Celesto (formerly SmolVM) vs Morph Cloud

Celesto (formerly SmolVM) 60

Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.

Morph Cloud 20

No x402, MPP or L402 found in the docs or the OpenAPI file on 8 October (0). Per the 8 October check, the pricing page defines the Morph Compute Unit (1 vCPU-hour with 4 GB RAM-hours and 16 GB disk-hours, or 5 TB snapshot-hours), states a standard rate of $0.05 an MCU and lists plans at $0, $40 and $250 a month without a login. The terms of 23 October 2025 add per-second compute billing and 30 days' notice of price changes (20). The Free plan starts with 0 MCUs and says to purchase MCUs to use compute. The FAQ refers readers to the billing console for any free credits (0). Signup is in a browser, and the key creation route needs an existing session or key (0). 0+20+0+0 = 20.

Celesto (formerly SmolVM) 81

0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.

Morph Cloud 48

The Python SDK repository tagged v0.1.116 on 20 October 2026, a generated release that adds disk resizing to the SDK and CLI, 15 days before this check. pypi.org did not resolve on 4 November, so its upload date there is unconfirmed (30). Three tagged Python releases in the 90 days from 6 August 2026, v0.1.114 on 30 August, v0.1.115 on 1 September and v0.1.116 on 20 October. v0.1.115 changes only the version and the minimum Python version in pyproject.toml, a packaging-only release that counts half, so the count is two and a half, below three (0). Scored on the closed-service scale. The changelog is not kept, per the 8 October check. The terms give ops@morph.so and the status page support@morph.so. The two open pull requests on the Python SDK (1 April and 14 September 2026) had no comments on 8 October, and GitHub's pages answered 403 on 4 November (4). The Python SDK and CLI are current. The TypeScript SDK repository's newest tag is v0.0.19 from 2 October 2025 and its newest commit 6 October 2025, matching 0.0.20 on npm on 8 October (10). The Python repository has 18 unit test files, but its only workflow is a publish job run by hand, so no public CI run was found (4). 30+0+4+10+4 = 48.

Celesto (formerly SmolVM) 70

Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.

Morph Cloud 44

The SDKs are Apache-2.0. The platform is closed, under Terms of Service last revised 23 October 2025 at cloud.morph.so/web/legal/terms-of-service, which name Morph Labs, Inc. of San Francisco, set California law and arbitration, and promise 15 days' notice of material changes (15). No privacy policy or DPA found. The terms say Morph staff do not access disk, memory or application data in instances except on a customer's time-bound request or by law, that such access is logged, that diagnostic artifacts are deleted per a retention schedule that is not published, and that usage telemetry is shared only aggregated or de-identified. The docs describe snapshot TTLs the customer sets and say Morph Actions data has no fixed retention period (8). No deprecation policy. The terms promise not to reduce core functionality materially during a committed billing term without a workaround or a refund, with no notice period for API changes. The OpenAPI file marks a few fields deprecated and keeps a legacy query alias, without dates (3). No subprocessor list or data location statement found (0). 15+8+3+0 = 26.

Celesto (formerly SmolVM) 85

Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer exec and keep shell, ssh and desktop for interactive work (14 of 20). Network modes are closed values (open, off, public, restricted) and the SDK takes typed keyword arguments, though internet_settings is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as required_scope, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.

Morph Cloud 72

Per the 8 October check, not re-read on 4 November. Public OpenAPI 3.1 file at cloud.morph.so/api/openapi.json with 52 paths and 69 operations (25). llms.txt and llms-full.txt under /docs (10). 67 of 69 operations have a description, many of one line, while the guides explain pause against stop and devboxes against instances (14). Enums for TTL action, HTTP auth mode and instance status, with patterns and ranges on names, ports and page sizes. Metadata is a free string map (12). Guides give Python, TypeScript and CLI examples. 37 operations document only a 422 beyond success, the error schema is detail with an optional error_code, and no error-code reference was found (8). The changelog page has one entry from 19 November 2024 and says it is not a complete history. The API path has no version and the SDK tags have no release notes (3). 25+10+14+12+8+3 = 72.

Celesto (formerly SmolVM) 52

Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). computer logs shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.

Morph Cloud 39

Per the 8 October check of the docs, not re-read on 4 November. Bearer API keys bound to an organisation, listed with prefix and last-used time and deletable through the API. The docs mention key permissions in the dashboard without describing any. Devbox agent tokens are bound to one devbox with seven named scopes but do not expire. Short-lived delegation tokens exist for services (22). No read-only key for the instance API and no confirmation on stop or delete. Exposed HTTP services default to auth_mode: none, and the api_key mode asks callers to send the account's Morph API key to the service URL (8). Each instance is a full VM, but the docs name no isolation technology and no egress controls were found (5). Key last-used times, an organisation SSH key audit route and usage routes exist. No audit log of API calls found (4). security.txt returned 404 on cloud.morph.so and www.morph.so on 8 October. No disclosure policy, bug bounty or certification found. The terms list security controls and breach notification and offer "available third-party security attestations (e.g., SOC reports)" on request, without naming one (0). On 4 November osv.dev listed no advisory for morphcloud and the 2025 and 2026 CVE records named no Morph product. 22+8+5+4+0 = 39.

Celesto (formerly SmolVM) 69

A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). computer list, logs --follow and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). with Computer() creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.

Morph Cloud 61

Per the 8 October check of the OpenAPI file and docs, not re-read on 4 November. Instance and snapshot objects are bounded, list calls take a limit and a metadata filter, and there is no field selection. Exec returns stdout and stderr whole (15). /api/instance/list and /api/snapshot/list take page and limit (default 50, maximum 1,000) and a metadata filter. The older list routes are unpaginated (16). Newer routes document 400, 401, 402, 403, 404, 409 and 503 with a coded error body. Most routes document only 422, and no error reference was found (10). Idempotency-Key exists on API key creation only. Snapshot, branch, pause and reboot return Retry-After on a 503 refused before dispatch (8). Starting an instance needs only a snapshot id. Python SDK and CLI are current. The TypeScript SDK is 0.0.20 from 6 October 2025, the version the docs pin (12). 15+16+10+8+12 = 61.