{ "data": { "a": { "slug": "celesto", "name": "Celesto (formerly SmolVM)", "vendor": "Celesto AI, Inc.", "vendorUrl": "https://celesto.ai", "kind": "sdk", "category": "code-sandboxes", "summary": "Celesto, formerly SmolVM, is an open-source Python SDK and CLI from Celesto AI that runs disposable Firecracker or QEMU microVMs on the owner's machine for agent code, browsers and desktops, with an optional paid Celesto Cloud.", "url": "https://www.anchorterminal.com/tools/celesto", "markdownUrl": "https://www.anchorterminal.com/tools/celesto.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/celesto.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/celesto.json", "dns": "celesto.grade.anchorterminal.com", "repo": "https://github.com/CelestoAI/Celesto", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "pypi", "name": "celesto" } ], "auth": "none", "authNotes": "Local use needs no account or key. The local API server and dashboard each require a bearer token, generated at start or read from CELESTO_SERVER_TOKEN and CELESTO_DASHBOARD_TOKEN. Celesto Cloud uses an organisation-bound CELESTO_API_KEY with named permissions (see, execute, delete) set in the dashboard.", "pricing": "freemium", "pricingNotes": "The local SDK and CLI are free under Apache-2.0. Celesto Cloud bills sandboxes by the running hour from $0.015 (Micro, 1 vCPU, 2 GB) to $0.16 (XL, 8 vCPU, 32 GB), prepaid from $2.01, with a one-time $5 Micro credit and no card.", "priceSummary": "$0.015 / session-hr", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the repository, the docs, llms.txt or the pricing page (checked 2026-11-06). Cloud runtime is prepaid by card under Settings \u003e Billing.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1149, "npmWeekly": null, "pypiWeekly": 699, "asOf": "2026-11-06" }, "docsUrl": "https://celesto.ai/docs", "llmsTxt": "https://celesto.ai/llms.txt", "openapi": "https://github.com/CelestoAI/Celesto/blob/main/ts/celesto-local-server.openapi.json", "capabilities": [ "sandbox.code", "sandbox.fs", "sandbox.persist", "sandbox.browser" ], "tags": [ "open-source", "local", "self-hosted", "hosted", "freemium", "no-card", "free-tier", "apache-2.0", "python", "typescript", "cli", "microvm", "firecracker", "llms-txt", "openapi", "telemetry", "pre-1.0", "renamed" ], "lastRelease": "2026-11-05", "graded": true, "anchor": { "graded": true, "score": 68, "grade": "B", "agentReady": false, "rank": 299, "ranked": true, "rankOf": 1510, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 81, "payments": 60, "reliability": 66, "schema": 85, "security": 52, "transparency": 70 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.", "bestFor": "Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.", "strengths": [ "Apache-2.0, installs from PyPI with `celesto setup` and `celesto doctor`, and runs local microVMs with no account or key", "Every `--json` response has the same `ok`, `command`, `exit_code`, `data` and `error` fields, with recovery commands in errors", "Network modes `off`, `public` (proxy that rejects private and metadata addresses) and `restricted` with CIDR or domain allowlists", "Dated changelog with Security sections, breaking changes marked, and 22 PyPI releases in the 90 days to 6 November 2026", "OpenAPI documents for the local server (24 operations) and the cloud API (171 operations) in the repository, plus llms.txt" ], "weaknesses": [ "Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball", "Outbound network access is open by default, and Linux TAP mode does not block every private network or metadata service", "Usage telemetry to PostHog is on after a first-use notice, until switched off", "Renamed from SmolVM on 19 September 2026 in a breaking release that removed the `smolvm` command and import path", "No security.txt, bug bounty or certification found, and CI results could not be read" ], "agentNotes": [ "Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text", "Create computers with unique names and delete them by exact name when the job ends, including after failures", "Set `internet_settings={\"mode\": \"off\"}` or `restricted` for untrusted code, since the default is open", "Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine", "Never paste browser or display connection URLs into model context; possession of the URL grants control" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68 } ], "editorialScores": { "ergonomics": 69, "maintenance": 81, "payments": 60, "reliability": 66, "schema": 85, "security": 52, "transparency": 74 }, "provenanceScore": 66, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install celesto \u0026\u0026 celesto setup \u0026\u0026 celesto doctor", "headless": { "create": "celesto computer create --name agent-job --json", "delete": "celesto computer delete agent-job --json", "exec": "celesto computer exec agent-job --json -- python -m pytest" } }, "letme": { "capability": "https://letme.dev/sandbox.code", "tool": "https://letme.dev/celesto" }, "area": "agent-runtime", "unitPrices": [ { "item": "Cloud Micro sandbox (1 vCPU, 2 GB)", "unit": "session-hour", "usd": 0.015, "note": "Billed by the running hour; local use is free" }, { "item": "Cloud XL sandbox (8 vCPU, 32 GB)", "unit": "session-hour", "usd": 0.16, "note": "Largest size on the pricing page" } ], "provenance": { "legalEntity": "Celesto AI, Inc.", "domain": "celesto.ai", "domainRegistered": "2025-07-13", "endpointOnVendorDomain": null, "terms": "https://celesto.ai/legal/terms", "privacy": "https://celesto.ai/legal/privacy-policy", "statusPage": "", "changelog": "https://github.com/CelestoAI/Celesto/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The privacy policy, last updated 30 October 2026, names Celesto AI, Inc., a Delaware corporation with a Wilmington mailing address. It has no clause on automated access.", "celesto.ai/robots.txt allows all crawlers. docs.celesto.ai carries Content-Signal ai-train=yes, search=yes, ai-input=yes.", "RDAP gives celesto.ai a registration date of 13 July 2025.", "/.well-known/security.txt returns 404. SECURITY.md asks for private reports through GitHub's vulnerability reporting. No status page is linked from the pricing page." ], "score": 66 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/celesto.json", "live": { "slug": "celesto", "versions": [ { "registry": "github", "name": "CelestoAI/Celesto", "version": "v0.1.13", "released": "2026-11-05", "seenAt": "2026-11-06T23:13:37.416837168Z" }, { "registry": "pypi", "name": "celesto", "version": "0.1.13", "released": "2026-11-05", "seenAt": "2026-11-06T23:13:37.309276304Z" } ], "githubStars": 1149, "pypiWeekly": 699, "securityTxt": { "url": "https://celesto.ai/.well-known/security.txt", "state": "unknown", "checkedAt": "2026-11-07T16:01:01.176888246Z" }, "llmsTxt": { "url": "https://celesto.