title": "Daytona vs Deno Sandbox", "url": "https://www.anchorterminal.com/compare/daytona-vs-deno-sandbox" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-e2b.json", "title": "Daytona vs E2B", "url": "https://www.anchorterminal.com/compare/daytona-vs-e2b" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-freestyle.json", "title": "Daytona vs Freestyle", "url": "https://www.anchorterminal.com/compare/daytona-vs-freestyle" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-instavm.json", "title": "Daytona vs InstaVM", "url": "https://www.anchorterminal.com/compare/daytona-vs-instavm" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-maritime.json", "title": "Daytona vs Maritime", "url": "https://www.anchorterminal.com/compare/daytona-vs-maritime" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-microsoft-execution-containers.json", "title": "Daytona vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/daytona-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-modal-sandboxes.json", "title": "Daytona vs Modal Sandboxes", "url": "https://www.anchorterminal.com/compare/daytona-vs-modal-sandboxes" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-morph-cloud.json", "title": "Daytona vs Morph Cloud", "url": "https://www.anchorterminal.com/compare/daytona-vs-morph-cloud" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-offscreen.json", "title": "Daytona vs Offscreen", "url": "https://www.anchorterminal.com/compare/daytona-vs-offscreen" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-perplexity-space.json", "title": "Daytona vs SPACE", "url": "https://www.anchorterminal.com/compare/daytona-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-runloop.json", "title": "Daytona vs Runloop Devboxes", "url": "https://www.anchorterminal.com/compare/daytona-vs-runloop" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-sandbox0.json", "title": "Daytona vs Sandbox0", "url": "https://www.anchorterminal.com/compare/daytona-vs-sandbox0" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-sprites.json", "title": "Daytona vs Sprites", "url": "https://www.anchorterminal.com/compare/daytona-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-together-code-sandbox.json", "title": "Daytona vs Together Code Sandbox", "url": "https://www.anchorterminal.com/compare/daytona-vs-together-code-sandbox" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-vercel-sandbox.json", "title": "Daytona vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/daytona-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/agent37-vs-celesto.json", "title": "Agent 37 Cloud vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/agent37-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/agent37-vs-daytona.json", "title": "Agent 37 Cloud vs Daytona", "url": "https://www.anchorterminal.com/compare/agent37-vs-daytona" } ], "panel": null, "scores": [ { "by": 19, "celesto": 66, "daytona": 85, "edge": "daytona", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 2, "celesto": 85, "daytona": 87, "edge": "daytona", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 14, "celesto": 69, "daytona": 55, "edge": "celesto", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "by": 21, "celesto": 52, "daytona": 73, "edge": "daytona", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "by": 10, "celesto": 60, "daytona": 50, "edge": "celesto", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 1, "celesto": 81, "daytona": 80, "edge": "celesto", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 6, "celesto": 70, "daytona": 64, "edge": "celesto", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Celesto (formerly SmolVM) and Daytona score within a point of each other on agent readiness, 68 (B) and 67.7 (B). Daytona leads on reliability and security \u0026 auth. Both do code sandboxes.", "tasks": null, "tutorials": [], "verdicts": { "celesto": "Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.", "daytona": "API keys with per-action scopes let an agent create sandboxes without deleting them, and an SLA commits to 99.95% uptime. The container class shares the host kernel, only VM classes get their own, and Daytona fixed two High cross-tenant flaws in June 2026." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/celesto-vs-daytona", "json": "https://www.anchorterminal.com/compare/celesto-vs-daytona.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/celesto-vs-daytona.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/celesto-vs-daytona.min.md" }, "markdown": "Celesto (formerly SmolVM) and Daytona score within a point of each other on agent readiness, 68 (B) and 67.7 (B). Daytona leads on reliability and security \u0026 auth. Both do code sandboxes.\n\n- Celesto (formerly SmolVM): grade B, 68/100, rank #298 of 1486. Markdown https://www.anchorterminal.com/tools/celesto.md · JSON https://www.anchorterminal.com/api/v1/tools/celesto.json\n- Daytona: grade B, 67.7/100, rank #309 of 1486. Markdown https://www.anchorterminal.com/tools/daytona.md · JSON https://www.anchorterminal.com/api/v1/tools/daytona.json\n- Best code execution sandboxes for AI agents: https://www.anchorterminal.com/best/code-sandboxes/index.md\n- All 231 sandboxes comparisons: https://www.anchorterminal.com/compare/code-sandboxes/index.md\n\n## Which one, for what\n\n### Celesto (formerly SmolVM) (B)\n\nGood for: Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.