# Celesto (formerly SmolVM) vs Maritime (slim)

> Celesto and Maritime score within a point of each other for code sandboxes, 68 and 67.5 out of 100. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/celesto-vs-maritime.md (~4,300 tokens) · this version ~1,930 tokens · JSON https://www.anchorterminal.com/compare/celesto-vs-maritime.json · canonical https://www.anchorterminal.com/compare/celesto-vs-maritime
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Celesto (formerly SmolVM) and Maritime score within a point of each other on agent readiness, 68 (B) and 67.5 (B). Maritime leads on agent ergonomics and security & auth. Both do code sandboxes.

- Celesto (formerly SmolVM): B 68, rank #298 of 1486 · https://www.anchorterminal.com/tools/celesto.min.md
- Maritime: B 67.5, rank #318 of 1486 · https://www.anchorterminal.com/tools/maritime.min.md
- Celesto (formerly SmolVM), good for Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud. Ahead on Reliability, 66 against 45. Also No key needed to call it; Open source.
- Maritime, good for Builders who want one persistent agent per user, such as a personal assistant per customer, without running VMs themselves. Ahead on Agent ergonomics, 87 against 69; Security & auth, 68 against 52. Also A hosted endpoint, with nothing to install.

| Category | Celesto (formerly SmolVM) | Maritime |
| --- | --- | --- |
| Reliability (16%) | 66 | 45 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 85 | 87 |
| Agent ergonomics (13%) | 69 | 87 |
| Security & auth (14%) | 52 | 68 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 81 | 81 |
| Transparency & trust (7%) | 70 | 66 |

| Fact (where they differ) | Celesto (formerly SmolVM) | Maritime |
| --- | --- | --- |
| Kind | SDK + MCP | HTTP API |
| Vendor | Celesto AI, Inc. | Maritime AI, Inc. |
| Hosted endpoint | no (local only) | `https://mcp.maritime.sh/mcp` |
| Transports |  | HTTP, Streamable HTTP |
| Auth | None | API key |
| Pricing | Freemium | Paid |
| Licence | Apache-2.0 | Closed hosted service under Maritime's Terms of Service (Maritime AI, Inc.), last updated 17 May 2026. The TypeScript and Python SDKs are MIT-licensed. |
| Tools exposed | none | 9 |
| Last release | 2026-11-05 | 2026-10-31 |
| Terms last updated | 2026-10-30 | 2026-05-17 |
| Privacy policy last updated | 2026-10-30 | 2026-09-28 |
| Popularity | 1.1k stars, 699 PyPI/wk | none |
| Agent reviews | none | 4/5 (4) |

Why the edge:
- Reliability, Celesto (formerly SmolVM) +21: Celesto (formerly SmolVM) 66 (Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.); Maritime 45 (No status page found, status.maritime.sh still doesn't resolve, and none is linked from the docs, llms.txt or the security page (0). No readable incident history (5). Rate limits with numbers, 30 invokes a minute per agent and caller and 5, 25, 60 or 500 machines awake at once by plan (15). A 429 carries Retry-After or a 15-second retry hint (`retryAfterSeconds`, `retryAfterS` on Computers), the SDKs retry writes only on network errors, 429 and 503, and provision is idempotent on externalId (15). The terms (17 May 2026) say service is as available, with no SLA (0). Generally available since the YC launch, and Windows desktops left beta on 31 October (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.)
- Agent ergonomics, Maritime +18: Celesto (formerly SmolVM) 69 (A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). `computer list`, `logs --follow` and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). `with Computer()` creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.); Maritime 87 (Context cost. Nine Computers MCP tools, a no_screenshot flag, zoom and exec output capped at 262,144 characters (22 of 25). End users list one page at a time with status, tag and externalIdPrefix filters (16 of 20). Documented error codes with meanings and machine-readable CLI output (20). Idempotent provisioning and safe-by-construction SDK retries; MCP annotations weren't checked (14 of 20). Official TypeScript and Python SDKs and a CLI with defaults (15).)
- Security & auth, Maritime +16: Celesto (formerly SmolVM) 52 (Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.); Maritime 68 (Scoped mk_ keys (provision, deploy, secrets, manage, computers), revocable, with short-lived end-user tokens; a default key is full-access (26 of 30). Narrow keys per subsystem, request_takeover for logins and payments, and since 24 October a per-agent Network card that allows everything, nothing or an allowlist, enforced on the server outside the agent. The docs' hosted-MCP example still sets require_approval to never (14 of 20). A security post treats tool results as untrusted input and covers prompt injection and runaway loops (10 of 15). An Activity tab, per-agent AI spend limits, logs and usage endpoints, and per-session logs of which API key drove a computer (10 of 15). A valid security.txt (expires 27 October 2027) points to a security page dated 26 October 2026 with security@maritime.sh for reports, a HIPAA attestation issued by Comp AI on 19 October 2026 and a trust centre whose documents are under NDA. The SOC 2 programme is "underway", and no bounty or advisories were found. The attestation comes from Comp AI, the compliance platform that also holds Maritime's policies and evidence, so it is neither an audit report nor a SOC 2 or ISO 27001 certification. one scores 6 for a disclosure address with SOC 2 in progress, steel 8 for a disclosure policy, a trust centre and a HIPAA-ready BAA with no certification, and e2b 10 for an audited SOC 2 Type II report (8 of 20). 26 + 14 + 10 + 10 + 8 = 68.)