# Celesto (formerly SmolVM) vs Morph Cloud (slim)

> Celesto scores 68 (B) to Morph Cloud's 51.6 (D) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.md (~5,750 tokens) · this version ~3,380 tokens · JSON https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.json · canonical https://www.anchorterminal.com/compare/celesto-vs-morph-cloud
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Morph Cloud's 51.6 (D), and leads in every scored category. Both do code sandboxes.

- Celesto (formerly SmolVM): B 68, rank #298 of 1486 · https://www.anchorterminal.com/tools/celesto.min.md
- Morph Cloud: D 51.6, rank #1014 of 1486 · https://www.anchorterminal.com/tools/morph-cloud.min.md
- Celesto (formerly SmolVM), good for Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud. Ahead on Schema & documentation, 85 against 72; Agent ergonomics, 69 against 61; Security & auth, 52 against 39; Payments & pricing, 60 against 20; Maintenance & community, 81 against 48; Transparency & trust, 70 against 44. Also No key needed to call it; Free to start without a card; Open source.
- Morph Cloud, good for Agents that need to checkpoint and fork a running machine with memory intact, for parallel attempts, evaluations or reinforcement learning rollouts. Also A hosted endpoint, with nothing to install.

| Category | Celesto (formerly SmolVM) | Morph Cloud |
| --- | --- | --- |
| Reliability (16%) | 66 | 63 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 85 | 72 |
| Agent ergonomics (13%) | 69 | 61 |
| Security & auth (14%) | 52 | 39 |
| Payments & pricing (10%) | 60 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 81 | 48 |
| Transparency & trust (7%) | 70 | 44 |

| Fact (where they differ) | Celesto (formerly SmolVM) | Morph Cloud |
| --- | --- | --- |
| Kind | SDK + MCP | HTTP API |
| Vendor | Celesto AI, Inc. | Morph Labs |
| Hosted endpoint | no (local only) | `https://cloud.morph.so/api` |
| Transports |  | HTTP |
| Auth | None | API key |
| Pricing | Freemium | Pay per use |
| Licence | Apache-2.0 | Proprietary hosted service under Morph Labs, Inc.'s Terms of Service (last revised 23 October 2025). The Python and TypeScript SDKs are Apache-2.0 |
| Last release | 2026-11-05 | 2026-10-20 |
| Terms last updated | 2026-10-30 | not read yet |
| Privacy policy last updated | 2026-10-30 | no document linked |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | not found in the text | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Popularity | 1.1k stars, 699 PyPI/wk | 3 stars, 339 npm/wk |

