{ "data": { "a": { "slug": "celesto", "name": "Celesto (formerly SmolVM)", "vendor": "Celesto AI, Inc.", "vendorUrl": "https://celesto.ai", "kind": "sdk", "category": "code-sandboxes", "summary": "Celesto, formerly SmolVM, is an open-source Python SDK and CLI from Celesto AI that runs disposable Firecracker or QEMU microVMs on the owner's machine for agent code, browsers and desktops, with an optional paid Celesto Cloud.", "url": "https://www.anchorterminal.com/tools/celesto", "markdownUrl": "https://www.anchorterminal.com/tools/celesto.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/celesto.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/celesto.json", "dns": "celesto.grade.anchorterminal.com", "repo": "https://github.com/CelestoAI/Celesto", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "pypi", "name": "celesto" } ], "auth": "none", "authNotes": "Local use needs no account or key. The local API server and dashboard each require a bearer token, generated at start or read from CELESTO_SERVER_TOKEN and CELESTO_DASHBOARD_TOKEN. Celesto Cloud uses an organisation-bound CELESTO_API_KEY with named permissions (see, execute, delete) set in the dashboard.", "pricing": "freemium", "pricingNotes": "The local SDK and CLI are free under Apache-2.0. Celesto Cloud bills sandboxes by the running hour from $0.015 (Micro, 1 vCPU, 2 GB) to $0.16 (XL, 8 vCPU, 32 GB), prepaid from $2.01, with a one-time $5 Micro credit and no card.", "priceSummary": "$0.015 / session-hr", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the repository, the docs, llms.txt or the pricing page (checked 2026-11-06). Cloud runtime is prepaid by card under Settings \u003e Billing.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1149, "npmWeekly": null, "pypiWeekly": 699, "asOf": "2026-11-06" }, "docsUrl": "https://celesto.ai/docs", "llmsTxt": "https://celesto.ai/llms.txt", "openapi": "https://github.com/CelestoAI/Celesto/blob/main/ts/celesto-local-server.openapi.json", "capabilities": [ "sandbox.code", "sandbox.fs", "sandbox.persist", "sandbox.browser" ], "tags": [ "open-source", "local", "self-hosted", "hosted", "freemium", "no-card", "free-tier", "apache-2.0", "python", "typescript", "cli", "microvm", "firecracker", "llms-txt", "openapi", "telemetry", "pre-1.0", "renamed" ], "lastRelease": "2026-11-05", "graded": true, "anchor": { "graded": true, "score": 68, "grade": "B", "agentReady": false, "rank": 298, "ranked": true, "rankOf": 1486, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 81, "payments": 60, "reliability": 66, "schema": 85, "security": 52, "transparency": 70 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.", "bestFor": "Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.", "strengths": [ "Apache-2.0, installs from PyPI with `celesto setup` and `celesto doctor`, and runs local microVMs with no account or key", "Every `--json` response has the same `ok`, `command`, `exit_code`, `data` and `error` fields, with recovery commands in errors", "Network modes `off`, `public` (proxy that rejects private and metadata addresses) and `restricted` with CIDR or domain allowlists", "Dated changelog with Security sections, breaking changes marked, and 22 PyPI releases in the 90 days to 6 November 2026", "OpenAPI documents for the local server (24 operations) and the cloud API (171 operations) in the repository, plus llms.txt" ], "weaknesses": [ "Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball", "Outbound network access is open by default, and Linux TAP mode does not block every private network or metadata service", "Usage telemetry to PostHog is on after a first-use notice, until switched off", "Renamed from SmolVM on 19 September 2026 in a breaking release that removed the `smolvm` command and import path", "No security.txt, bug bounty or certification found, and CI results could not be read" ], "agentNotes": [ "Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text", "Create computers with unique names and delete them by exact name when the job ends, including after failures", "Set `internet_settings={\"mode\": \"off\"}` or `restricted` for untrusted code, since the default is open", "Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine", "Never paste browser or display connection URLs into model context; possession of the URL grants control" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68 } ], "editorialScores": { "ergonomics": 69, "maintenance": 81, "payments": 60, "reliability": 66, "schema": 85, "security": 52, "transparency": 74 }, "provenanceScore": 66, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install celesto \u0026\u0026 celesto setup \u0026\u0026 celesto doctor", "headless": { "create": "celesto computer create --name agent-job --json", "delete": "celesto computer delete agent-job --json", "exec": "celesto computer exec agent-job --json -- python -m pytest" } }, "letme": { "capability": "https://letme.dev/sandbox.code", "tool": "https://letme.dev/celesto" }, "area": "agent-runtime", "unitPrices": [ { "item": "Cloud Micro sandbox (1 vCPU, 2 GB)", "unit": "session-hour", "usd": 0.015, "note": "Billed by the running hour; local use is free" }, { "item": "Cloud XL sandbox (8 vCPU, 32 GB)", "unit": "session-hour", "usd": 0.16, "note": "Largest size on the pricing page" } ], "provenance": { "legalEntity": "Celesto AI, Inc.", "domain": "celesto.ai", "domainRegistered": "2025-07-13", "endpointOnVendorDomain": null, "terms": "https://celesto.ai/legal/terms", "privacy": "https://celesto.ai/legal/privacy-policy", "statusPage": "", "changelog": "https://github.com/CelestoAI/Celesto/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The privacy policy, last updated 30 October 2026, names Celesto AI, Inc., a Delaware corporation with a Wilmington mailing address. It has no clause on automated access.", "celesto.ai/robots.txt allows all crawlers. docs.celesto.ai carries Content-Signal ai-train=yes, search=yes, ai-input=yes.", "RDAP gives celesto.ai a registration date of 13 July 2025.", "/.well-known/security.txt returns 404. SECURITY.md asks for private reports through GitHub's vulnerability reporting. No status page is linked from the pricing page." ], "score": 66 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/celesto.json", "live": { "slug": "celesto", "versions": [ { "registry": "github", "name": "CelestoAI/Celesto", "version": "v0.1.13", "released": "2026-11-05", "seenAt": "2026-11-06T23:13:37.416837168Z" }, { "registry": "pypi", "name": "celesto", "version": "0.1.13", "released": "2026-11-05", "seenAt": "2026-11-06T23:13:37.309276304Z" } ], "githubStars": 1149, "pypiWeekly": 699, "securityTxt": { "url": "https://celesto.ai/.well-known/security.txt", "state": "unknown", "checkedAt": "2026-11-07T16:01:01.176888246Z" }, "llmsTxt": { "url": "https://celesto.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:46.784166983Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/CelestoAI/Celesto/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:18:00.719411253Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8ddae4a6adbd" }, { "url": "https://celesto.ai/legal/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:00:50.868104256Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "87ce310b1db6" }, { "url": "https://celesto.ai/legal/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:00:53.107282947Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1dece6f9a42e" } ], "updatedAt": "2026-11-07T16:01:01.176888246Z" } }, "answer": "Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Deno Sandbox's 49.5 (D), and leads in 6 of 7 scored categories. Deno Sandbox leads on security \u0026 auth.", "b": { "slug": "deno-sandbox", "name": "Deno Sandbox", "vendor": "Deno Land Inc.", "vendorUrl": "https://deno.com", "kind": "http-api", "category": "code-sandboxes", "summary": "Deno Sandbox runs Linux microVMs on Deno Deploy for untrusted or AI-generated code, through JavaScript and Python SDKs or the `deno sandbox` CLI. In beta since February 2026, it closes with Deno Deploy six months after 9 October 2026.", "url": "https://www.anchorterminal.com/tools/deno-sandbox", "markdownUrl": "https://www.anchorterminal.com/tools/deno-sandbox.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/deno-sandbox.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/deno-sandbox.json", "dns": "deno-sandbox.grade.anchorterminal.com", "repo": "https://github.com/denoland/sandbox-py", "license": "Proprietary service under the Deno Deploy terms and conditions. The `@deno/sandbox` and `deno-sandbox` SDKs are MIT", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "@deno/sandbox" }, { "registry": "pypi", "name": "deno-sandbox" } ], "auth": "api-key", "authNotes": "An organisation access token (prefix `ddo_`) created under Settings in console.deno.com, read by the SDKs from `DENO_DEPLOY_TOKEN` and sent as a Bearer token. The same token manages the organisation's Deno Deploy apps. No scopes or expiry were found in the reviewed docs, the docs say to rotate a leaked token from the dashboard, and all organisation members hold owner permissions. Signup is in a browser.", "pricing": "paid", "pricingNotes": "Sandboxes need the Pro plan ($20 a month) or above, and the Free plan does not include them. Compute bills through the Deploy meters at $0.10 a CPU-hour and $0.025 a GiB-hour of memory beyond the plan's allowance (50 CPU-hours and 750 GiB-hours on Pro), and volume storage at $0.20 a GiB-month beyond 5 GiB on Pro. Spend limits can be set on paid plans (https://deno.com/deploy/pricing, checked 2026-10-08).", "priceSummary": "$0.10 / vCPU-hr", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the sandbox docs, the pricing page or the OpenAPI document (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 6, "npmWeekly": 1971, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://docs.deno.com/sandbox/", "llmsTxt": "https://docs.deno.com/llms.txt", "capabilities": [ "sandbox.code", "sandbox.fs", "sandbox.persist" ], "tags": [ "hosted", "paid", "beta", "microvm", "typescript", "python", "cli", "llms-txt", "status-page", "enterprise" ], "lastRelease": "2026-07-22", "graded": true, "anchor": { "graded": true, "score": 49.5, "grade": "D", "agentReady": false, "rank": 1081, "ranked": true, "rankOf": 1486, "categoryRank": 22, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 60, "maintenance": 45, "payments": 20, "reliability": 43, "schema": 66, "security": 58, "transparency": 67 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -2, "negativeNotes": [ "2026-10-08: the Create page (last modified 28 January 2026) says a default sandbox has no outbound network access, while the Security page of the same date says outbound access is unrestricted unless `allowNet` is set. Both pages still say so on 4 November 2026. A reader of the first page would leave egress open. 2 points. https://docs.deno.com/sandbox/create/ and https://docs.deno.com/sandbox/security/" ], "verdict": "Secrets stay outside the microVM and are substituted only on outbound requests to approved hosts, and an allowlist limits egress. Deno Deploy, which runs it, is due to shut down six months after 9 October 2026, when Deno announced it is joining Cloudflare. The service is still in beta, needs the $20 Pro plan and caps lifetime at 30 minutes.", "bestFor": "Short runs of untrusted or generated code that need outside API keys kept out of reach, for teams already on Deno Deploy, until Deploy closes six months after 9 October 2026.", "strengths": [ "Secrets are held outside the VM. Code sees a placeholder, and the real value is substituted only on requests to hosts named for that secret", "`allowNet` restricts outbound traffic to listed hostnames, wildcard subdomains, ports or IP addresses", "Each sandbox is a Firecracker microVM per the product page, with 2 vCPUs, 768 MB to 4 GB of memory and 10 GB of disk", "Volumes of 300 MB to 20 GB persist between sandboxes, and read-only snapshots of a volume can boot new sandboxes", "Unit prices are public, $0.10 a CPU-hour, $0.025 a GiB-hour of memory and $0.20 a GiB-month of volume storage" ], "weaknesses": [ "Deno Deploy, which runs Sandbox, shuts down six months after the 9 October 2026 announcement, and Deno is moving its development to Cloudflare", "Beta since 3 February 2026 and not in the Free plan. Access starts at Pro, $20 a month, after a browser signup", "The published OpenAPI document at `api.deno.com/v2/openapi.json` had 34 operations and none for sandboxes, volumes or snapshots on 8 October", "The Create page says a default sandbox has no outbound network access, and the Security page says outbound access is unrestricted by default", "Maximum lifetime is 30 minutes, volumes exist only in `ord`, and no API rate limits or 429 guidance were found", "Organisation tokens carry no scopes in the reviewed docs, and every organisation member has owner permissions" ], "agentNotes": [ "Set `DENO_DEPLOY_TOKEN` to an organisation token (prefix `ddo_`) from Settings in console.deno.com. The organisation must be on Pro or above", "Pass `allowNet` on every `Sandbox.create()`. The Security page says outbound access is unrestricted when it is omitted", "Pass credentials through `secrets` with a `hosts` list, not `env`, so code in the VM sees only a placeholder", "The default timeout ends the VM when the client disconnects. Pass a duration such as `\"10m\"` and reconnect with `Sandbox.connect({ id })`, up to 30 minutes", "Create volumes in `ord` and start the sandbox in `ord`. A volume mounts only in its own region", "`exposeHttp` URLs are public with no authentication. Treat the random subdomain as a secret", "Plan a move before Deno Deploy closes, six months after 9 October 2026. Deno gives migration support to Cloudflare Workers for paying customers only" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 49.5 } ], "editorialScores": { "ergonomics": 60, "maintenance": 45, "payments": 20, "reliability": 43, "schema": 66, "security": 58, "transparency": 50 }, "provenanceScore": 83, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @deno/sandbox # or pip install deno-sandbox" }, "letme": { "capability": "https://letme.dev/sandbox.code", "tool": "https://letme.dev/deno-sandbox" }, "area": "agent-runtime", "unitPrices": [ { "item": "Active CPU beyond plan allowance", "unit": "vcpu-hour", "usd": 0.1, "note": "Memory extra at $0.025 a GiB-hour" }, { "item": "Volume storage beyond plan allowance", "unit": "gb-month", "usd": 0.2, "note": "Priced per GiB" }, { "item": "Pro plan, the lowest that includes sandboxes", "unit": "month", "usd": 20, "note": "Includes 50 CPU-hours, 750 GiB-hours of memory and 5 GiB of volume storage" } ], "provenance": { "legalEntity": "Deno Land Inc.", "domain": "deno.com", "domainRegistered": "1999-03-09", "endpointOnVendorDomain": false, "terms": "https://docs.deno.com/deploy/terms_and_conditions/", "privacy": "https://docs.deno.com/deploy/privacy_policy/", "statusPage": "https://denostatus.com", "changelog": "https://docs.deno.com/deploy/changelog/", "securityTxt": "valid", "checked": "2026-11-04", "notes": [ "The Deno Deploy terms and conditions (last modified 30 September 2026) name Deno Land Inc. and govern the Deploy services, of which Sandbox is a part. No separate sandbox terms were found.", "The privacy policy (last modified 30 September 2026) gives Deno Land Inc., 1111 6th Ave Ste 550, PMB 702973, San Diego CA 92101. A DPA is listed under Enterprise only, and no public copy was found.", "The Python SDK's default sandbox endpoint is `\u003cregion\u003e.sandbox-api.deno.net`, a second domain of the vendor's, while listing and volumes go through console.deno.com.", "deno.com/.well-known/security.txt gives deploy@deno.com and a policy link and has no Expires field, which RFC 9116 requires. It is recorded as valid to match other listings with the same gap. The policy page gives security@deno.com.", "The registration date (1999-03-09) is carried from the 8 October check, which took it from a registry data service this run doesn't use.", "The Deploy changelog's newest entry is still dated 12 March 2026 on 4 November 2026.", "Deno's post of 9 October 2026 says the team is joining Cloudflare and that Deno Deploy, which runs Sandbox, will shut down after six months. The terms and privacy policy, both last updated 30 September 2026, still name Deno Land Inc." ], "score": 83 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/deno-sandbox.json", "live": { "slug": "deno-sandbox", "vendorStatus": { "page": "https://denostatus.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:47:38.303293262Z" }, "versions": [ { "registry": "github", "name": "denoland/sandbox-py", "version": "v0.15.0", "released": "2026-03-13", "seenAt": "2026-11-06T23:20:52.500407155Z" }, { "registry": "npm", "name": "@deno/sandbox", "version": "0.13.2", "seenAt": "2026-11-06T23:20:51.935099618Z" }, { "registry": "pypi", "name": "deno-sandbox", "version": "0.16.0", "released": "2026-07-22", "seenAt": "2026-11-06T23:20:52.211366312Z" } ], "githubStars": 6, "npmWeekly": 1065, "pypiWeekly": 61015, "securityTxt": { "url": "https://deno.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:08.156795265Z" }, "llmsTxt": { "url": "https://docs.deno.com/llms.txt", "ok": false, "status": 500, "checkedAt": "2026-11-07T15:32:16.068339342Z" }, "domain": { "domain": "deno.com", "registered": "1999-03-09", "source": "https://rdap.verisign.com/com/v1/domain/deno.com", "checkedAt": "2026-11-01T14:18:00.518437187Z" }, "pages": [ { "url": "https://docs.deno.com/deploy/changelog/", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:06:04.458827564Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "970657376187" }, { "url": "https://deno.com/blog/cloudflare", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:02:35.7723311Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "ee3d10c6e2b2" }, { "url": "https://deno.com/deploy/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:02:37.856963714Z", "changedAt": "2026-11-07T14:02:37.856963714Z", "fingerprint": "c8eb115e6a14" }, { "url": "https://docs.deno.com/deploy/privacy_policy/", "kind": "privacy", "status": 304, "checkedAt": "2026-11-07T14:06:06.519425348Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8daa7ca4099e" }, { "url": "https://docs.deno.com/deploy/terms_and_conditions/", "kind": "terms", "status": 304, "checkedAt": "2026-11-07T14:06:08.502738098Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "95a600f10514" } ], "github": { "repo": "denoland/sandbox-py", "checkedAt": "2026-11-02T08:43:52.230227156Z", "stars": 6, "archived": false, "issuesEnabled": true, "pushedAt": "2026-07-23T07:30:39Z", "openIssues": 0, "openPRs": 1, "issuesOpened90d": 0, "issuesClosed90d": 0, "prsMerged90d": 0, "ci": { "branch": "main", "runs": 50, "success": 50, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-07-22T21:39:50Z" }, "replies": { "sampled": 2, "unanswered": 0, "medianDays": 2.6 } }, "updatedAt": "2026-11-07T16:00:08.156795265Z" } }, "edges": [ { "by": 40, "category": "payments", "leads": "celesto", "name": "Payments \u0026 pricing", "reasons": { "a": "Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.", "b": "No x402, MPP or L402 (0). Unit prices are public without a login, $0.10 a CPU-hour, $0.025 a GiB-hour and $0.20 a GiB-month (20). The Free plan does not include sandboxes, and no trial was found (0). A person signs up at console.deno.com in a browser and creates the token (0). 0+20+0+0 = 20." }, "scores": { "a": 60, "b": 20 } }, { "by": 36, "category": "maintenance", "leads": "celesto", "name": "Maintenance \u0026 community", "reasons": { "a": "0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.", "b": "Deno 2.9.7 (16 September 2026, 49 days ago) includes a fix to how the `deno sandbox` command passes its arguments, the newest release touching the product. `deno-sandbox` 0.16.0 shipped on 22 July 2026, and `@deno/sandbox` 0.13.2 on 16 March per the 8 October check (20). One release in the 90 days from 6 August (0). The Deploy changelog stops at 12 March 2026. Support is by Discord, and by email on paid plans. The Python repository showed one open issue or pull request on 8 October (7). Official JavaScript and Python SDKs, the JavaScript one unchanged since March (12). The Python repository runs formatting, lint, type checks and offline tests in CI. The JavaScript SDK's source repository is not public (6). 20+0+7+12+6 = 45." }, "scores": { "a": 81, "b": 45 } }, { "by": 23, "category": "reliability", "leads": "celesto", "name": "Reliability", "reasons": { "a": "Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.", "b": "Hosted lines. denostatus.com runs on Instatus with history, but has no component for sandboxes (15 of 20). The 90 days from 6 August show one incident, request failures in `ord` on 7 September 2026, one region, so minor (20). Concurrency and resource limits are published, though the docs (5 per organisation) and the pricing table (3 per region on Pro) differ, and no API request limits were found (8, a partial value kept). No 429 or retry guidance and no idempotency keys found (0). The pricing table lists a 99.95 per cent reliability SLA for Enterprise, with no SLA document found (0). Beta, pre-release per the docs (0). 15+20+8+0+0+0 = 43." }, "scores": { "a": 66, "b": 43 } }, { "by": 19, "category": "schema", "leads": "celesto", "name": "Schema \u0026 documentation", "reasons": { "a": "Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.", "b": "The published OpenAPI document has no sandbox operations, so the typed TypeScript SDK reference on JSR and the typed Python SDK count as 15 of 25 (15). llms.txt and every docs page as Markdown (10). The docs state use cases, when to choose a duration timeout and when to move work to a Deploy app (13). Typed options with stated ranges for memory, capacity and timeout (12). Examples in JavaScript, sync and async Python and the CLI. No error reference was found, and two pages disagree on the default network policy (8). SDKs are versioned at 0.x, and the Deploy changelog's newest entry is 12 March 2026 (8). 15+10+13+12+8+8 = 66." }, "scores": { "a": 85, "b": 66 } }, { "by": 9, "category": "ergonomics", "leads": "celesto", "name": "Agent ergonomics", "reasons": { "a": "A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). `computer list`, `logs --follow` and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). `with Computer()` creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.", "b": "Sandbox and volume objects are small, and command output streams (15). Lists use cursor pagination with search, label and status filters (15). The Python SDK raises errors with a status, code, message and trace id, and validation errors with a field path, but the codes are not documented (10). No idempotency keys. A duration sandbox can be rejoined by id, and volume slugs are unique per organisation (5). `Sandbox.create()` needs no parameters, with JavaScript and Python SDKs and a CLI (15). 15+15+10+5+15 = 60." }, "scores": { "a": 69, "b": 60 } }, { "by": 6, "category": "security", "leads": "deno-sandbox", "name": "Security \u0026 auth", "reasons": { "a": "Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.", "b": "One organisation token with no scopes or expiry found, rotatable from the dashboard, which also manages the organisation's Deploy apps. All members hold owner permissions (15). An outbound allowlist and read-only volume mounts exist, but outbound access is open unless `allowNet` is set, per the Security page (13). Secret substitution outside the VM is documented as a defence against prompt injection followed by exfiltration (13). Commands, HTTP requests and SSH sessions are traced in the dashboard with an event log (10). A disclosure policy with safe harbour and a reporting route at security@deno.com, with no acknowledgement time, and a security.txt without an Expires field (7). The SOC2 and ISO27001 claims read on 8 October are no longer on the product or pricing pages, and no bug bounty was found. `exposeHttp` URLs are public without authentication, which the docs state in capitals. 15+13+13+10+7 = 58." }, "scores": { "a": 52, "b": 58 } } ], "facts": [ { "a": "SDK + MCP", "b": "HTTP API", "name": "Kind" }, { "a": "Celesto AI, Inc.", "b": "Deno Land Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "HTTP", "name": "Transports" }, { "a": "None", "b": "API key", "name": "Auth" }, { "a": "Freemium", "b": "Paid", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0", "b": "Proprietary service under the Deno Deploy terms and conditions. The `@deno/sandbox` and `deno-sandbox` SDKs are MIT", "name": "Licence" }, { "a": "no", "b": "yes", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-11-05", "b": "2026-07-22", "name": "Last release" }, { "a": "2026-10-30", "b": "2026-09-30", "name": "Terms last updated" }, { "a": "2026-10-30", "b": "2026-09-30", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "1.1k stars, 699 PyPI/wk", "b": "6 stars, 2k npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Deno Sandbox's 49.5 (D), and leads in 6 of 7 scored categories. Deno Sandbox leads on security \u0026 auth.", "question": "Which is better for AI agents, Celesto (formerly SmolVM) or Deno Sandbox?" }, { "answer": "No hosted endpoint is listed for Celesto (formerly SmolVM). No hosted endpoint is listed for Deno Sandbox.", "question": "Can an agent call Celesto (formerly SmolVM) and Deno Sandbox without installing anything?" }, { "answer": "Celesto (formerly SmolVM) is open source (Apache-2.0). No open-source release is listed for Deno Sandbox.", "question": "Are Celesto (formerly SmolVM) and Deno Sandbox open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 66 against 43", "Schema \u0026 documentation, 85 against 66", "Agent ergonomics, 69 against 60", "Payments \u0026 pricing, 60 against 20", "Maintenance \u0026 community, 81 against 45" ], "also": [ "No key needed to call it", "Free to start without a card", "Open source" ], "goodFor": "Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.", "slug": "celesto", "watchFor": "Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball" }, { "aheadOn": [ "Security \u0026 auth, 58 against 52" ], "also": null, "goodFor": "Short runs of untrusted or generated code that need outside API keys kept out of reach, for teams already on Deno Deploy, until Deploy closes six months after 9 October 2026.", "slug": "deno-sandbox", "watchFor": "Deno Deploy, which runs Sandbox, shuts down six months after the 9 October 2026 announcement, and Deno is moving its development to Cloudflare" } ], "history": { "celesto": null, "deno-sandbox": [ { "causes": [ "product", "correction" ], "date": "2026-11-04", "delta": -0.9, "from": 50.4, "fromGrade": "D", "to": 49.5, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 50.3, "fromGrade": "D", "to": 50.4, "toGrade": "D" } ] }, "job": { "capability": "sandbox.code", "name": "Code sandboxes" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.json", "title": "Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-deno-sandbox.json", "title": "Amazon Bedrock AgentCore Code Interpreter vs Deno Sandbox", "url": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-deno-sandbox" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.json", "title": "Blaxel Sandboxes vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-deno-sandbox.json", "title": "Blaxel Sandboxes vs Deno Sandbox", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-deno-sandbox" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.json", "title": "Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK", "url": "https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-daytona.json", "title": "Celesto (formerly SmolVM) vs Daytona", "url": "https://www.anchorterminal.com/compare/celesto-vs-daytona" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.json", "title": "Celesto (formerly SmolVM) vs DeltaBox Lite", "url": "https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-e2b.json", "title": "Celesto (formerly SmolVM) vs E2B", "url": "https://www.anchorterminal.com/compare/celesto-vs-e2b" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-freestyle.json", "title": "Celesto (formerly SmolVM) vs Freestyle", "url": "https://www.anchorterminal.com/compare/celesto-vs-freestyle" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-instavm.json", "title": "Celesto (formerly SmolVM) vs InstaVM", "url": "https://www.anchorterminal.com/compare/celesto-vs-instavm" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-maritime.json", "title": "Celesto (formerly SmolVM) vs Maritime", "url": "https://www.anchorterminal.com/compare/celesto-vs-maritime" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.json", "title": "Celesto (formerly SmolVM) vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.json", "title": "Celesto (formerly SmolVM) vs Modal Sandboxes", "url": "https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.json", "title": "Celesto (formerly SmolVM) vs Morph Cloud", "url": "https://www.anchorterminal.com/compare/celesto-vs-morph-cloud" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-offscreen.json", "title": "Celesto (formerly SmolVM) vs Offscreen", "url": "https://www.anchorterminal.com/compare/celesto-vs-offscreen" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.json", "title": "Celesto (formerly SmolVM) vs SPACE", "url": "https://www.anchorterminal.com/compare/celesto-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-runloop.json", "title": "Celesto (formerly SmolVM) vs Runloop Devboxes", "url": "https://www.anchorterminal.com/compare/celesto-vs-runloop" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-sandbox0.json", "title": "Celesto (formerly SmolVM) vs Sandbox0", "url": "https://www.anchorterminal.com/compare/celesto-vs-sandbox0" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-sprites.json", "title": "Celesto (formerly SmolVM) vs Sprites", "url": "https://www.anchorterminal.com/compare/celesto-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.json", "title": "Celesto (formerly SmolVM) vs Together Code Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.json", "title": "Celesto (formerly SmolVM) vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-deno-sandbox.json", "title": "Cloudflare Sandbox SDK vs Deno Sandbox", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-deno-sandbox" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-deno-sandbox.json", "title": "Daytona vs Deno Sandbox", "url": "https://www.anchorterminal.com/compare/daytona-vs-deno-sandbox" }, { "json": "https://www.anchorterminal.com/compare/deno-sandbox-vs-e2b.json", "title": "Deno Sandbox vs E2B", "url": "https://www.anchorterminal.com/compare/deno-sandbox-vs-e2b" }, { "json": "https://www.anchorterminal.com/compare/deno-sandbox-vs-freestyle.json", "title": "Deno Sandbox vs Freestyle", "url": "https://www.anchorterminal.com/compare/deno-sandbox-vs-freestyle" }, { "json": "https://www.anchorterminal.com/compare/deno-sandbox-vs-instavm.json", "title": "Deno Sandbox vs InstaVM", "url": "https://www.anchorterminal.com/compare/deno-sandbox-vs-instavm" }, { "json": "https://www.anchorterminal.com/compare/deno-sandbox-vs-maritime.json", "title": "Deno Sandbox vs Maritime", "url": "https://www.anchorterminal.com/compare/deno-sandbox-vs-maritime" }, { "json": "https://www.anchorterminal.com/compare/deno-sandbox-vs-microsoft-execution-containers.json", "title": "Deno Sandbox vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/deno-sandbox-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/deno-sandbox-vs-modal-sandboxes.json", "title": "Deno Sandbox vs Modal Sandboxes", "url": "https://www.anchorterminal.com/compare/deno-sandbox-vs-modal-sandboxes" }, { "json": "https://www.anchorterminal.com/compare/deno-sandbox-vs-morph-cloud.json", "title": "Deno Sandbox vs Morph Cloud", "url": "https://www.anchorterminal.com/compare/deno-sandbox-vs-morph-cloud" }, { "json": "https://www.anchorterminal.com/compare/deno-sandbox-vs-offscreen.json", "title": "Deno Sandbox vs Offscreen", "url": "https://www.anchorterminal.com/compare/deno-sandbox-vs-offscreen" }, { "json": "https://www.anchorterminal.com/compare/deno-sandbox-vs-perplexity-space.json", "title": "Deno Sandbox vs