# Celesto (formerly SmolVM) vs Deno Sandbox

> Celesto scores 68 (B) to Deno Sandbox's 49.5 (D) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox
- Markdown: https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.md (~5,300 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Deno Sandbox's 49.5 (D), and leads in 6 of 7 scored categories. Deno Sandbox leads on security & auth. Both do code sandboxes.

- Celesto (formerly SmolVM): grade B, 68/100, rank #298 of 1486. Markdown https://www.anchorterminal.com/tools/celesto.md · JSON https://www.anchorterminal.com/api/v1/tools/celesto.json
- Deno Sandbox: grade D, 49.5/100, rank #1081 of 1486. Markdown https://www.anchorterminal.com/tools/deno-sandbox.md · JSON https://www.anchorterminal.com/api/v1/tools/deno-sandbox.json
- Best code execution sandboxes for AI agents: https://www.anchorterminal.com/best/code-sandboxes/index.md
- All 231 sandboxes comparisons: https://www.anchorterminal.com/compare/code-sandboxes/index.md

## Which one, for what

### Celesto (formerly SmolVM) (B)

Good for: Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.

Ahead on:
- Reliability, 66 against 43
- Schema & documentation, 85 against 66
- Agent ergonomics, 69 against 60
- Payments & pricing, 60 against 20
- Maintenance & community, 81 against 45

Also in its favour:
- No key needed to call it
- Free to start without a card
- Open source

Watch for: Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball

### Deno Sandbox (D)

Good for: Short runs of untrusted or generated code that need outside API keys kept out of reach, for teams already on Deno Deploy, until Deploy closes six months after 9 October 2026.

Ahead on:
- Security & auth, 58 against 52

Watch for: Deno Deploy, which runs Sandbox, shuts down six months after the 9 October 2026 announcement, and Deno is moving its development to Cloudflare


## Why the edge

### Payments & pricing: Celesto (formerly SmolVM) +40

- Celesto (formerly SmolVM) (60): Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.
- Deno Sandbox (20): No x402, MPP or L402 (0). Unit prices are public without a login, $0.10 a CPU-hour, $0.025 a GiB-hour and $0.20 a GiB-month (20). The Free plan does not include sandboxes, and no trial was found (0). A person signs up at console.deno.com in a browser and creates the token (0). 0+20+0+0 = 20.

### Maintenance & community: Celesto (formerly SmolVM) +36

- Celesto (formerly SmolVM) (81): 0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.
- Deno Sandbox (45): Deno 2.9.7 (16 September 2026, 49 days ago) includes a fix to how the `deno sandbox` command passes its arguments, the newest release touching the product. `deno-sandbox` 0.16.0 shipped on 22 July 2026, and `@deno/sandbox` 0.13.2 on 16 March per the 8 October check (20). One release in the 90 days from 6 August (0). The Deploy changelog stops at 12 March 2026. Support is by Discord, and by email on paid plans. The Python repository showed one open issue or pull request on 8 October (7). Official JavaScript and Python SDKs, the JavaScript one unchanged since March (12). The Python repository runs formatting, lint, type checks and offline tests in CI. The JavaScript SDK's source repository is not public (6). 20+0+7+12+6 = 45.

### Reliability: Celesto (formerly SmolVM) +23

- Celesto (formerly SmolVM) (66): Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.
- Deno Sandbox (43): Hosted lines. denostatus.com runs on Instatus with history, but has no component for sandboxes (15 of 20). The 90 days from 6 August show one incident, request failures in `ord` on 7 September 2026, one region, so minor (20). Concurrency and resource limits are published, though the docs (5 per organisation) and the pricing table (3 per region on Pro) differ, and no API request limits were found (8, a partial value kept). No 429 or retry guidance and no idempotency keys found (0). The pricing table lists a 99.95 per cent reliability SLA for Enterprise, with no SLA document found (0). Beta, pre-release per the docs (0). 15+20+8+0+0+0 = 43.

