# Celesto (formerly SmolVM) vs Deno Sandbox (slim)

> Celesto scores 68 (B) to Deno Sandbox's 49.5 (D) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.md (~5,300 tokens) · this version ~2,830 tokens · JSON https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.json · canonical https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Deno Sandbox's 49.5 (D), and leads in 6 of 7 scored categories. Deno Sandbox leads on security & auth. Both do code sandboxes.

- Celesto (formerly SmolVM): B 68, rank #298 of 1486 · https://www.anchorterminal.com/tools/celesto.min.md
- Deno Sandbox: D 49.5, rank #1081 of 1486 · https://www.anchorterminal.com/tools/deno-sandbox.min.md
- Celesto (formerly SmolVM), good for Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud. Ahead on Reliability, 66 against 43; Schema & documentation, 85 against 66; Agent ergonomics, 69 against 60; Payments & pricing, 60 against 20; Maintenance & community, 81 against 45. Also No key needed to call it; Free to start without a card; Open source.
- Deno Sandbox, good for Short runs of untrusted or generated code that need outside API keys kept out of reach, for teams already on Deno Deploy, until Deploy closes six months after 9 October 2026. Ahead on Security & auth, 58 against 52.

| Category | Celesto (formerly SmolVM) | Deno Sandbox |
| --- | --- | --- |
| Reliability (16%) | 66 | 43 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 85 | 66 |
| Agent ergonomics (13%) | 69 | 60 |
| Security & auth (14%) | 52 | 58 |
| Payments & pricing (10%) | 60 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 81 | 45 |
| Transparency & trust (7%) | 70 | 67 |

| Fact (where they differ) | Celesto (formerly SmolVM) | Deno Sandbox |
| --- | --- | --- |
| Kind | SDK + MCP | HTTP API |
| Vendor | Celesto AI, Inc. | Deno Land Inc. |
| Transports |  | HTTP |
| Auth | None | API key |
| Pricing | Freemium | Paid |
| Licence | Apache-2.0 | Proprietary service under the Deno Deploy terms and conditions. The `@deno/sandbox` and `deno-sandbox` SDKs are MIT |
| Read-only variant documented | no | yes |
| Last release | 2026-11-05 | 2026-07-22 |
| Terms last updated | 2026-10-30 | 2026-09-30 |
| Privacy policy last updated | 2026-10-30 | 2026-09-30 |
| Terms restrict benchmarking | not found in the text | yes |
| Terms or service can change without notice | not found in the text | yes |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 1.1k stars, 699 PyPI/wk | 6 stars, 2k npm/wk |

Why the edge:
- Payments & pricing, Celesto (formerly SmolVM) +40: Celesto (formerly SmolVM) 60 (Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.); Deno Sandbox 20 (No x402, MPP or L402 (0). Unit prices are public without a login, $0.10 a CPU-hour, $0.025 a GiB-hour and $0.20 a GiB-month (20). The Free plan does not include sandboxes, and no trial was found (0). A person signs up at console.deno.com in a browser and creates the token (0). 0+20+0+0 = 20.)
- Maintenance & community, Celesto (formerly SmolVM) +36: Celesto (formerly SmolVM) 81 (0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.); Deno Sandbox 45 (Deno 2.9.7 (16 September 2026, 49 days ago) includes a fix to how the `deno sandbox` command passes its arguments, the newest release touching the product. `deno-sandbox` 0.16.0 shipped on 22 July 2026, and `@deno/sandbox` 0.13.2 on 16 March per the 8 October check (20). One release in the 90 days from 6 August (0). The Deploy changelog stops at 12 March 2026. Support is by Discord, and by email on paid plans. The Python repository showed one open issue or pull request on 8 October (7). Official JavaScript and Python SDKs, the JavaScript one unchanged since March (12). The Python repository runs formatting, lint, type checks and offline tests in CI. The JavaScript SDK's source repository is not public (6). 20+0+7+12+6 = 45.)
- Reliability, Celesto (formerly SmolVM) +23: Celesto (formerly SmolVM) 66 (Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.); Deno Sandbox 43 (Hosted lines. denostatus.com runs on Instatus with history, but has no component for sandboxes (15 of 20). The 90 days from 6 August show one incident, request failures in `ord` on 7 September 2026, one region, so minor (20). Concurrency and resource limits are published, though the docs (5 per organisation) and the pricing table (3 per region on Pro) differ, and no API request limits were found (8, a partial value kept). No 429 or retry guidance and no idempotency keys found (0). The pricing table lists a 99.95 per cent reliability SLA for Enterprise, with no SLA document found (0). Beta, pre-release per the docs (0). 15+20+8+0+0+0 = 43.)
- Schema & documentation, Celesto (formerly SmolVM) +19: Celesto (formerly SmolVM) 85 (Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.); Deno Sandbox 66 (The published OpenAPI document has no sandbox operations, so the typed TypeScript SDK reference on JSR and the typed Python SDK count as 15 of 25 (15). llms.txt and every docs page as Markdown (10). The docs state use cases, when to choose a duration timeout and when to move work to a Deploy app (13). Typed options with stated ranges for memory, capacity and timeout (12). Examples in JavaScript, sync and async Python and the CLI. No error reference was found, and two pages disagree on the default network policy (8). SDKs are versioned at 0.x, and the Deploy changelog's newest entry is 12 March 2026 (8). 15+10+13+12+8+8 = 66.)
- Agent ergonomics, Celesto (formerly SmolVM) +9: Celesto (formerly SmolVM) 69 (A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). `computer list`, `logs --follow` and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). `with Computer()` creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.); Deno Sandbox 60 (Sandbox and volume objects are small, and command output streams (15). Lists use cursor pagination with search, label and status filters (15). The Python SDK raises errors with a status, code, message and trace id, and validation errors with a field path, but the codes are not documented (10). No idempotency keys. A duration sandbox can be rejoined by id, and volume slugs are unique per organisation (5). `Sandbox.create()` needs no parameters, with JavaScript and Python SDKs and a CLI (15). 15+15+10+5+15 = 60.)
- Security & auth, Deno Sandbox +6: Celesto (formerly SmolVM) 52 (Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.); Deno Sandbox 58 (One organisation token with no scopes or expiry found, rotatable from the dashboard, which also manages the organisation's Deploy apps. All members hold owner permissions (15). An outbound allowlist and read-only volume mounts exist, but outbound access is open unless `allowNet` is set, per the Security page (13). Secret substitution outside the VM is documented as a defence against prompt injection followed by exfiltration (13). Commands, HTTP requests and SSH sessions are traced in the dashboard with an event log (10). A disclosure policy with safe harbour and a reporting route at security@deno.com, with no acknowledgement time, and a security.txt without an Expires field (7). The SOC2 and ISO27001 claims read on 8 October are no longer on the product or pricing pages, and no bug bounty was found. `exposeHttp` URLs are public without authentication, which the docs state in capitals. 15+13+13+10+7 = 58.)