SPACE", "url": "https://www.anchorterminal.com/compare/deno-sandbox-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/deno-sandbox-vs-runloop.json", "title": "Deno Sandbox vs Runloop Devboxes", "url": "https://www.anchorterminal.com/compare/deno-sandbox-vs-runloop" }, { "json": "https://www.anchorterminal.com/compare/deno-sandbox-vs-sandbox0.json", "title": "Deno Sandbox vs Sandbox0", "url": "https://www.anchorterminal.com/compare/deno-sandbox-vs-sandbox0" }, { "json": "https://www.anchorterminal.com/compare/deno-sandbox-vs-sprites.json", "title": "Deno Sandbox vs Sprites", "url": "https://www.anchorterminal.com/compare/deno-sandbox-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/deno-sandbox-vs-together-code-sandbox.json", "title": "Deno Sandbox vs Together Code Sandbox", "url": "https://www.anchorterminal.com/compare/deno-sandbox-vs-together-code-sandbox" }, { "json": "https://www.anchorterminal.com/compare/deno-sandbox-vs-vercel-sandbox.json", "title": "Deno Sandbox vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/deno-sandbox-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/agent37-vs-celesto.json", "title": "Agent 37 Cloud vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/agent37-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/agent37-vs-deno-sandbox.json", "title": "Agent 37 Cloud vs Deno Sandbox", "url": "https://www.anchorterminal.com/compare/agent37-vs-deno-sandbox" }, { "json": "https://www.anchorterminal.com/compare/deltabox-lite-vs-deno-sandbox.json", "title": "DeltaBox Lite vs Deno Sandbox", "url": "https://www.anchorterminal.com/compare/deltabox-lite-vs-deno-sandbox" } ], "panel": null, "scores": [ { "by": 23, "celesto": 66, "deno-sandbox": 43, "edge": "celesto", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 19, "celesto": 85, "deno-sandbox": 66, "edge": "celesto", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 9, "celesto": 69, "deno-sandbox": 60, "edge": "celesto", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "by": 6, "celesto": 52, "deno-sandbox": 58, "edge": "deno-sandbox", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "by": 40, "celesto": 60, "deno-sandbox": 20, "edge": "celesto", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 36, "celesto": 81, "deno-sandbox": 45, "edge": "celesto", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 3, "celesto": 70, "deno-sandbox": 67, "edge": "celesto", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Deno Sandbox's 49.5 (D), and leads in 6 of 7 scored categories. Deno Sandbox leads on security \u0026 auth. Both do code sandboxes.", "tasks": null, "tutorials": [], "verdicts": { "celesto": "Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.", "deno-sandbox": "Secrets stay outside the microVM and are substituted only on outbound requests to approved hosts, and an allowlist limits egress. Deno Deploy, which runs it, is due to shut down six months after 9 October 2026, when Deno announced it is joining Cloudflare. The service is still in beta, needs the $20 Pro plan and caps lifetime at 30 minutes." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox", "json": "https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.min.md" }, "markdown": "Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Deno Sandbox's 49.5 (D), and leads in 6 of 7 scored categories. Deno Sandbox leads on security \u0026 auth. Both do code sandboxes.\n\n- Celesto (formerly SmolVM): grade B, 68/100, rank #298 of 1486. Markdown https://www.anchorterminal.com/tools/celesto.md · JSON https://www.anchorterminal.com/api/v1/tools/celesto.json\n- Deno Sandbox: grade D, 49.5/100, rank #1081 of 1486. Markdown https://www.anchorterminal.com/tools/deno-sandbox.md · JSON https://www.anchorterminal.com/api/v1/tools/deno-sandbox.json\n- Best code execution sandboxes for AI agents: https://www.anchorterminal.com/best/code-sandboxes/index.md\n- All 231 sandboxes comparisons: https://www.anchorterminal.com/compare/code-sandboxes/index.md\n\n## Which one, for what\n\n### Celesto (formerly SmolVM) (B)\n\nGood for: Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.\n\nAhead on:\n- Reliability, 66 against 43\n- Schema \u0026 documentation, 85 against 66\n- Agent ergonomics, 69 against 60\n- Payments \u0026 pricing, 60 against 20\n- Maintenance \u0026 community, 81 against 45\n\nAlso in its favour:\n- No key needed to call it\n- Free to start without a card\n- Open source\n\nWatch for: Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball\n\n### Deno Sandbox (D)\n\nGood for: Short runs of untrusted or generated code that need outside API keys kept out of reach, for teams already on Deno Deploy, until Deploy closes six months after 9 October 2026.\n\nAhead on:\n- Security \u0026 auth, 58 against 52\n\nWatch for: Deno Deploy, which runs Sandbox, shuts down six months after the 9 October 2026 announcement, and Deno is moving its development to Cloudflare\n\n\n## Why the edge\n\n### Payments \u0026 pricing: Celesto (formerly SmolVM) +40\n\n- Celesto (formerly SmolVM) (60): Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.\n- Deno Sandbox (20): No x402, MPP or L402 (0). Unit prices are public without a login, $0.10 a CPU-hour, $0.025 a GiB-hour and $0.20 a GiB-month (20). The Free plan does not include sandboxes, and no trial was found (0). A person signs up at console.deno.com in a browser and creates the token (0). 0+20+0+0 = 20.\n\n### Maintenance \u0026 community: Celesto (formerly SmolVM) +36\n\n- Celesto (formerly SmolVM) (81): 0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.\n- Deno Sandbox (45): Deno 2.9.7 (16 September 2026, 49 days ago) includes a fix to how the `deno sandbox` command passes its arguments, the newest release touching the product. `deno-sandbox` 0.16.0 shipped on 22 July 2026, and `@deno/sandbox` 0.13.2 on 16 March per the 8 October check (20). One release in the 90 days from 6 August (0). The Deploy changelog stops at 12 March 2026. Support is by Discord, and by email on paid plans. The Python repository showed one open issue or pull request on 8 October (7). Official JavaScript and Python SDKs, the JavaScript one unchanged since March (12). The Python repository runs formatting, lint, type checks and offline tests in CI. The JavaScript SDK's source repository is not public (6). 20+0+7+12+6 = 45.\n\n### Reliability: Celesto (formerly SmolVM) +23\n\n- Celesto (formerly SmolVM) (66): Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.