### Schema & documentation: Celesto (formerly SmolVM) +19

- Celesto (formerly SmolVM) (85): Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.
- Deno Sandbox (66): The published OpenAPI document has no sandbox operations, so the typed TypeScript SDK reference on JSR and the typed Python SDK count as 15 of 25 (15). llms.txt and every docs page as Markdown (10). The docs state use cases, when to choose a duration timeout and when to move work to a Deploy app (13). Typed options with stated ranges for memory, capacity and timeout (12). Examples in JavaScript, sync and async Python and the CLI. No error reference was found, and two pages disagree on the default network policy (8). SDKs are versioned at 0.x, and the Deploy changelog's newest entry is 12 March 2026 (8). 15+10+13+12+8+8 = 66.

### Agent ergonomics: Celesto (formerly SmolVM) +9

- Celesto (formerly SmolVM) (69): A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). `computer list`, `logs --follow` and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). `with Computer()` creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.
- Deno Sandbox (60): Sandbox and volume objects are small, and command output streams (15). Lists use cursor pagination with search, label and status filters (15). The Python SDK raises errors with a status, code, message and trace id, and validation errors with a field path, but the codes are not documented (10). No idempotency keys. A duration sandbox can be rejoined by id, and volume slugs are unique per organisation (5). `Sandbox.create()` needs no parameters, with JavaScript and Python SDKs and a CLI (15). 15+15+10+5+15 = 60.

### Security & auth: Deno Sandbox +6

- Celesto (formerly SmolVM) (52): Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.
- Deno Sandbox (58): One organisation token with no scopes or expiry found, rotatable from the dashboard, which also manages the organisation's Deploy apps. All members hold owner permissions (15). An outbound allowlist and read-only volume mounts exist, but outbound access is open unless `allowNet` is set, per the Security page (13). Secret substitution outside the VM is documented as a defence against prompt injection followed by exfiltration (13). Commands, HTTP requests and SSH sessions are traced in the dashboard with an event log (10). A disclosure policy with safe harbour and a reporting route at security@deno.com, with no acknowledgement time, and a security.txt without an Expires field (7). The SOC2 and ISO27001 claims read on 8 October are no longer on the product or pricing pages, and no bug bounty was found. `exposeHttp` URLs are public without authentication, which the docs state in capitals. 15+13+13+10+7 = 58.

## Score by category

| Category | Weight | Celesto (formerly SmolVM) | Deno Sandbox | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 66 | 43 | Celesto (formerly SmolVM) +23 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 85 | 66 | Celesto (formerly SmolVM) +19 |
| Agent ergonomics | 13% (16.2 this run) | 69 | 60 | Celesto (formerly SmolVM) +9 |
| Security & auth | 14% (17.5 this run) | 52 | 58 | Deno Sandbox +6 |
| Payments & pricing | 10% (12.5 this run) | 60 | 20 | Celesto (formerly SmolVM) +40 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 81 | 45 | Celesto (formerly SmolVM) +36 |
| Transparency & trust | 7% (8.8 this run) | 70 | 67 | Celesto (formerly SmolVM) +3 |
| Negative events | ≤15 | 0 | -2 | |
| **Total** | | **68 · B** | **49.5 · D** | |

## Facts side by side

| Fact | Celesto (formerly SmolVM) | Deno Sandbox |
| --- | --- | --- |
| Kind | SDK + MCP | HTTP API |
| Vendor | Celesto AI, Inc. | Deno Land Inc. |
| Hosted endpoint | no (local only) | no (local only) |
| Transports |  | HTTP |
| Auth | None | API key |
| Pricing | Freemium | Paid |
| x402 | no | no |
| Licence | Apache-2.0 | Proprietary service under the Deno Deploy terms and conditions. The `@deno/sandbox` and `deno-sandbox` SDKs are MIT |
| Read-only variant documented | no | yes |
| llms.txt | yes | yes |
| Last release | 2026-11-05 | 2026-07-22 |
| Terms last updated | 2026-10-30 | 2026-09-30 |
| Privacy policy last updated | 2026-10-30 | 2026-09-30 |
| Customer content may train models | not found in the text | not found in the text |
| Terms restrict automated access | not found in the text | not found in the text |
| Terms restrict benchmarking | not found in the text | yes |
| Terms or service can change without notice | not found in the text | yes |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 1.1k stars, 699 PyPI/wk | 6 stars, 2k npm/wk |