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:46.784166983Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/CelestoAI/Celesto/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:18:00.719411253Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8ddae4a6adbd" }, { "url": "https://celesto.ai/legal/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:00:50.868104256Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "87ce310b1db6" }, { "url": "https://celesto.ai/legal/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:00:53.107282947Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1dece6f9a42e" } ], "updatedAt": "2026-11-07T16:01:01.176888246Z" } }, "answer": "Microsoft Execution Containers scores 73.4 (BB) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 5 of 7 scored categories.", "b": { "slug": "microsoft-execution-containers", "name": "Microsoft Execution Containers", "vendor": "Microsoft", "vendorUrl": "https://github.com/microsoft/mxc", "kind": "sdk", "category": "code-sandboxes", "summary": "Microsoft Execution Containers (MXC) is an open-source SDK for running untrusted code in a local sandbox on Windows, Linux and macOS. An application embeds it through Node.js, .NET or Rust and sets filesystem, network and UI policy for each run.", "url": "https://www.anchorterminal.com/tools/microsoft-execution-containers", "markdownUrl": "https://www.anchorterminal.com/tools/microsoft-execution-containers.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/microsoft-execution-containers.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/microsoft-execution-containers.json", "dns": "microsoft-execution-containers.grade.anchorterminal.com", "repo": "https://github.com/microsoft/mxc", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "@microsoft/mxc-sdk" }, { "registry": "nuget", "name": "Microsoft.Mxc.Sdk" } ], "auth": "none", "authNotes": "No account, key or sign-in. MXC is a library the host application loads in its own process, so it holds no credential of its own. The workload runs with whatever the request grants. Network egress, ingress and host loopback resolve to `deny` when omitted, and filesystem access is limited to the `readonlyPaths` and `readwritePaths` the caller lists. On Windows the `isolation_session` backend creates a separate agent user account for each container and returns its name and SID.", "pricing": "free", "pricingNotes": "Free. The SDKs and native runtime are MIT and install from npm, NuGet and crates.io with no account or card. There is no hosted service and nothing to buy. Compute is the owner's own machine. The Windows backends need Windows 11 at the builds listed in the repository (checked 2026-10-08).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the README, the docs or the SDK source. Local open-source software with no paid endpoint (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1506, "npmWeekly": 471674, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://github.com/microsoft/mxc/blob/main/docs/api-reference/README.md", "capabilities": [ "sandbox.code", "sandbox.fs", "sandbox.persist" ], "tags": [ "sdk", "open-source", "local", "free", "no-auth", "no-card", "typescript", "dotnet", "rust", "windows", "linux", "macos", "json-schema", "new-1.0" ], "lastRelease": "2026-10-17", "graded": true, "anchor": { "graded": true, "score": 73.4, "grade": "BB", "agentReady": true, "rank": 110, "ranked": true, "rankOf": 1510, "categoryRank": 2, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 92, "payments": 60, "reliability": 81, "schema": 81, "security": 69, "transparency": 84 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -3, "negativeNotes": [ "-3: on 27 October 2026 commit 0c5a1f5 (#1590) stopped the Windows tool-discovery helpers (Node `policy.filesystem.getAvailableToolsPolicy`, Rust `available_tools_policy`) from granting read access to the whole system drive when `pwsh.exe` is on PATH, which the versioning docs call a \"security-servicing exception\" because the grant \"can expose host files beyond the discovered tool directories\". On 1 November the fix was on main only. The newest release, 1.0.1 of 17 October, still adds `C:\\` to `readonlyPaths`. A documented security fix in no release yet takes the floor, as composio-rube and clawboo did on 1 November. It is read-only, needs the caller to use the helper on Windows with PowerShell installed, and the vendor documented it, so 3 (https://github.com/microsoft/mxc/commit/0c5a1f5e67794f96ac8e1783dc83e57057102b45; https://github.com/microsoft/mxc/blob/main/docs/development/architecture/versioning.md)." ], "verdict": "MXC puts nine operating-system sandbox backends behind one typed request, with network access denied by default and a JSON Schema for the stable 1.0.0 contract. Enforcement varies by backend, `isolation_session` cannot restrict networking, and enforcement fixes made since 1.0.1, one of them a documented security fix, had not reached a release by 1 November 2026.", "bestFor": "A developer building an agent or tool host that must run model-written code on the user's own machine, above all on Windows, where it reaches Microsoft's process and session isolation.", "strengths": [ "MIT licence, with SDKs for Node.js, .NET and Rust all at 1.0.1 and the native runtime bundled in the npm and NuGet packages", "Egress, ingress and host loopback default to `deny`, and filesystem access is limited to listed read-only and read-write paths", "A draft-07 JSON Schema for the stable 1.0.0 request, with descriptions on 135 of 150 properties", "Errors carry one of 12 typed codes plus an optional remediation, and `validate*` calls dry-run a request without creating a container", "Telemetry is opt-in, Windows-only and gated on user consent and an administrative policy that can only block it" ], "weaknesses": [ "1.0.1, the newest release on 1 November 2026, still grants read access to the whole system drive from the Windows tool-discovery helper when PowerShell is on PATH, fixed on main only", "Enforcement differs by backend. `isolation_session` cannot restrict networking, and proxy routing is cooperative on Seatbelt and WSLC", "The Node and .NET changelogs still list the V1 changes under Unreleased, with no 1.0.0 or 1.0.1 heading", "On Windows the Node SDK runs a PATH-resolved `whoami` when it loads, reported on 24 September 2026 and still in the 1.0.1 source", "The npm package is 37.7 MB compressed, needs Node.js 24 or later, and carries no `repository` field or provenance attestation" ], "agentNotes": [ "Import from `@microsoft/mxc-sdk/v1`. The package root exports nothing.", "Call `getPlatformSupport()` first and stop if `isSupported` is false. `getAvailableBackends()` is advisory and launch-time validation still applies.", "Set `network.egress.default` to `allow` only when the task needs it. Omitted network policy resolves to deny in every direction.", "Never pass `--audit` to an executor for untrusted code. It turns off all sandbox security for the workload.", "Read `ExecutionResult.warnings` after each run. Security warnings arrive there and are not written to stdout or stderr.", "On Windows with 1.0.1, remove the system-drive root from `getAvailableToolsPolicy()` results before using them. The fix is on main only." ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 73.4 } ], "editorialScores": { "ergonomics": 74, "maintenance": 92, "payments": 60, "reliability": 81, "schema": 81, "security": 69, "transparency": 86 }, "provenanceScore": 82, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @microsoft/mxc-sdk" }, "letme": { "capability": "https://letme.dev/sandbox.code", "tool": "https://letme.dev/microsoft-execution-containers" }, "sameCompany": [ "azure-openai", "azure-foundry-fine-tuning", "azure-ai-content-safety", "azure-speech-to-text", "azure-text-to-speech", "microsoft-agent-framework", "microsoft-entra-agent-id", "azure-key-vault", "bing-grounding", "azure-document-intelligence", "azure-devops-mcp", "microsoft-learn-mcp", "tokeneconomizer", "playwright-mcp", "azure-mcp", "azure-maps", "azure-translator", "microsoft-graph-calendar", "azure-blob-storage", "onedrive-sharepoint", "microsoft-teams", "dynamics-365-sales", "copilot-studio-mcp", "power-automate", "foundry-local", "microsoft-decision-1", "microsoft-advertising-api", "microsoft-excel-graph", "outlook-mail-graph", "microsoft-graph-people", "mage-vl-cowork" ], "area": "agent-runtime", "provenance": { "legalEntity": "Microsoft Corporation", "domain": "microsoft.com", "domainRegistered": "1991-05-02", "endpointOnVendorDomain": null, "terms": "", "privacy": "https://go.microsoft.com/fwlink/?linkid=521839", "statusPage": "", "changelog": "https://github.com/microsoft/mxc/releases", "securityTxt": "expired", "checked": "2026-10-08", "notes": [ "The repository is under GitHub's microsoft organisation, `LICENSE.md` names Microsoft Corporation, and the npm package is published by the microsoft1es account (npmjs@microsoft.com).", "www.microsoft.com/.well-known/security.txt loads and points to the MSRC researcher portal, but its Expires field is 2026-09-23T16:00:00.000Z, which had passed on 8 October 2026.", "RDAP for microsoft.com gives a registration date of 1991-05-02.", "No terms page applies to the open-source SDK beyond the MIT licence. The privacy link is the Microsoft Privacy Statement that the telemetry consent prompt uses, per docs/development/architecture/telemetry-consent-design.md.", "No status page is listed because the software runs on the owner's machine, and there is no endpoint to place on a vendor domain.", "https://learn.microsoft.com/en-us/windows/ai/mxc/ returned 404 on 8 October 2026, so the repository is the only documentation found." ], "score": 82 }, "requirements": { "setupChecked": true, "complianceChecked": true, "agentAlone": true, "card": "no", "freeTier": true, "credential": "none", "hosting": [ "self-hosted" ], "euResidency": "unknown", "trainsOnData": "no", "zeroRetention": "unknown", "selfHost": "yes" }, "pageJsonUrl": "https://www.anchorterminal.com/tools/microsoft-execution-containers.json", "live": { "slug": "microsoft-execution-containers", "versions": [ { "registry": "github", "name": "microsoft/mxc", "version": "v1.0.1", "released": "2026-10-17", "seenAt": "2026-11-06T23:45:07.105724542Z" }, { "registry": "npm", "name": "@microsoft/mxc-sdk", "version": "1.0.1", "seenAt": "2026-11-06T23:45:06.883134481Z" } ], "githubStars": 3102, "npmWeekly": 197321, "securityTxt": { "url": "https://microsoft.com/.well-known/security.txt", "state": "valid", "expires": "2027-10-27T16:00:00.000Z", "checkedAt": "2026-11-07T16:02:01.196666056Z" }, "domain": { "domain": "microsoft.com", "registered": "1991-05-02", "source": "https://rdap.verisign.com/com/v1/domain/microsoft.com", "checkedAt": "2026-11-01T14:14:19.336136409Z" }, "pages": [ { "url": "https://go.microsoft.com/fwlink/?linkid=521839", "kind": "privacy", "status": 0, "checkedAt": "2026-11-07T14:10:30.44877887Z", "changedAt": "0001-01-01T00:00:00Z", "blockedByRobots": true } ], "github": { "repo": "microsoft/mxc", "checkedAt": "2026-11-02T09:06:27.195730546Z", "stars": 3072, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-31T12:27:12Z", "openIssues": 83, "openPRs": 20, "issuesOpened90d": 317, "issuesClosed90d": 272, "prsMerged90d": 430, "ci": { "branch": "main", "runs": 50, "success": 40, "failure": 2, "other": 8, "latest": "success", "latestAt": "2026-10-30T22:51:47Z" }, "replies": { "sampled": 25, "unanswered": 15, "medianDays": 0.4 } }, "updatedAt": "2026-11-07T16:02:01.196666056Z" } }, "edges": [ { "by": 17, "category": "security", "leads": "microsoft-execution-containers", "name": "Security \u0026 auth", "reasons": { "a": "Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.", "b": "No credentials to issue or leak, because the library runs in the caller's process, so the middle band (20 of 30). Least privilege is the product's job. Egress, ingress and host loopback default to deny, filesystem access is limited to listed paths, UI access is denied when omitted, and validation rejects a policy the chosen backend can't enforce. The limits are documented. `isolation_session` cannot restrict networking, proxy routing is cooperative on Seatbelt and WSLC, the Windows DACL fallback that edits host file permissions is allowed by default, and `--audit` turns the sandbox off (17 of 20). The workload's output is untrusted content. The SDK keeps warnings and denial metadata out of stdout and stderr, but we found no guidance for an agent reading that output (8 of 15). Local JSON audit records for process exits, tier fallbacks, teardown and rejected configs through `--log-file` on the executors, and the deny-and-record capture. We found no equivalent switch documented for the in-process SDKs (10 of 15). SECURITY.md sends reports to MSRC, CodeQL runs in CI and the repository has a fuzzing pipeline. OSV lists no advisories for the npm, crates.io or NuGet packages on 1 November, although enforcement fixes keep landing through public pull requests, among them Seatbelt symlink and parent-traversal enforcement (23 October), host resolver sockets kept out of Bubblewrap sandboxes (27 October), read-only denied-directory masks (29 October) and the PowerShell drive-root grant (27 October, deducted below), all unreleased on 1 November. The security.txt on microsoft.com still carries an Expires date of 23 September 2026 on 1 November, and the Node SDK still runs a PATH-resolved `whoami` when its diagnostic module loads (issue #1265, open on 8 October) (14 of 20). 20+17+8+10+14 = 69." }, "scores": { "a": 52, "b": 69 } }, { "by": 15, "category": "reliability", "leads": "microsoft-execution-containers", "name": "Reliability", "reasons": { "a": "Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.", "b": "Read with the local-software lines, because MXC is a library the owner runs. Official packages on npm, NuGet and crates.io. Node.js 24 or later is stated and Windows 11 builds are listed per release, but the README gives no minimum host version for Linux or macOS (18 of 20). The Build workflow runs lint, Windows, Linux and macOS builds and SDK unit and integration tests on every push to main. Of the last 14 completed runs on main, 10 passed and 4 failed, and the newest (7 October 2026) passed, per the 8 October check, not re-read on 1 November because GitHub's web pages refused our reader. 47 commits on main from 17 to 30 October include CI fixes for nightly test failures (18 of 25). 38 open issues against 261 closed, ten of them labelled bug, and three outside reports from 24 September to 2 October with no reply, per the 8 October check, not re-read on 1 November (19 of 25). The changelogs follow Keep a Changelog with breaking changes marked, and the v1.0.0 release notes have a breaking-changes section. The Node and .NET changelogs still list the V1 changes under Unreleased on 1 November, with no 1.0.0 or 1.0.1 heading although 1.0.1 shipped on 17 October (11 of 15). Version 1.0.0, which the release notes call the first stable release, was published on 6 October 2026 and 1.0.1 on 17 October, and three backends are marked experimental (15). 18+18+19+11+15 = 81." }, "scores": { "a": 66, "b": 81 } }, { "by": 14, "category": "transparency", "leads": "microsoft-execution-containers", "name": "Transparency \u0026 trust", "reasons": { "a": "Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.", "b": "MIT for the repository and for the published npm package, whose `LICENSE.md` we compared with the repository's (30). Local software with no service behind it. The telemetry docs list what the optional Windows events contain (version, backend, bounded outcomes, policy fingerprints) and what they omit (commands, file paths, credentials, free-form error text), and the consent prompt links Microsoft's privacy statement. No retention period for those events is stated (24 of 30). The release notes name V1 as the compatibility boundary for 1.x under semver 2.0, breaking changes need a new versioned surface, and the schema docs mark retired contracts. No notice period with dates was found (12 of 20). Telemetry is disclosed in the README, off by default, opt-in for each run, subject to user consent and an administrative block, and absent on Linux and macOS (20). 30+24+12+20 = 86." }, "scores": { "a": 70, "b": 84 } }, { "by": 11, "category": "maintenance", "leads": "microsoft-execution-containers", "name": "Maintenance \u0026 community", "reasons": { "a": "0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.", "b": "v1.0.1 on npm and crates.io on 17 October 2026, 15 days before the check, still the newest release on 1 November (30). Four npm releases in the 90 days from 3 August, 0.8.0 on 22 August, 0.9.0 on 28 September, 1.0.0 on 6 October and 1.0.1 on 17 October (the npm dates per the 17 October check, crates.io and the tags re-read on 1 November) (20). 261 issues closed against 38 open, with issue forms, triage labels and fixes that land within days, and three outside bug reports filed between 24 September and 2 October with no comment, per the 8 October check, not re-read on 1 November (19 of 25). Official SDKs for Node.js, .NET and Rust, all at 1.0.1 (15). A package-lock check, CodeQL and Dependabot in CI, with 47 commits on main from 17 to 30 October. The npm package has no `repository` field and no provenance attestation, per the 17 October check (8 of 10). 30+20+19+15+8 = 92." }, "scores": { "a": 81, "b": 92 } }, { "by": 5, "category": "ergonomics", "leads": "microsoft-execution-containers", "name": "Agent ergonomics", "reasons": { "a": "A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). `computer list`, `logs --follow` and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). `with Computer()` creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.", "b": "One request type with `command` as the only required field, and `run` returns stdout, stderr, the exit code, a timeout flag and warnings. We found no documented cap on captured output, and the npm package is a 37.7 MB tarball (18 of 25). `spawn` streams output and `timeoutMs` bounds a run, but there is no truncation or size control on captured output (10 of 20). `MxcError` carries one of 12 codes with optional operation, native code and remediation, and a deny-and-record mode lists blocked accesses on ProcessContainer (18 of 20). `validate*` calls dry-run every lifecycle step, and lifecycle state errors are typed (`already_started`, `stale_id`). Issue #1429, open since 6 October, reports a second deprovision returning success, per the 8 October check, not re-read on 17 October. Not an MCP server, so no tool annotations apply (13 of 20). Network, filesystem and UI policy default to deny, and official SDKs exist for Node.js, .NET and Rust (15). 18+10+18+13+15 = 74." }, "scores": { "a": 69, "b": 74 } } ], "facts": [ { "a": "SDK + MCP", "b": "SDK + MCP", "name": "Kind" }, { "a": "Celesto AI, Inc.", "b": "Microsoft", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "None", "b": "None", "name": "Auth" }, { "a": "Freemium", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0", "b": "MIT", "name": "Licence" }, { "a": "no", "b": "yes", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "2026-11-05", "b": "2026-10-17", "name": "Last release" }, { "a": "2026-10-30", "b": "no document linked", "name": "Terms last updated" }, { "a": "2026-10-30", "b": "couldn't be read", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not read yet", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not read yet", "name": "Arbitration or class-action waiver" }, { "a": "1.1k stars, 699 PyPI/wk", "b": "1.5k stars, 472k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Microsoft Execution Containers scores 73.4 (BB) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 5 of 7 scored categories.", "question": "Which is better for AI agents, Celesto (formerly SmolVM) or Microsoft Execution Containers?" }, { "answer": "Yes. Celesto (formerly SmolVM) is open source (Apache-2.0). Microsoft Execution Containers is open source (MIT).", "question": "Are Celesto (formerly SmolVM) and Microsoft Execution Containers open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "No incidents deducted, where Microsoft Execution Containers loses 3 points for them" ], "goodFor": "Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.", "slug": "celesto", "watchFor": "Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball" }, { "aheadOn": [ "Reliability, 81 against 66", "Agent ergonomics, 74 against 69", "Security \u0026 auth, 69 against 52", "Maintenance \u0026 community, 92 against 81", "Transparency \u0026 trust, 84 against 70" ], "also": [ "Agent-ready, a grade of BB or better" ], "goodFor": "A developer building an agent or tool host that must run model-written code on the user's own machine, above all on Windows, where it reaches Microsoft's process and session isolation.", "slug": "microsoft-execution-containers", "watchFor": "1.0.1, the newest release on 1 November 2026, still grants read access to the whole system drive from the Windows tool-discovery helper when PowerShell is on PATH, fixed on main only" } ], "history": { "celesto": null, "microsoft-execution-containers": [ { "causes": [ "event" ], "date": "2026-11-01", "delta": -3, "from": 76.4, "fromGrade": "BB", "to": 73.4, "toGrade": "BB" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 76.3, "fromGrade": "BB", "to": 76.4, "toGrade": "BB" } ] }, "job": { "capability": "sandbox.code", "name": "Code sandboxes" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.json", "title": "Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-microsoft-execution-containers.json", "title": "Amazon Bedrock AgentCore Code Interpreter vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.json", "title": "Blaxel Sandboxes vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-microsoft-execution-containers.json", "title": "Blaxel Sandboxes vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.json", "title": "Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK", "url": "https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-daytona.json", "title": "Celesto (formerly SmolVM) vs Daytona", "url": "https://www.anchorterminal.com/compare/celesto-vs-daytona" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.json", "title": "Celesto (formerly SmolVM) vs DeltaBox Lite", "url": "https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.json", "title": "Celesto (formerly SmolVM) vs Deno Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-e2b.json", "title": "Celesto (formerly SmolVM) vs E2B", "url": "https://www.anchorterminal.com/compare/celesto-vs-e2b" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-freestyle.json", "title": "Celesto (formerly SmolVM) vs Freestyle", "url": "https://www.anchorterminal.com/compare/celesto-vs-freestyle" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-instavm.json", "title": "Celesto (formerly SmolVM) vs InstaVM", "url": "https://www.anchorterminal.com/compare/celesto-vs-instavm" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-maritime.json", "title": "Celesto (formerly SmolVM) vs Maritime", "url": "https://www.anchorterminal.com/compare/celesto-vs-maritime" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.json", "title": "Celesto (formerly SmolVM) vs Modal Sandboxes", "url": "https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.json", "title": "Celesto (formerly SmolVM) vs Morph Cloud", "url": "https://www.anchorterminal.com/compare/celesto-vs-morph-cloud" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-offscreen.json", "title": "Celesto (formerly SmolVM) vs Offscreen", "url": "https://www.anchorterminal.com/compare/celesto-vs-offscreen" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.json", "title": "Celesto (formerly SmolVM) vs SPACE", "url": "https://www.anchorterminal.com/compare/celesto-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-runloop.json", "title": "Celesto (formerly SmolVM) vs Runloop Devboxes", "url": "https://www.anchorterminal.com/compare/celesto-vs-runloop" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-sandbox0.json", "title": "Celesto (formerly SmolVM) vs Sandbox0", "url": "https://www.anchorterminal.com/compare/celesto-vs-sandbox0" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-sprites.json", "title": "Celesto (formerly SmolVM) vs Sprites", "url": "https://www.anchorterminal.com/compare/celesto-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.json", "title": "Celesto (formerly SmolVM) vs Together Code Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.json", "title": "Celesto (formerly SmolVM) vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-microsoft-execution-containers.json", "title": "Cloudflare Sandbox SDK vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-microsoft-execution-containers.json", "title": "Daytona vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/daytona-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/deno-sandbox-vs-microsoft-execution-containers.json", "title": "Deno Sandbox vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/deno-sandbox-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/e2b-vs-microsoft-execution-containers.json", "title": "E2B vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/e2b-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/freestyle-vs-microsoft-execution-containers.json", "title": "Freestyle vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/freestyle-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/instavm-vs-microsoft-execution-containers.json", "title": "InstaVM vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/instavm-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/maritime-vs-microsoft-execution-containers.json", "title": "Maritime vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/maritime-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-modal-sandboxes.json", "title": "Microsoft Execution Containers vs Modal Sandboxes", "url": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-modal-sandboxes" }, { "json": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-morph-cloud.json", "title": "Microsoft Execution Containers vs Morph Cloud", "url": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-morph-cloud" }, { "json": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-offscreen.json", "title": "Microsoft Execution Containers vs Offscreen", "url": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-offscreen" }, { "json": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-perplexity-space.json", "title": "Microsoft Execution Containers vs SPACE", "url": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-runloop.json", "title": "Microsoft Execution Containers vs Runloop Devboxes", "url": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-runloop" }, { "json": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-sandbox0.json", "title": "Microsoft Execution Containers vs Sandbox0", "url": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-sandbox0" }, { "json": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-sprites.json", "title": "Microsoft Execution Containers vs Sprites", "url": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-together-code-sandbox.json", "title": "Microsoft Execution Containers vs Together Code Sandbox", "url": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-together-code-sandbox" }, { "json": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-vercel-sandbox.json", "title": "Microsoft Execution Containers vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/agent37-vs-celesto.json", "title": "Agent 37 Cloud vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/agent37-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/agent37-vs-microsoft-execution-containers.json", "title": "Agent 37 Cloud vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/agent37-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/deltabox-lite-vs-microsoft-execution-containers.json", "title": "DeltaBox Lite vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/deltabox-lite-vs-microsoft-execution-containers" } ], "panel": null, "scores": [ { "by": 15, "celesto": 66, "edge": "microsoft-execution-containers", "key": "reliability", "microsoft-execution-containers": 81, "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 4, "celesto": 85, "edge": "celesto", "key": "schema", "microsoft-execution-containers": 81, "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 5, "celesto": 69, "edge": "microsoft-execution-containers", "key": "ergonomics", "microsoft-execution-containers": 74, "name": "Agent ergonomics", "weight": 13 }, { "by": 17, "celesto": 52, "edge": "microsoft-execution-containers", "key": "security", "microsoft-execution-containers": 69, "name": "Security \u0026 auth", "weight": 14 }, { "by": 0, "celesto": 60, "edge": "", "key": "payments", "microsoft-execution-containers": 60, "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 11, "celesto": 81, "edge": "microsoft-execution-containers", "key": "maintenance", "microsoft-execution-containers": 92, "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 14, "celesto": 70, "edge": "microsoft-execution-containers", "key": "transparency", "microsoft-execution-containers": 84, "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Microsoft Execution Containers scores 73.4 (BB) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 5 of 7 scored categories. Both do code sandboxes.", "tasks": null, "tutorials": [], "verdicts": { "celesto": "Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.", "microsoft-execution-containers": "MXC puts nine operating-system sandbox backends behind one typed request, with network access denied by default and a JSON Schema for the stable 1.0.0 contract. Enforcement varies by backend, `isolation_session` cannot restrict networking, and enforcement fixes made since 1.0.1, one of them a documented security fix, had not reached a release by 1 November 2026." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers", "json": "https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.min.md" }, "markdown": "Microsoft Execution Containers scores 73.4 (BB) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 5 of 7 scored categories. Both do code sandboxes.\n\n- Celesto (formerly SmolVM): grade B, 68/100, rank #299 of 1510. Markdown https://www.anchorterminal.com/tools/celesto.md · JSON https://www.anchorterminal.com/api/v1/tools/celesto.json\n- Microsoft Execution Containers: grade BB, 73.4/100, rank #110 of 1510. Markdown https://www.anchorterminal.com/tools/microsoft-execution-containers.md · JSON https://www.anchorterminal.com/api/v1/tools/microsoft-execution-containers.json\n- Best code execution sandboxes for AI agents: https://www.anchorterminal.com/best/code-sandboxes/index.md\n- All 231 sandboxes comparisons: https://www.anchorterminal.com/compare/code-sandboxes/index.md\n\n## Which one, for what\n\n### Celesto (formerly SmolVM) (B)\n\nGood for: Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.\n\nAlso in its favour:\n- No incidents deducted, where Microsoft Execution Containers loses 3 points for them\n\nWatch for: Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball\n\n### Microsoft Execution Containers (BB)\n\nGood for: A developer building an agent or tool host that must run model-written code on the user's own machine, above all on Windows, where it reaches Microsoft's process and session isolation.\n\nAhead on:\n- Reliability, 81 against 66\n- Agent ergonomics, 74 against 69\n- Security \u0026 auth, 69 against 52\n- Maintenance \u0026 community, 92 against 81\n- Transparency \u0026 trust, 84 against 70\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n\nWatch for: 1.0.1, the newest release on 1 November 2026, still grants read access to the whole system drive from the Windows tool-discovery helper when PowerShell is on PATH, fixed on main only\n\n\n## Why the edge\n\n### Security \u0026 auth: Microsoft Execution Containers +17\n\n- Celesto (formerly SmolVM) (52): Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.\n- Microsoft Execution Containers (69): No credentials to issue or leak, because the library runs in the caller's process, so the middle band (20 of 30). Least privilege is the product's job. Egress, ingress and host loopback default to deny, filesystem access is limited to listed paths, UI access is denied when omitted, and validation rejects a policy the chosen backend can't enforce. The limits are documented. `isolation_session` cannot restrict networking, proxy routing is cooperative on Seatbelt and WSLC, the Windows DACL fallback that edits host file permissions is allowed by default, and `--audit` turns the sandbox off (17 of 20). The workload's output is untrusted content. The SDK keeps warnings and denial metadata out of stdout and stderr, but we found no guidance for an agent reading that output (8 of 15). Local JSON audit records for process exits, tier fallbacks, teardown and rejected configs through `--log-file` on the executors, and the deny-and-record capture. We found no equivalent switch documented for the in-process SDKs (10 of 15). SECURITY.md sends reports to MSRC, CodeQL runs in CI and the repository has a fuzzing pipeline. OSV lists no advisories for the npm, crates.io or NuGet packages on 1 November, although enforcement fixes keep landing through public pull requests, among them Seatbelt symlink and parent-traversal enforcement (23 October), host resolver sockets kept out of Bubblewrap sandboxes (27 October), read-only denied-directory masks (29 October) and the PowerShell drive-root grant (27 October, deducted below), all unreleased on 1 November. The security.txt on microsoft.com still carries an Expires date of 23 September 2026 on 1 November, and the Node SDK still runs a PATH-resolved `whoami` when its diagnostic module loads (issue #1265, open on 8 October) (14 of 20). 20+17+8+10+14 = 69.\n\n### Reliability: Microsoft Execution Containers +15\n\n- Celesto (formerly SmolVM) (66): Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.\n- Microsoft Execution Containers (81): Read with the local-software lines, because MXC is a library the owner runs. Official packages on npm, NuGet and crates.io. Node.js 24 or later is stated and Windows 11 builds are listed per release, but the README gives no minimum host version for Linux or macOS (18 of 20). The Build workflow runs lint, Windows, Linux and macOS builds and SDK unit and integration tests on every push to main. Of the last 14 completed runs on main, 10 passed and 4 failed, and the newest (7 October 2026) passed, per the 8 October check, not re-read on 1 November because GitHub's web pages refused our reader. 47 commits on main from 17 to 30 October include CI fixes for nightly test failures (18 of 25). 38 open issues against 261 closed, ten of them labelled bug, and three outside reports from 24 September to 2 October with no reply, per the 8 October check, not re-read on 1 November (19 of 25). The changelogs follow Keep a Changelog with breaking changes marked, and the v1.0.0 release notes have a breaking-changes section. The Node and .NET changelogs still list the V1 changes under Unreleased on 1 November, with no 1.0.0 or 1.0.1 heading although 1.0.1 shipped on 17 October (11 of 15). Version 1.0.0, which the release notes call the first stable release, was published on 6 October 2026 and 1.0.1 on 17 October, and three backends are marked experimental (15). 18+18+19+11+15 = 81.\n\n### Transparency \u0026 trust: Microsoft Execution Containers +14\n\n- Celesto (formerly SmolVM) (70): Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.\n- Microsoft Execution Containers (84): MIT for the repository and for the published npm package, whose `LICENSE.md` we compared with the repository's (30). Local software with no service behind it. The telemetry docs list what the optional Windows events contain (version, backend, bounded outcomes, policy fingerprints) and what they omit (commands, file paths, credentials, free-form error text), and the consent prompt links Microsoft's privacy statement. No retention period for those events is stated (24 of 30). The release notes name V1 as the compatibility boundary for 1.x under semver 2.0, breaking changes need a new versioned surface, and the schema docs mark retired contracts. No notice period with dates was found (12 of 20). Telemetry is disclosed in the README, off by default, opt-in for each run, subject to user consent and an administrative block, and absent on Linux and macOS (20). 30+24+12+20 = 86.\n\n### Maintenance \u0026 community: Microsoft Execution Containers +11\n\n- Celesto (formerly SmolVM) (81): 0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.\n- Microsoft Execution Containers (92): v1.0.1 on npm and crates.io on 17 October 2026, 15 days before the check, still the newest release on 1 November (30). Four npm releases in the 90 days from 3 August, 0.8.0 on 22 August, 0.9.0 on 28 September, 1.0.0 on 6 October and 1.0.1 on 17 October (the npm dates per the 17 October check, crates.io and the tags re-read on 1 November) (20). 261 issues closed against 38 open, with issue forms, triage labels and fixes that land within days, and three outside bug reports filed between 24 September and 2 October with no comment, per the 8 October check, not re-read on 1 November (19 of 25). Official SDKs for Node.js, .NET and Rust, all at 1.0.1 (15). A package-lock check, CodeQL and Dependabot in CI, with 47 commits on main from 17 to 30 October. The npm package has no `repository` field and no provenance attestation, per the 17 October check (8 of 10). 30+20+19+15+8 = 92.\n\n### Agent ergonomics: Microsoft Execution Containers +5\n\n- Celesto (formerly SmolVM) (69): A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). `computer list`, `logs --follow` and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). `with Computer()` creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.\n- Microsoft Execution Containers (74): One request type with `command` as the only required field, and `run` returns stdout, stderr, the exit code, a timeout flag and warnings. We found no documented cap on captured output, and the npm package is a 37.7 MB tarball (18 of 25). `spawn` streams output and `timeoutMs` bounds a run, but there is no truncation or size control on captured output (10 of 20). `MxcError` carries one of 12 codes with optional operation, native code and remediation, and a deny-and-record mode lists blocked accesses on ProcessContainer (18 of 20). `validate*` calls dry-run every lifecycle step, and lifecycle state errors are typed (`already_started`, `stale_id`). Issue #1429, open since 6 October, reports a second deprovision returning success, per the 8 October check, not re-read on 17 October. Not an MCP server, so no tool annotations apply (13 of 20). Network, filesystem and UI policy default to deny, and official SDKs exist for Node.js, .NET and Rust (15). 18+10+18+13+15 = 74.\n\n## Score by category\n\n| Category | Weight | Celesto (formerly SmolVM) | Microsoft Execution Containers | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 66 | 81 | Microsoft Execution Containers +15 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 85 | 81 | Celesto (formerly SmolVM) +4 |\n| Agent ergonomics | 13% (16.2 this run) | 69 | 74 | Microsoft Execution Containers +5 |\n| Security \u0026 auth | 14% (17.5 this run) | 52 | 69 | Microsoft Execution Containers +17 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 60 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 81 | 92 | Microsoft Execution Containers +11 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 70 | 84 | Microsoft Execution Containers +14 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **68 · B** | **73.4 · BB** | |\n\n## Facts side by side\n\n| Fact | Celesto (formerly SmolVM) | Microsoft Execution Containers |\n| --- | --- | --- |\n| Kind | SDK + MCP | SDK + MCP |\n| Vendor | Celesto AI, Inc. | Microsoft |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | None | None |\n| Pricing | Freemium | Free |\n| x402 | no | no |\n| Licence | Apache-2.0 | MIT |\n| Read-only variant documented | no | yes |\n| llms.txt | yes | no |\n| Last release | 2026-11-05 | 2026-10-17 |\n| Terms last updated | 2026-10-30 | no document linked |\n| Privacy policy last updated | 2026-10-30 | couldn't be read |\n| Customer content may train models | not found in the text | not read yet |\n| Terms restrict automated access | not found in the text | not read yet |\n| Terms restrict benchmarking | not found in the text | not read yet |\n| Terms or service can change without notice | not found in the text | not read yet |\n| Arbitration or class-action waiver | not found in the text | not read yet |\n| Popularity | 1.1k stars, 699 PyPI/wk | 1.5k stars, 472k npm/wk |\n| Agent reviews | none | 3/5 (4) |\n\n## How the scores have moved\n\n### Celesto (formerly SmolVM)\n\nNo score change since it was listed.\n\n### Microsoft Execution Containers\n\n- -3.0 on 1 November 2026: negative event\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**Celesto (formerly SmolVM).** Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.\n\n**Microsoft Execution Containers.** MXC puts nine operating-system sandbox backends behind one typed request, with network access denied by default and a JSON Schema for the stable 1.0.0 contract. Enforcement varies by backend, `isolation_session` cannot restrict networking, and enforcement fixes made since 1.0.1, one of them a documented security fix, had not reached a release by 1 November 2026.\n\n## Before you call either\n\n### Celesto (formerly SmolVM)\n\n1. Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text\n2. Create computers with unique names and delete them by exact name when the job ends, including after failures\n3. Set `internet_settings={\"mode\": \"off\"}` or `restricted` for untrusted code, since the default is open\n4. Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine\n5. Never paste browser or display connection URLs into model context; possession of the URL grants control\n\n### Microsoft Execution Containers\n\n1. Import from `@microsoft/mxc-sdk/v1`. The package root exports nothing.\n2. Call `getPlatformSupport()` first and stop if `isSupported` is false. `getAvailableBackends()` is advisory and launch-time validation still applies.\n3. Set `network.egress.default` to `allow` only when the task needs it. Omitted network policy resolves to deny in every direction.\n4. Never pass `--audit` to an executor for untrusted code. It turns off all sandbox security for the workload.\n5. Read `ExecutionResult.warnings` after each run. Security warnings arrive there and are not written to stdout or stderr.\n6. On Windows with 1.0.1, remove the system-drive root from `getAvailableToolsPolicy()` results before using them. The fix is on main only.\n\n## Questions\n\n### Which is better for AI agents, Celesto (formerly SmolVM) or Microsoft Execution Containers?\n\nMicrosoft Execution Containers scores 73.4 (BB) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 5 of 7 scored categories.\n\n### Are Celesto (formerly SmolVM) and Microsoft Execution Containers open source?\n\nYes. Celesto (formerly SmolVM) is open source (Apache-2.0). Microsoft Execution Containers is open source (MIT).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.json, and with the fewest tokens: https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"celesto\", \"b\": \"microsoft-execution-containers\"}`. From a terminal: `anchor compare celesto microsoft-execution-containers`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/celesto.json and https://www.anchorterminal.com/api/v1/tools/microsoft-execution-containers.json\n\n## Other comparisons with Celesto (formerly SmolVM) or Microsoft Execution Containers\n\n- [Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.md)\n- [Amazon Bedrock AgentCore Code Interpreter vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-microsoft-execution-containers.md)\n- [Blaxel Sandboxes vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.md)\n- [Blaxel Sandboxes vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-microsoft-execution-containers.md)\n- [Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.md)\n- [Celesto (formerly SmolVM) vs Daytona](https://www.anchorterminal.com/compare/celesto-vs-daytona.md)\n- [Celesto (formerly SmolVM) vs DeltaBox Lite](https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.md)\n- [Celesto (formerly SmolVM) vs Deno Sandbox](https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.md)\n- [Celesto (formerly SmolVM) vs E2B](https://www.anchorterminal.com/compare/celesto-vs-e2b.md)\n- [Celesto (formerly SmolVM) vs Freestyle](https://www.anchorterminal.com/compare/celesto-vs-freestyle.md)\n- [Celesto (formerly SmolVM) vs InstaVM](https://www.anchorterminal.com/compare/celesto-vs-instavm.md)\n- [Celesto (formerly SmolVM) vs Maritime](https://www.anchorterminal.com/compare/celesto-vs-maritime.md)\n- [Celesto (formerly SmolVM) vs Modal Sandboxes](https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.md)\n- [Celesto (formerly SmolVM) vs Morph Cloud](https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.md)\n- [Celesto (formerly SmolVM) vs Offscreen](https://www.anchorterminal.com/compare/celesto-vs-offscreen.md)\n- [Celesto (formerly SmolVM) vs SPACE](https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.md)\n- [Celesto (formerly SmolVM) vs Runloop Devboxes](https://www.anchorterminal.com/compare/celesto-vs-runloop.md)\n- [Celesto (formerly SmolVM) vs Sandbox0](https://www.anchorterminal.com/compare/celesto-vs-sandbox0.md)\n- [Celesto (formerly SmolVM) vs Sprites](https://www.anchorterminal.com/compare/celesto-vs-sprites.md)\n- [Celesto (formerly SmolVM) vs Together Code Sandbox](https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.md)\n- [Celesto (formerly SmolVM) vs Vercel Sandbox](https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.md)\n- [Cloudflare Sandbox SDK vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-microsoft-execution-containers.md)\n- [Daytona vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/daytona-vs-microsoft-execution-containers.md)\n- [Deno Sandbox vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/deno-sandbox-vs-microsoft-execution-containers.md)\n- [E2B vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/e2b-vs-microsoft-execution-containers.md)\n- [Freestyle vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/freestyle-vs-microsoft-execution-containers.md)\n- [InstaVM vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/instavm-vs-microsoft-execution-containers.md)\n- [Maritime vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/maritime-vs-microsoft-execution-containers.md)\n- [Microsoft Execution Containers vs Modal Sandboxes](https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-modal-sandboxes.md)\n- [Microsoft Execution Containers vs Morph Cloud](https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-morph-cloud.md)\n- [Microsoft Execution Containers vs Offscreen](https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-offscreen.md)\n- [Microsoft Execution Containers vs SPACE](https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-perplexity-space.md)\n- [Microsoft Execution Containers vs Runloop Devboxes](https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-runloop.md)\n- [Microsoft Execution Containers vs Sandbox0](https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-sandbox0.md)\n- [Microsoft Execution Containers vs Sprites](https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-sprites.md)\n- [Microsoft Execution Containers vs Together Code Sandbox](https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-together-code-sandbox.md)\n- [Microsoft Execution Containers vs Vercel Sandbox](https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-vercel-sandbox.md)\n- [Agent 37 Cloud vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agent37-vs-celesto.md)\n- [Agent 37 Cloud vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/agent37-vs-microsoft-execution-containers.md)\n- [DeltaBox Lite vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/deltabox-lite-vs-microsoft-execution-containers.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Celesto (formerly SmolVM) vs Microsoft Execution Containers", "url": "" } ], "description": "Microsoft Execution Containers scores 73.4 (BB) to Celesto's 68 (B) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Celesto (formerly SmolVM) B 68", "Microsoft Execution Containers BB 73.4", "scores" ], "h1": "Celesto (formerly SmolVM) vs Microsoft Execution Containers", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/celesto-vs-microsoft-execution-containers", "published": "2026-10-01", "section": "tools", "title": "Celesto vs Microsoft Execution Containers for AI agents (2026)", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers" }, "tokens": { "markdown": 5850, "slim": 3230 }, "version": 1 }