Celesto (formerly SmolVM) vs Maritime

Celesto (formerly SmolVM) 66

Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as celesto with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.

Maritime 45

No status page found, status.maritime.sh still doesn't resolve, and none is linked from the docs, llms.txt or the security page (0). No readable incident history (5). Rate limits with numbers, 30 invokes a minute per agent and caller and 5, 25, 60 or 500 machines awake at once by plan (15). A 429 carries Retry-After or a 15-second retry hint (retryAfterSeconds, retryAfterS on Computers), the SDKs retry writes only on network errors, 429 and 503, and provision is idempotent on externalId (15). The terms (17 May 2026) say service is as available, with no SLA (0). Generally available since the YC launch, and Windows desktops left beta on 31 October (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

Celesto (formerly SmolVM) 69

A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). computer list, logs --follow and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). with Computer() creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.

Maritime 87

Context cost. Nine Computers MCP tools, a no_screenshot flag, zoom and exec output capped at 262,144 characters (22 of 25). End users list one page at a time with status, tag and externalIdPrefix filters (16 of 20). Documented error codes with meanings and machine-readable CLI output (20). Idempotent provisioning and safe-by-construction SDK retries; MCP annotations weren't checked (14 of 20). Official TypeScript and Python SDKs and a CLI with defaults (15).

Celesto (formerly SmolVM) 52

Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). computer logs shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.

Maritime 68

Scoped mk_ keys (provision, deploy, secrets, manage, computers), revocable, with short-lived end-user tokens; a default key is full-access (26 of 30). Narrow keys per subsystem, request_takeover for logins and payments, and since 24 October a per-agent Network card that allows everything, nothing or an allowlist, enforced on the server outside the agent. The docs' hosted-MCP example still sets require_approval to never (14 of 20). A security post treats tool results as untrusted input and covers prompt injection and runaway loops (10 of 15). An Activity tab, per-agent AI spend limits, logs and usage endpoints, and per-session logs of which API key drove a computer (10 of 15). A valid security.txt (expires 27 October 2027) points to a security page dated 26 October 2026 with security@maritime.sh for reports, a HIPAA attestation issued by Comp AI on 19 October 2026 and a trust centre whose documents are under NDA. The SOC 2 programme is "underway", and no bounty or advisories were found. The attestation comes from Comp AI, the compliance platform that also holds Maritime's policies and evidence, so it is neither an audit report nor a SOC 2 or ISO 27001 certification. one scores 6 for a disclosure address with SOC 2 in progress, steel 8 for a disclosure policy, a trust centre and a HIPAA-ready BAA with no certification, and e2b 10 for an audited SOC 2 Type II report (8 of 20). 26 + 14 + 10 + 10 + 8 = 68.