## How the scores have moved

### Celesto (formerly SmolVM)

No score change since it was listed.

### Deno Sandbox

- -0.9 on 4 November 2026: product, correction
- +0.1 on 27 October 2026: checklist

## Verdicts

**Celesto (formerly SmolVM).** Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.

**Deno Sandbox.** Secrets stay outside the microVM and are substituted only on outbound requests to approved hosts, and an allowlist limits egress. Deno Deploy, which runs it, is due to shut down six months after 9 October 2026, when Deno announced it is joining Cloudflare. The service is still in beta, needs the $20 Pro plan and caps lifetime at 30 minutes.

## Before you call either

### Celesto (formerly SmolVM)

1. Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text
2. Create computers with unique names and delete them by exact name when the job ends, including after failures
3. Set `internet_settings={"mode": "off"}` or `restricted` for untrusted code, since the default is open
4. Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine
5. Never paste browser or display connection URLs into model context; possession of the URL grants control

### Deno Sandbox

1. Set `DENO_DEPLOY_TOKEN` to an organisation token (prefix `ddo_`) from Settings in console.deno.com. The organisation must be on Pro or above
2. Pass `allowNet` on every `Sandbox.create()`. The Security page says outbound access is unrestricted when it is omitted
3. Pass credentials through `secrets` with a `hosts` list, not `env`, so code in the VM sees only a placeholder
4. The default timeout ends the VM when the client disconnects. Pass a duration such as `"10m"` and reconnect with `Sandbox.connect({ id })`, up to 30 minutes
5. Create volumes in `ord` and start the sandbox in `ord`. A volume mounts only in its own region
6. `exposeHttp` URLs are public with no authentication. Treat the random subdomain as a secret
7. Plan a move before Deno Deploy closes, six months after 9 October 2026. Deno gives migration support to Cloudflare Workers for paying customers only

## Questions

### Which is better for AI agents, Celesto (formerly SmolVM) or Deno Sandbox?

Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Deno Sandbox's 49.5 (D), and leads in 6 of 7 scored categories. Deno Sandbox leads on security & auth.

### Can an agent call Celesto (formerly SmolVM) and Deno Sandbox without installing anything?

No hosted endpoint is listed for Celesto (formerly SmolVM). No hosted endpoint is listed for Deno Sandbox.

### Are Celesto (formerly SmolVM) and Deno Sandbox open source?

Celesto (formerly SmolVM) is open source (Apache-2.0). No open-source release is listed for Deno Sandbox.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.json, and with the fewest tokens: https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "celesto", "b": "deno-sandbox"}`. From a terminal: `anchor compare celesto deno-sandbox`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/celesto.json and https://www.anchorterminal.com/api/v1/tools/deno-sandbox.json