Why the edge:
- Payments & pricing, Celesto (formerly SmolVM) +40: Celesto (formerly SmolVM) 60 (Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.); Morph Cloud 20 (No x402, MPP or L402 found in the docs or the OpenAPI file on 8 October (0). Per the 8 October check, the pricing page defines the Morph Compute Unit (1 vCPU-hour with 4 GB RAM-hours and 16 GB disk-hours, or 5 TB snapshot-hours), states a standard rate of $0.05 an MCU and lists plans at $0, $40 and $250 a month without a login. The terms of 23 October 2025 add per-second compute billing and 30 days' notice of price changes (20). The Free plan starts with 0 MCUs and says to purchase MCUs to use compute. The FAQ refers readers to the billing console for any free credits (0). Signup is in a browser, and the key creation route needs an existing session or key (0). 0+20+0+0 = 20.)
- Maintenance & community, Celesto (formerly SmolVM) +33: Celesto (formerly SmolVM) 81 (0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.); Morph Cloud 48 (The Python SDK repository tagged v0.1.116 on 20 October 2026, a generated release that adds disk resizing to the SDK and CLI, 15 days before this check. pypi.org did not resolve on 4 November, so its upload date there is unconfirmed (30). Three tagged Python releases in the 90 days from 6 August 2026, v0.1.114 on 30 August, v0.1.115 on 1 September and v0.1.116 on 20 October. v0.1.115 changes only the version and the minimum Python version in `pyproject.toml`, a packaging-only release that counts half, so the count is two and a half, below three (0). Scored on the closed-service scale. The changelog is not kept, per the 8 October check. The terms give ops@morph.so and the status page support@morph.so. The two open pull requests on the Python SDK (1 April and 14 September 2026) had no comments on 8 October, and GitHub's pages answered 403 on 4 November (4). The Python SDK and CLI are current. The TypeScript SDK repository's newest tag is v0.0.19 from 2 October 2025 and its newest commit 6 October 2025, matching 0.0.20 on npm on 8 October (10). The Python repository has 18 unit test files, but its only workflow is a publish job run by hand, so no public CI run was found (4). 30+0+4+10+4 = 48.)
- Transparency & trust, Celesto (formerly SmolVM) +26: Celesto (formerly SmolVM) 70 (Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.); Morph Cloud 44 (The SDKs are Apache-2.0. The platform is closed, under Terms of Service last revised 23 October 2025 at cloud.morph.so/web/legal/terms-of-service, which name Morph Labs, Inc. of San Francisco, set California law and arbitration, and promise 15 days' notice of material changes (15). No privacy policy or DPA found. The terms say Morph staff do not access disk, memory or application data in instances except on a customer's time-bound request or by law, that such access is logged, that diagnostic artifacts are deleted per a retention schedule that is not published, and that usage telemetry is shared only aggregated or de-identified. The docs describe snapshot TTLs the customer sets and say Morph Actions data has no fixed retention period (8). No deprecation policy. The terms promise not to reduce core functionality materially during a committed billing term without a workaround or a refund, with no notice period for API changes. The OpenAPI file marks a few fields deprecated and keeps a legacy query alias, without dates (3). No subprocessor list or data location statement found (0). 15+8+3+0 = 26.)
- Schema & documentation, Celesto (formerly SmolVM) +13: Celesto (formerly SmolVM) 85 (Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.); Morph Cloud 72 (Per the 8 October check, not re-read on 4 November. Public OpenAPI 3.1 file at cloud.morph.so/api/openapi.json with 52 paths and 69 operations (25). llms.txt and llms-full.txt under /docs (10). 67 of 69 operations have a description, many of one line, while the guides explain pause against stop and devboxes against instances (14). Enums for TTL action, HTTP auth mode and instance status, with patterns and ranges on names, ports and page sizes. Metadata is a free string map (12). Guides give Python, TypeScript and CLI examples. 37 operations document only a 422 beyond success, the error schema is `detail` with an optional `error_code`, and no error-code reference was found (8). The changelog page has one entry from 19 November 2024 and says it is not a complete history. The API path has no version and the SDK tags have no release notes (3). 25+10+14+12+8+3 = 72.)
- Security & auth, Celesto (formerly SmolVM) +13: Celesto (formerly SmolVM) 52 (Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.); Morph Cloud 39 (Per the 8 October check of the docs, not re-read on 4 November. Bearer API keys bound to an organisation, listed with prefix and last-used time and deletable through the API. The docs mention key permissions in the dashboard without describing any. Devbox agent tokens are bound to one devbox with seven named scopes but do not expire. Short-lived delegation tokens exist for services (22). No read-only key for the instance API and no confirmation on stop or delete. Exposed HTTP services default to `auth_mode: none`, and the `api_key` mode asks callers to send the account's Morph API key to the service URL (8). Each instance is a full VM, but the docs name no isolation technology and no egress controls were found (5). Key last-used times, an organisation SSH key audit route and usage routes exist. No audit log of API calls found (4). security.txt returned 404 on cloud.morph.so and www.morph.so on 8 October. No disclosure policy, bug bounty or certification found. The terms list security controls and breach notification and offer "available third-party security attestations (e.g., SOC reports)" on request, without naming one (0). On 4 November osv.dev listed no advisory for `morphcloud` and the 2025 and 2026 CVE records named no Morph product. 22+8+5+4+0 = 39.)
- Agent ergonomics, Celesto (formerly SmolVM) +8: Celesto (formerly SmolVM) 69 (A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). `computer list`, `logs --follow` and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). `with Computer()` creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.); Morph Cloud 61 (Per the 8 October check of the OpenAPI file and docs, not re-read on 4 November. Instance and snapshot objects are bounded, list calls take a limit and a metadata filter, and there is no field selection. Exec returns stdout and stderr whole (15). `/api/instance/list` and `/api/snapshot/list` take `page` and `limit` (default 50, maximum 1,000) and a metadata filter. The older list routes are unpaginated (16). Newer routes document 400, 401, 402, 403, 404, 409 and 503 with a coded error body. Most routes document only 422, and no error reference was found (10). `Idempotency-Key` exists on API key creation only. Snapshot, branch, pause and reboot return `Retry-After` on a 503 refused before dispatch (8). Starting an instance needs only a snapshot id. Python SDK and CLI are current. The TypeScript SDK is 0.0.20 from 6 October 2025, the version the docs pin (12). 15+16+10+8+12 = 61.)