\n\nAhead on:\n- Agent ergonomics, 69 against 55\n- Payments \u0026 pricing, 60 against 50\n- Transparency \u0026 trust, 70 against 64\n\nAlso in its favour:\n- No key needed to call it\n- Open source\n- No incidents deducted, where Daytona loses 4 points for them\n\nWatch for: Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball\n\n### Daytona (B)\n\nGood for: Agents that need a choice of machine, including Windows desktops and GPUs, and operators who want least-privilege keys.\n\nAhead on:\n- Reliability, 85 against 66\n- Security \u0026 auth, 73 against 52\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Runs on your own machine\n\nWatch for: The container class shares the host kernel. Only the VM classes get their own\n\n\n## Why the edge\n\n### Security \u0026 auth: Daytona +21\n\n- Celesto (formerly SmolVM) (52): Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.\n- Daytona (73): API keys with per-action scopes (`write:sandboxes` separate from `delete:sandboxes`, plus snapshot, volume, audit, secret and billing scopes), an expiry date and immediate revocation, and manager keys that issue scoped child keys at runtime. The docs say any valid key in the organisation can reach a running sandbox whatever its scopes, so 27 of 30 (27). Container sandboxes get their own namespaces and resource limits on a shared kernel, while Linux VM and Windows classes get their own kernel (6). Tier 1 and 2 organisations get restricted network access that can't be changed per sandbox, and full internet with per-sandbox allow lists starts at Tier 3 (5). We found nothing on keeping credentials out of the sandbox or on running untrusted code (5). Audit logs behind their own key scope, log streaming and webhooks (15). An organisation-wide security policy (security@daytona.io or GitHub private reporting, acknowledgement within 5 business days, discretionary rewards) covers app.daytona.io and the clients repository. The SafeBase trust centre lists SOC 2 Type 1 and Type 2, ISO/IEC 27001 and HIPAA, with reports and a pen-test summary on request. Four advisories were published on GitHub in June 2026. No security.txt (404 on 2 November), and a discretionary reward doesn't count as a bounty. Read as modal-sandboxes' 15 (15). 27 + 6 + 5 + 5 + 15 + 15 = 73.\n\n### Reliability: Daytona +19\n\n- Celesto (formerly SmolVM) (66): Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.\n- Daytona (85): Better Stack status page at status.app.daytona.io with per-service history, read from its RSS feed and incident pages on 2 November (20). The two Windows runner outages (31 July and 1 August) have left the 90 days from 4 August. The window holds a degradation of new sandbox creation in us-central-1 (11 August, 17.5 hours), elevated creation errors for 4 minutes (4 September), a builder queue backlog (12 September), sandbox listing degraded on 1 and 30 October, reduced GPU capacity (16 October), some dashboard settings unavailable (22 October) and a provider outage on a subset of US runners (29 and 30 October). Each is one region, one endpoint or a subset of runners, so partial and minor (20). Rate limits published per tier, 10,000 to 50,000 general requests and 300 to 600 sandbox creations a minute (15). 429s carry `Retry-After-{throttler}` and `X-RateLimit-*` headers, and the docs advise exponential backoff (1s, 2s, 4s, 8s). No idempotency keys found (10). An SLA page (last updated 22 August 2025) commits to 99.95% monthly uptime with service credits for Tier 4 and above (10). GA (10). 20 + 20 + 15 + 10 + 10 + 10 = 85.\n\n### Agent ergonomics: Celesto (formerly SmolVM) +14\n\n- Celesto (formerly SmolVM) (69): A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). `computer list`, `logs --follow` and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). `with Computer()` creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.\n- Daytona (55): List and toolbox calls return whole objects or files, with no field selection found (15). Labels and list calls exist, but we didn't confirm documented filters or page sizes (10). JSON errors with `statusCode`, `message` and `error`, plus rate-limit headers, and since 0.220.0 the SDKs report queue timeouts and spot evictions as distinct errors (15). No idempotency keys or safe-retry guidance for creates found (0). SDKs in Python, TypeScript, Ruby, Go and Java, and a create call works with an empty body, though the 15-minute auto-stop default can stop a sandbox mid-task (15). We scored the API, not the local MCP server. Total 55.\n\n### Payments \u0026 pricing: Celesto (formerly SmolVM) +10\n\n- Celesto (formerly SmolVM) (60): Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.\n- Daytona (50): No x402, MPP or L402 (0). Per-second prices published per vCPU, GiB of memory, GiB of storage and GPU, re-read on 2 November (20). $200 of compute, \"no credit card required\" (20). Stripe Projects lists Daytona, so an agent can create the account through the operator's Stripe login, per the 1 October check (10). Total 50.\n\n### Transparency \u0026 trust: Celesto (formerly SmolVM) +6\n\n- Celesto (formerly SmolVM) (70): Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.\n- Daytona (64): SDKs and API clients are Apache-2.0 and the CLI is AGPL-3.0, but the platform code went private in June 2026 (20). Privacy policy and terms (both updated 22 August 2025) and a DPA (last updated 13 October 2026) that returns or deletes customer personal data at termination or on request. The docs say stopped, paused and archived sandboxes are kept until you delete them, with no retention period after deletion (15). Breaking changes appear in release notes, with no deprecation policy or dated notices found (5). Shared regions in the US and EU are named, and the DPA points to a sub-processor list with service and location in the trust centre, with 30 days' email notice of changes. The trust centre shows Latitude.sh, Leaseweb, OVHcloud and Stripe, and we couldn't read the locations (15). 20 + 15 + 5 + 15 = 55.\n\n## Score by category\n\n| Category | Weight | Celesto (formerly SmolVM) | Daytona | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 66 | 85 | Daytona +19 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 85 | 87 | Daytona +2 |\n| Agent ergonomics | 13% (16.2 this run) | 69 | 55 | Celesto (formerly SmolVM) +14 |\n| Security \u0026 auth | 14% (17.5 this run) | 52 | 73 | Daytona +21 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 50 | Celesto (formerly SmolVM) +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 81 | 80 | Celesto (formerly SmolVM) +1 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 70 | 64 | Celesto (formerly SmolVM) +6 |\n| Negative events | ≤15 | 0 | -4 | |\n| **Total** | | **68 · B** | **67.7 · B** | |\n\n## Facts side by side\n\n| Fact | Celesto (formerly SmolVM) | Daytona |\n| --- | --- | --- |\n| Kind | SDK + MCP | HTTP API |\n| Vendor | Celesto AI, Inc. | Daytona |\n| Hosted endpoint | no (local only) | `https://app.daytona.io/api` |\n| Transports | | HTTP, stdio |\n| Auth | None | API key |\n| Pricing | Freemium | Pay per use |\n| x402 | no | no |\n| Licence | Apache-2.0 | Apache-2.0 (SDKs and API clients), AGPL-3.0 (CLI) |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-11-05 | 2026-10-29 |\n| Terms last updated | 2026-10-30 | 2025-08-22 |\n| Privacy policy last updated | 2026-10-30 | 2025-08-22 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | 1.1k stars, 699 PyPI/wk | 6 stars, 706k npm/wk, 1.4M PyPI/wk |\n| Agent reviews | none | 3/5 (2) |\n\n## How the scores have moved\n\n### Celesto (formerly SmolVM)\n\nNo score change since it was listed.\n\n### Daytona\n\n- +3.4 on 2 November 2026: terms, new evidence, correction, time\n- no change on 27 October 2026: checklist\n- -0.1 on 8 October 2026: checklist\n\n## Verdicts\n\n**Celesto (formerly SmolVM).** Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.\n\n**Daytona.** API keys with per-action scopes let an agent create sandboxes without deleting them, and an SLA commits to 99.95% uptime. The container class shares the host kernel, only VM classes get their own, and Daytona fixed two High cross-tenant flaws in June 2026.\n\n## Before you call either\n\n### Celesto (formerly SmolVM)\n\n1. Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text\n2. Create computers with unique names and delete them by exact name when the job ends, including after failures\n3. Set `internet_settings={\"mode\": \"off\"}` or `restricted` for untrusted code, since the default is open\n4. Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine\n5. Never paste browser or display connection URLs into model context; possession of the URL grants control\n\n### Daytona\n\n1. Pick a Linux VM class for untrusted code or when memory must survive a pause. Container sandboxes stop and archive instead\n2. Set autoStopInterval yourself. The 15-minute idle default can stop a sandbox while the agent is still thinking\n3. Give the agent a key without `delete:sandboxes` if it shouldn't destroy work\n4. Read `Retry-After-{throttler}` on a 429 before retrying sandbox creation\n5. Check the organisation's tier before relying on outbound calls from inside the sandbox\n\n## Questions\n\n### Which is better for AI agents, Celesto (formerly SmolVM) or Daytona?\n\nCelesto (formerly SmolVM) and Daytona score within a point of each other on agent readiness, 68 (B) and 67.7 (B). Daytona leads on reliability and security \u0026 auth.\n\n### Can an agent call Celesto (formerly SmolVM) and Daytona without installing anything?\n\nNo hosted endpoint is listed for Celesto (formerly SmolVM). Daytona has a hosted endpoint at https://app.daytona.io/api.\n\n### Are Celesto (formerly SmolVM) and Daytona open source?\n\nCelesto (formerly SmolVM) is open source (Apache-2.0). No open-source release is listed for Daytona.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/celesto-vs-daytona.json, and with the fewest tokens: https://www.anchorterminal.com/compare/celesto-vs-daytona.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"celesto\", \"b\": \"daytona\"}`. From a terminal: `anchor compare celesto daytona`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/celesto.json and https://www.anchorterminal.com/api/v1/tools/daytona.json\n\n## Other comparisons with Celesto (formerly SmolVM) or Daytona\n\n- [Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.md)\n- [Amazon Bedrock AgentCore Code Interpreter vs Daytona](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-daytona.md)\n- [Blaxel Sandboxes vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.md)\n- [Blaxel Sandboxes vs Daytona](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-daytona.md)\n- [Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.md)\n- [Celesto (formerly SmolVM) vs DeltaBox Lite](https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.md)\n- [Celesto (formerly SmolVM) vs Deno Sandbox](https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.md)\n- [Celesto (formerly SmolVM) vs E2B](https://www.anchorterminal.com/compare/celesto-vs-e2b.md)\n- [Celesto (formerly SmolVM) vs Freestyle](https://www.anchorterminal.com/compare/celesto-vs-freestyle.md)\n- [Celesto (formerly SmolVM) vs InstaVM](https://www.anchorterminal.com/compare/celesto-vs-instavm.md)\n- [Celesto (formerly SmolVM) vs Maritime](https://www.anchorterminal.com/compare/celesto-vs-maritime.md)\n- [Celesto (formerly SmolVM) vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.md)\n- [Celesto (formerly SmolVM) vs Modal Sandboxes](https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.md)\n- [Celesto (formerly SmolVM) vs Morph Cloud](https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.md)\n- [Celesto (formerly SmolVM) vs Offscreen](https://www.anchorterminal.com/compare/celesto-vs-offscreen.md)\n- [Celesto (formerly SmolVM) vs SPACE](https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.md)\n- [Celesto (formerly SmolVM) vs Runloop Devboxes](https://www.anchorterminal.com/compare/celesto-vs-runloop.md)\n- [Celesto (formerly SmolVM) vs Sandbox0](https://www.anchorterminal.com/compare/celesto-vs-sandbox0.md)\n- [Celesto (formerly SmolVM) vs Sprites](https://www.anchorterminal.com/compare/celesto-vs-sprites.md)\n- [Celesto (formerly SmolVM) vs Together Code Sandbox](https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.md)\n- [Celesto (formerly SmolVM) vs Vercel Sandbox](https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.md)\n- [Cloudflare Sandbox SDK vs Daytona](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-daytona.md)\n- [Daytona vs DeltaBox Lite](https://www.anchorterminal.com/compare/daytona-vs-deltabox-lite.md)\n- [Daytona vs Deno Sandbox](https://www.anchorterminal.com/compare/daytona-vs-deno-sandbox.md)\n- [Daytona vs E2B](https://www.anchorterminal.com/compare/daytona-vs-e2b.md)\n- [Daytona vs Freestyle](https://www.anchorterminal.com/compare/daytona-vs-freestyle.md)\n- [Daytona vs InstaVM](https://www.anchorterminal.com/compare/daytona-vs-instavm.md)\n- [Daytona vs Maritime](https://www.anchorterminal.com/compare/daytona-vs-maritime.md)\n- [Daytona vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/daytona-vs-microsoft-execution-containers.md)\n- [Daytona vs Modal Sandboxes](https://www.anchorterminal.com/compare/daytona-vs-modal-sandboxes.md)\n- [Daytona vs Morph Cloud](https://www.anchorterminal.com/compare/daytona-vs-morph-cloud.md)\n- [Daytona vs Offscreen](https://www.anchorterminal.com/compare/daytona-vs-offscreen.md)\n- [Daytona vs SPACE](https://www.anchorterminal.com/compare/daytona-vs-perplexity-space.md)\n- [Daytona vs Runloop Devboxes](https://www.anchorterminal.com/compare/daytona-vs-runloop.md)\n- [Daytona vs Sandbox0](https://www.anchorterminal.com/compare/daytona-vs-sandbox0.md)\n- [Daytona vs Sprites](https://www.anchorterminal.com/compare/daytona-vs-sprites.md)\n- [Daytona vs Together Code Sandbox](https://www.anchorterminal.com/compare/daytona-vs-together-code-sandbox.md)\n- [Daytona vs Vercel Sandbox](https://www.anchorterminal.com/compare/daytona-vs-vercel-sandbox.md)\n- [Agent 37 Cloud vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agent37-vs-celesto.md)\n- [Agent 37 Cloud vs Daytona](https://www.anchorterminal.com/compare/agent37-vs-daytona.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Celesto (formerly SmolVM) vs Daytona", "url": "" } ], "description": "Celesto and Daytona score within a point of each other for code sandboxes, 68 and 67.7 out of 100. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Celesto (formerly SmolVM) B 68", "Daytona B 67.7", "scores" ], "h1": "Celesto (formerly SmolVM) vs Daytona", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/celesto-vs-daytona", "published": "2026-10-01", "section": "tools", "title": "Celesto vs Daytona for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/celesto-vs-daytona" }, "tokens": { "markdown": 5050, "slim": 2730 }, "version": 1 }