\n- Deno Sandbox (43): Hosted lines. denostatus.com runs on Instatus with history, but has no component for sandboxes (15 of 20). The 90 days from 6 August show one incident, request failures in `ord` on 7 September 2026, one region, so minor (20). Concurrency and resource limits are published, though the docs (5 per organisation) and the pricing table (3 per region on Pro) differ, and no API request limits were found (8, a partial value kept). No 429 or retry guidance and no idempotency keys found (0). The pricing table lists a 99.95 per cent reliability SLA for Enterprise, with no SLA document found (0). Beta, pre-release per the docs (0). 15+20+8+0+0+0 = 43.\n\n### Schema \u0026 documentation: Celesto (formerly SmolVM) +19\n\n- Celesto (formerly SmolVM) (85): Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.\n- Deno Sandbox (66): The published OpenAPI document has no sandbox operations, so the typed TypeScript SDK reference on JSR and the typed Python SDK count as 15 of 25 (15). llms.txt and every docs page as Markdown (10). The docs state use cases, when to choose a duration timeout and when to move work to a Deploy app (13). Typed options with stated ranges for memory, capacity and timeout (12). Examples in JavaScript, sync and async Python and the CLI. No error reference was found, and two pages disagree on the default network policy (8). SDKs are versioned at 0.x, and the Deploy changelog's newest entry is 12 March 2026 (8). 15+10+13+12+8+8 = 66.\n\n### Agent ergonomics: Celesto (formerly SmolVM) +9\n\n- Celesto (formerly SmolVM) (69): A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). `computer list`, `logs --follow` and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). `with Computer()` creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.\n- Deno Sandbox (60): Sandbox and volume objects are small, and command output streams (15). Lists use cursor pagination with search, label and status filters (15). The Python SDK raises errors with a status, code, message and trace id, and validation errors with a field path, but the codes are not documented (10). No idempotency keys. A duration sandbox can be rejoined by id, and volume slugs are unique per organisation (5). `Sandbox.create()` needs no parameters, with JavaScript and Python SDKs and a CLI (15). 15+15+10+5+15 = 60.\n\n### Security \u0026 auth: Deno Sandbox +6\n\n- Celesto (formerly SmolVM) (52): Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.\n- Deno Sandbox (58): One organisation token with no scopes or expiry found, rotatable from the dashboard, which also manages the organisation's Deploy apps. All members hold owner permissions (15). An outbound allowlist and read-only volume mounts exist, but outbound access is open unless `allowNet` is set, per the Security page (13). Secret substitution outside the VM is documented as a defence against prompt injection followed by exfiltration (13). Commands, HTTP requests and SSH sessions are traced in the dashboard with an event log (10). A disclosure policy with safe harbour and a reporting route at security@deno.com, with no acknowledgement time, and a security.txt without an Expires field (7). The SOC2 and ISO27001 claims read on 8 October are no longer on the product or pricing pages, and no bug bounty was found. `exposeHttp` URLs are public without authentication, which the docs state in capitals. 15+13+13+10+7 = 58.\n\n## Score by category\n\n| Category | Weight | Celesto (formerly SmolVM) | Deno Sandbox | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 66 | 43 | Celesto (formerly SmolVM) +23 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 85 | 66 | Celesto (formerly SmolVM) +19 |\n| Agent ergonomics | 13% (16.2 this run) | 69 | 60 | Celesto (formerly SmolVM) +9 |\n| Security \u0026 auth | 14% (17.5 this run) | 52 | 58 | Deno Sandbox +6 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 20 | Celesto (formerly SmolVM) +40 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 81 | 45 | Celesto (formerly SmolVM) +36 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 70 | 67 | Celesto (formerly SmolVM) +3 |\n| Negative events | ≤15 | 0 | -2 | |\n| **Total** | | **68 · B** | **49.5 · D** | |\n\n## Facts side by side\n\n| Fact | Celesto (formerly SmolVM) | Deno Sandbox |\n| --- | --- | --- |\n| Kind | SDK + MCP | HTTP API |\n| Vendor | Celesto AI, Inc. | Deno Land Inc. |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | HTTP |\n| Auth | None | API key |\n| Pricing | Freemium | Paid |\n| x402 | no | no |\n| Licence | Apache-2.0 | Proprietary service under the Deno Deploy terms and conditions. The `@deno/sandbox` and `deno-sandbox` SDKs are MIT |\n| Read-only variant documented | no | yes |\n| llms.txt | yes | yes |\n| Last release | 2026-11-05 | 2026-07-22 |\n| Terms last updated | 2026-10-30 | 2026-09-30 |\n| Privacy policy last updated | 2026-10-30 | 2026-09-30 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | not found in the text | yes |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | 1.1k stars, 699 PyPI/wk | 6 stars, 2k npm/wk |\n\n## How the scores have moved\n\n### Celesto (formerly SmolVM)\n\nNo score change since it was listed.\n\n### Deno Sandbox\n\n- -0.9 on 4 November 2026: product, correction\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**Celesto (formerly SmolVM).** Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.\n\n**Deno Sandbox.** Secrets stay outside the microVM and are substituted only on outbound requests to approved hosts, and an allowlist limits egress. Deno Deploy, which runs it, is due to shut down six months after 9 October 2026, when Deno announced it is joining Cloudflare. The service is still in beta, needs the $20 Pro plan and caps lifetime at 30 minutes.\n\n## Before you call either\n\n### Celesto (formerly SmolVM)\n\n1. Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text\n2. Create computers with unique names and delete them by exact name when the job ends, including after failures\n3. Set `internet_settings={\"mode\": \"off\"}` or `restricted` for untrusted code, since the default is open\n4. Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine\n5. Never paste browser or display connection URLs into model context; possession of the URL grants control\n\n### Deno Sandbox\n\n1. Set `DENO_DEPLOY_TOKEN` to an organisation token (prefix `ddo_`) from Settings in console.deno.com. The organisation must be on Pro or above\n2. Pass `allowNet` on every `Sandbox.create()`. The Security page says outbound access is unrestricted when it is omitted\n3. Pass credentials through `secrets` with a `hosts` list, not `env`, so code in the VM sees only a placeholder\n4. The default timeout ends the VM when the client disconnects. Pass a duration such as `\"10m\"` and reconnect with `Sandbox.connect({ id })`, up to 30 minutes\n5. Create volumes in `ord` and start the sandbox in `ord`. A volume mounts only in its own region\n6. `exposeHttp` URLs are public with no authentication. Treat the random subdomain as a secret\n7. Plan a move before Deno Deploy closes, six months after 9 October 2026. Deno gives migration support to Cloudflare Workers for paying customers only\n\n## Questions\n\n### Which is better for AI agents, Celesto (formerly SmolVM) or Deno Sandbox?\n\nCelesto (formerly SmolVM) scores 68 (B) on agent readiness against Deno Sandbox's 49.5 (D), and leads in 6 of 7 scored categories. Deno Sandbox leads on security \u0026 auth.\n\n### Can an agent call Celesto (formerly SmolVM) and Deno Sandbox without installing anything?\n\nNo hosted endpoint is listed for Celesto (formerly SmolVM). No hosted endpoint is listed for Deno Sandbox.\n\n### Are Celesto (formerly SmolVM) and Deno Sandbox open source?\n\nCelesto (formerly SmolVM) is open source (Apache-2.0). No open-source release is listed for Deno Sandbox.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.json, and with the fewest tokens: https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"celesto\", \"b\": \"deno-sandbox\"}`. From a terminal: `anchor compare celesto deno-sandbox`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/celesto.json and https://www.anchorterminal.com/api/v1/tools/deno-sandbox.json\n\n## Other comparisons with Celesto (formerly SmolVM) or Deno Sandbox\n\n- [Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.md)\n- [Amazon Bedrock AgentCore Code Interpreter vs Deno Sandbox](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-deno-sandbox.md)\n- [Blaxel Sandboxes vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.md)\n- [Blaxel Sandboxes vs Deno Sandbox](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-deno-sandbox.md)\n- [Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.md)\n- [Celesto (formerly SmolVM) vs Daytona](https://www.anchorterminal.com/compare/celesto-vs-daytona.md)\n- [Celesto (formerly SmolVM) vs DeltaBox Lite](https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.md)\n- [Celesto (formerly SmolVM) vs E2B](https://www.anchorterminal.com/compare/celesto-vs-e2b.md)\n- [Celesto (formerly SmolVM) vs Freestyle](https://www.anchorterminal.com/compare/celesto-vs-freestyle.md)\n- [Celesto (formerly SmolVM) vs InstaVM](https://www.anchorterminal.com/compare/celesto-vs-instavm.md)\n- [Celesto (formerly SmolVM) vs Maritime](https://www.anchorterminal.com/compare/celesto-vs-maritime.md)\n- [Celesto (formerly SmolVM) vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.md)\n- [Celesto (formerly SmolVM) vs Modal Sandboxes](https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.md)\n- [Celesto (formerly SmolVM) vs Morph Cloud](https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.md)\n- [Celesto (formerly SmolVM) vs Offscreen](https://www.anchorterminal.com/compare/celesto-vs-offscreen.md)\n- [Celesto (formerly SmolVM) vs SPACE](https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.md)\n- [Celesto (formerly SmolVM) vs Runloop Devboxes](https://www.anchorterminal.com/compare/celesto-vs-runloop.md)\n- [Celesto (formerly SmolVM) vs Sandbox0](https://www.anchorterminal.com/compare/celesto-vs-sandbox0.md)\n- [Celesto (formerly SmolVM) vs Sprites](https://www.anchorterminal.com/compare/celesto-vs-sprites.md)\n- [Celesto (formerly SmolVM) vs Together Code Sandbox](https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.md)\n- [Celesto (formerly SmolVM) vs Vercel Sandbox](https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.md)\n- [Cloudflare Sandbox SDK vs Deno Sandbox](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-deno-sandbox.md)\n- [Daytona vs Deno Sandbox](https://www.anchorterminal.com/compare/daytona-vs-deno-sandbox.md)\n- [Deno Sandbox vs E2B](https://www.anchorterminal.com/compare/deno-sandbox-vs-e2b.md)\n- [Deno Sandbox vs Freestyle](https://www.anchorterminal.com/compare/deno-sandbox-vs-freestyle.md)\n- [Deno Sandbox vs InstaVM](https://www.anchorterminal.com/compare/deno-sandbox-vs-instavm.md)\n- [Deno Sandbox vs Maritime](https://www.anchorterminal.com/compare/deno-sandbox-vs-maritime.md)\n- [Deno Sandbox vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/deno-sandbox-vs-microsoft-execution-containers.md)\n- [Deno Sandbox vs Modal Sandboxes](https://www.anchorterminal.com/compare/deno-sandbox-vs-modal-sandboxes.md)\n- [Deno Sandbox vs Morph Cloud](https://www.anchorterminal.com/compare/deno-sandbox-vs-morph-cloud.md)\n- [Deno Sandbox vs Offscreen](https://www.anchorterminal.com/compare/deno-sandbox-vs-offscreen.md)\n- [Deno Sandbox vs SPACE](https://www.anchorterminal.com/compare/deno-sandbox-vs-perplexity-space.md)\n- [Deno Sandbox vs Runloop Devboxes](https://www.anchorterminal.com/compare/deno-sandbox-vs-runloop.md)\n- [Deno Sandbox vs Sandbox0](https://www.anchorterminal.com/compare/deno-sandbox-vs-sandbox0.md)\n- [Deno Sandbox vs Sprites](https://www.anchorterminal.com/compare/deno-sandbox-vs-sprites.md)\n- [Deno Sandbox vs Together Code Sandbox](https://www.anchorterminal.com/compare/deno-sandbox-vs-together-code-sandbox.md)\n- [Deno Sandbox vs Vercel Sandbox](https://www.anchorterminal.com/compare/deno-sandbox-vs-vercel-sandbox.md)\n- [Agent 37 Cloud vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agent37-vs-celesto.md)\n- [Agent 37 Cloud vs Deno Sandbox](https://www.anchorterminal.com/compare/agent37-vs-deno-sandbox.md)\n- [DeltaBox Lite vs Deno Sandbox](https://www.anchorterminal.com/compare/deltabox-lite-vs-deno-sandbox.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Celesto (formerly SmolVM) vs Deno Sandbox", "url": "" } ], "description": "Celesto scores 68 (B) to Deno Sandbox's 49.5 (D) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Celesto (formerly SmolVM) B 68", "Deno Sandbox D 49.5", "scores" ], "h1": "Celesto (formerly SmolVM) vs Deno Sandbox", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/celesto-vs-deno-sandbox", "published": "2026-10-01", "section": "tools", "title": "Celesto vs Deno Sandbox for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox" }, "tokens": { "markdown": 5300, "slim": 2830 }, "version": 1 }