## Other comparisons with Celesto (formerly SmolVM) or Deno Sandbox

- [Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Deno Sandbox](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-deno-sandbox.md)
- [Blaxel Sandboxes vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.md)
- [Blaxel Sandboxes vs Deno Sandbox](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-deno-sandbox.md)
- [Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.md)
- [Celesto (formerly SmolVM) vs Daytona](https://www.anchorterminal.com/compare/celesto-vs-daytona.md)
- [Celesto (formerly SmolVM) vs DeltaBox Lite](https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.md)
- [Celesto (formerly SmolVM) vs E2B](https://www.anchorterminal.com/compare/celesto-vs-e2b.md)
- [Celesto (formerly SmolVM) vs Freestyle](https://www.anchorterminal.com/compare/celesto-vs-freestyle.md)
- [Celesto (formerly SmolVM) vs InstaVM](https://www.anchorterminal.com/compare/celesto-vs-instavm.md)
- [Celesto (formerly SmolVM) vs Maritime](https://www.anchorterminal.com/compare/celesto-vs-maritime.md)
- [Celesto (formerly SmolVM) vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.md)
- [Celesto (formerly SmolVM) vs Modal Sandboxes](https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.md)
- [Celesto (formerly SmolVM) vs Morph Cloud](https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.md)
- [Celesto (formerly SmolVM) vs Offscreen](https://www.anchorterminal.com/compare/celesto-vs-offscreen.md)
- [Celesto (formerly SmolVM) vs SPACE](https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.md)
- [Celesto (formerly SmolVM) vs Runloop Devboxes](https://www.anchorterminal.com/compare/celesto-vs-runloop.md)
- [Celesto (formerly SmolVM) vs Sandbox0](https://www.anchorterminal.com/compare/celesto-vs-sandbox0.md)
- [Celesto (formerly SmolVM) vs Sprites](https://www.anchorterminal.com/compare/celesto-vs-sprites.md)
- [Celesto (formerly SmolVM) vs Together Code Sandbox](https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.md)
- [Celesto (formerly SmolVM) vs Vercel Sandbox](https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.md)
- [Cloudflare Sandbox SDK vs Deno Sandbox](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-deno-sandbox.md)
- [Daytona vs Deno Sandbox](https://www.anchorterminal.com/compare/daytona-vs-deno-sandbox.md)
- [Deno Sandbox vs E2B](https://www.anchorterminal.com/compare/deno-sandbox-vs-e2b.md)
- [Deno Sandbox vs Freestyle](https://www.anchorterminal.com/compare/deno-sandbox-vs-freestyle.md)
- [Deno Sandbox vs InstaVM](https://www.anchorterminal.com/compare/deno-sandbox-vs-instavm.md)
- [Deno Sandbox vs Maritime](https://www.anchorterminal.com/compare/deno-sandbox-vs-maritime.md)
- [Deno Sandbox vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/deno-sandbox-vs-microsoft-execution-containers.md)
- [Deno Sandbox vs Modal Sandboxes](https://www.anchorterminal.com/compare/deno-sandbox-vs-modal-sandboxes.md)
- [Deno Sandbox vs Morph Cloud](https://www.anchorterminal.com/compare/deno-sandbox-vs-morph-cloud.md)
- [Deno Sandbox vs Offscreen](https://www.anchorterminal.com/compare/deno-sandbox-vs-offscreen.md)
- [Deno Sandbox vs SPACE](https://www.anchorterminal.com/compare/deno-sandbox-vs-perplexity-space.md)
- [Deno Sandbox vs Runloop Devboxes](https://www.anchorterminal.com/compare/deno-sandbox-vs-runloop.md)
- [Deno Sandbox vs Sandbox0](https://www.anchorterminal.com/compare/deno-sandbox-vs-sandbox0.md)
- [Deno Sandbox vs Sprites](https://www.anchorterminal.com/compare/deno-sandbox-vs-sprites.md)
- [Deno Sandbox vs Together Code Sandbox](https://www.anchorterminal.com/compare/deno-sandbox-vs-together-code-sandbox.md)
- [Deno Sandbox vs Vercel Sandbox](https://www.anchorterminal.com/compare/deno-sandbox-vs-vercel-sandbox.md)
- [Agent 37 Cloud vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agent37-vs-celesto.md)
- [Agent 37 Cloud vs Deno Sandbox](https://www.anchorterminal.com/compare/agent37-vs-deno-sandbox.md)
- [DeltaBox Lite vs Deno Sandbox](https://www.anchorterminal.com/compare/deltabox-lite-vs-deno-sandbox.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp