# Celesto (formerly SmolVM) vs Offscreen

> Celesto scores 68 (B) to Offscreen's 63.4 (B) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/celesto-vs-offscreen
- Markdown: https://www.anchorterminal.com/compare/celesto-vs-offscreen.md (~5,900 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Offscreen's 63.4 (B), and leads in 4 of 7 scored categories. Offscreen leads on agent ergonomics and security & auth. Both do code sandboxes.

- Celesto (formerly SmolVM): grade B, 68/100, rank #298 of 1486. Markdown https://www.anchorterminal.com/tools/celesto.md · JSON https://www.anchorterminal.com/api/v1/tools/celesto.json
- Offscreen: grade B, 63.4/100, rank #513 of 1486. Markdown https://www.anchorterminal.com/tools/offscreen.md · JSON https://www.anchorterminal.com/api/v1/tools/offscreen.json
- Best code execution sandboxes for AI agents: https://www.anchorterminal.com/best/code-sandboxes/index.md
- All 231 sandboxes comparisons: https://www.anchorterminal.com/compare/code-sandboxes/index.md

## Which one, for what

### Celesto (formerly SmolVM) (B)

Good for: Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.

Ahead on:
- Reliability, 66 against 55
- Schema & documentation, 85 against 67
- Maintenance & community, 81 against 66
- Transparency & trust, 70 against 61

Watch for: Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball

### Offscreen (B)

Good for: A coding agent working on a macOS or iOS app on the developer's own Apple silicon Mac, which needs to run UI tests, the Simulator or the built app without taking the screen.

Ahead on:
- Agent ergonomics, 74 against 69
- Security & auth, 62 against 52

Watch for: First commit 11 October 2026, version 0.0.5 and labelled beta, with JSON field names that may change before 1.0


## Why the edge

### Schema & documentation: Celesto (formerly SmolVM) +18

- Celesto (formerly SmolVM) (85): Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.
- Offscreen (67): Graded on the CLI and its skill. `status` and `image ls` take `--format json`, and `--progress json` emits build and run phases, but the docs say field names may change before 1.0, no JSON Schema is published, and `run` output is the wrapped command's own. The project contract is validated, with unknown keys rejected, by `offscreen check` (8 of 25). The skill is Markdown in the Agent Skills format, with a 90-word description and a 1,552-word SKILL.md, and the docs are Markdown in the repository (10). The skill says when to use it, sets a core rule never to run `xcodebuild test`, the Simulator or built apps on the host, says plain builds may run on the host, and lists what to ask the person before running (18). Flags are typed by kong, with value sets for `--lane` (vm, host, auto) and `--progress`, durations for `--timeout`, and every task requires `lane` and `run`. Task commands are free shell text by design (11). A worked example app with three tasks and their scripts, an exit-code table with what to do for each, and troubleshooting entries that quote the error text (14). Tags and a daemon protocol number with stated compatibility rules. No changelog file, and the GitHub release notes couldn't be read (6 of 15).

### Maintenance & community: Celesto (formerly SmolVM) +15

- Celesto (formerly SmolVM) (81): 0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.
- Offscreen (66): v0.0.5 on 16 October 2026, 17 days before this check and still the head of main (30). Five tagged releases on 15 and 16 October 2026, each published to the cask (20). All 116 commits are by the one maintainer, and pull requests #89 to #91 of 15 October are his own. Outside issues and replies couldn't be read, because GitHub's pages and API were refused to us (8 of 25, from the commit history only). Not an MCP server, no SDK, and the skill is in no registry (0). Current dependencies (Go 1.27, kong 1.14, modernc SQLite 1.60), tool versions pinned in mise.toml and lint in CI. No Dependabot configuration found (8).

### Reliability: Celesto (formerly SmolVM) +11

- Celesto (formerly SmolVM) (66): Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.
- Offscreen (55): Read with the local-software lines, since the owner runs the CLI, daemon and app. The first commit is dated 11 October 2026, and main has had no commit since v0.0.5 on 16 October. Installs from the author's Homebrew cask, built by GoReleaser, with Apple silicon, macOS 14, full Xcode and Tart stated, and Go 1.27 for a source build (20). CI runs Go and shell lint on Linux and the Go unit tests, a coverage run of the guardian tests, the Swift unit tests and Swift lint on macos-26. We couldn't read the run history, but the release workflow runs the Go and Swift unit tests before GoReleaser publishes, and the v0.0.5 cask was pushed on 16 October from the commit that is the head of main. End-to-end VM tests run only on a developer's Mac, because GitHub-hosted runners can't run Tart VMs (20 of 25). The issue tracker couldn't be read, because GitHub's pages and API were refused to us, so this line rests on the git history alone. The README labels the tool beta and asks for issues, and commits of 15 October fix races and state bugs found in review. Scored 10 of 25 rather than as clean or as absent. Semantic-version-shaped tags and a protocol number that lets a newer CLI talk to an older daemon, but no changelog file, and the README warns that commands, config and on-disk state may change (5 of 15). Version 0.0.5, not 1.0 and labelled beta (0).

### Security & auth: Offscreen +10

- Celesto (formerly SmolVM) (52): Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.
- Offscreen (62): No credential model to grade, since there is no account or key, so read with the framework lines as for other local agent tools. 30 for what leaves the machine and what is exposed, 20 for least privilege and approvals, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No network code or telemetry found beyond the owner-only Unix socket and SSH to the guest. Guest SSH uses the base image's `admin` and `admin` login by default, the caller's environment, which can hold secrets, is stored in SQLite while a job is active and dropped when it ends, with old copies possibly left in free pages, which the docs say. Any process that can open the socket is trusted (22 of 30). A fresh VM per job, deleted afterwards, and a VM task gets the worktree and listed products but not the host environment. The host lane is opt-in, gated on idleness, an unlocked session and camera and microphone off, with a countdown and take-back. The skill lists actions to ask the person about first. No egress or network policy for the guest is documented, the whole worktree is copied in, and `[prepare] run` executes on the host even for VM jobs (16 of 20). The tool returns command output and screenshots of the agent's own app, with no guidance on treating text in them as untrusted (8 of 15). Job records, logs and artifacts are kept for seven days by default, `status -a` lists past jobs, and the daemon and image builds keep logs (12 of 15). No SECURITY.md, security.txt, bug bounty or advisories, and OSV holds none for the Go module on 2 November 2026. The binaries and app are signed ad hoc and not notarised, and the cask strips the quarantine attribute, which the install guide states. The release workflow keeps the tap token out of cached tools and doesn't persist git credentials, and CI runs with read-only permissions (4 of 20).

### Transparency & trust: Celesto (formerly SmolVM) +9

- Celesto (formerly SmolVM) (70): Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.
- Offscreen (61): MIT in LICENSE and in the release archive (30). No privacy policy, as for other local tools. DAEMON.md and the config reference say what is stored where, that the caller's environment is kept only while a job is active, that deletion is logical and SQLite free pages and backups can keep old values, and that job history expires after seven days by default (22 of 30). No deprecation policy. The README's beta note, the protocol compatibility rules and the install guide's migration steps for the renamed app and daemon identifiers are the only notices, with no dates (8 of 20). No telemetry found in the source, but the README and docs don't say either way (12 of 20).

### Agent ergonomics: Offscreen +5

- Celesto (formerly SmolVM) (69): A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). `computer list`, `logs --follow` and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). `with Computer()` creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.
- Offscreen (74): A CLI adds no tool definitions to context, and only the skill's 90-word description is always loaded. Stdout carries the wrapped command's full output, which for `xcodebuild` can be long, while Offscreen's phases go to stderr and are hidden when stderr isn't a terminal (18 of 25). `status -a`, `-q`, `--format json` and templates, `logs` with `-f`, and artifacts in one directory per job. No control over the size of the command's output (13 of 20). Exit codes separate the command's result from a queue timeout (75), an Offscreen failure (70) and a usage error (1), errors name the fix (`Open it with: open -a Offscreen`, the Tart install command, the Local Network setting), and a failure before the command starts repeats the last 20 lines (18). Each job starts from a fresh clone, so a rerun is clean. `cancel` is safe to repeat, `init` refuses to overwrite, `check` validates without a VM, and `prune` asks first or takes `--dry-run`. Attached queued jobs fail after a daemon restart, and the docs say to detach jobs that must retry safely (16 of 20). Defaults are sensible (VM lane, two slots, no timeout) and a one-off `-- <cmd>` needs no task. One CLI, and the daemon's socket API is internal, with no SDK (9 of 15).

## Score by category

| Category | Weight | Celesto (formerly SmolVM) | Offscreen | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 66 | 55 | Celesto (formerly SmolVM) +11 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 85 | 67 | Celesto (formerly SmolVM) +18 |
| Agent ergonomics | 13% (16.2 this run) | 69 | 74 | Offscreen +5 |
| Security & auth | 14% (17.5 this run) | 52 | 62 | Offscreen +10 |
| Payments & pricing | 10% (12.5 this run) | 60 | 60 | even |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 81 | 66 | Celesto (formerly SmolVM) +15 |
| Transparency & trust | 7% (8.8 this run) | 70 | 61 | Celesto (formerly SmolVM) +9 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **68 · B** | **63.4 · B** | |

## Facts side by side

| Fact | Celesto (formerly SmolVM) | Offscreen |
| --- | --- | --- |
| Kind | SDK + MCP | SDK + MCP |
| Vendor | Celesto AI, Inc. | Mark Phelps |
| Hosted endpoint | no (local only) | no (local only) |
| Transports |  |  |
| Auth | None | None |
| Pricing | Freemium | Free |
| x402 | no | no |
| Licence | Apache-2.0 | MIT |
| Read-only variant documented | no | no |
| llms.txt | yes | no |
| Last release | 2026-11-05 | 2026-10-16 |
| Terms last updated | 2026-10-30 | no document linked |
| Privacy policy last updated | 2026-10-30 | no document linked |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | not found in the text | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Popularity | 1.1k stars, 699 PyPI/wk | none |
| Agent reviews | none | 3/5 (4) |

## How the scores have moved

### Celesto (formerly SmolVM)

No score change since it was listed.

### Offscreen

- +0.5 on 27 October 2026: new evidence

## Verdicts

**Celesto (formerly SmolVM).** Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.

**Offscreen.** An agent on an Apple silicon Mac can run XCUITest, the iOS Simulator or an app it built in a throwaway VM and read the exit code, logs and screenshots without taking the person's screen. The project began on 11 October 2026, is at v0.0.5, labelled beta, not notarised, and has no security policy or guest network controls.

## Before you call either

### Celesto (formerly SmolVM)

1. Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text
2. Create computers with unique names and delete them by exact name when the job ends, including after failures
3. Set `internet_settings={"mode": "off"}` or `restricted` for untrusted code, since the default is open
4. Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine
5. Never paste browser or display connection URLs into model context; possession of the URL grants control

### Offscreen

1. Read `.offscreen.toml` before running anything and use its `project` key and task names. Don't guess them
2. Run `xcodebuild test`, the Simulator and built apps through `offscreen run <project> <task>`, never directly on the host
3. Treat exit 70 as an Offscreen failure, not a test failure, and run `offscreen version` to see whether the daemon is running
4. Ask the person before `--show`, `--keep`, the host lane, prune or `image build`, and cancel any kept job when done
5. Read screenshots and `.xcresult` bundles from the directory `offscreen artifacts <job>` prints

## Questions

### Which is better for AI agents, Celesto (formerly SmolVM) or Offscreen?

Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Offscreen's 63.4 (B), and leads in 4 of 7 scored categories. Offscreen leads on agent ergonomics and security & auth.

### Are Celesto (formerly SmolVM) and Offscreen open source?

Yes. Celesto (formerly SmolVM) is open source (Apache-2.0). Offscreen is open source (MIT).


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/celesto-vs-offscreen.json, and with the fewest tokens: https://www.anchorterminal.com/compare/celesto-vs-offscreen.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "celesto", "b": "offscreen"}`. From a terminal: `anchor compare celesto offscreen`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/celesto.json and https://www.anchorterminal.com/api/v1/tools/offscreen.json

## Other comparisons with Celesto (formerly SmolVM) or Offscreen

- [Agent 37 Cloud vs Offscreen](https://www.anchorterminal.com/compare/agent37-vs-offscreen.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Offscreen](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-offscreen.md)
- [Blaxel Sandboxes vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.md)
- [Blaxel Sandboxes vs Offscreen](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-offscreen.md)
- [Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.md)
- [Celesto (formerly SmolVM) vs Daytona](https://www.anchorterminal.com/compare/celesto-vs-daytona.md)
- [Celesto (formerly SmolVM) vs DeltaBox Lite](https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.md)
- [Celesto (formerly SmolVM) vs Deno Sandbox](https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.md)
- [Celesto (formerly SmolVM) vs E2B](https://www.anchorterminal.com/compare/celesto-vs-e2b.md)
- [Celesto (formerly SmolVM) vs Freestyle](https://www.anchorterminal.com/compare/celesto-vs-freestyle.md)
- [Celesto (formerly SmolVM) vs InstaVM](https://www.anchorterminal.com/compare/celesto-vs-instavm.md)
- [Celesto (formerly SmolVM) vs Maritime](https://www.anchorterminal.com/compare/celesto-vs-maritime.md)
- [Celesto (formerly SmolVM) vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.md)
- [Celesto (formerly SmolVM) vs Modal Sandboxes](https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.md)
- [Celesto (formerly SmolVM) vs Morph Cloud](https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.md)
- [Celesto (formerly SmolVM) vs SPACE](https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.md)
- [Celesto (formerly SmolVM) vs Runloop Devboxes](https://www.anchorterminal.com/compare/celesto-vs-runloop.md)
- [Celesto (formerly SmolVM) vs Sandbox0](https://www.anchorterminal.com/compare/celesto-vs-sandbox0.md)
- [Celesto (formerly SmolVM) vs Sprites](https://www.anchorterminal.com/compare/celesto-vs-sprites.md)
- [Celesto (formerly SmolVM) vs Together Code Sandbox](https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.md)
- [Celesto (formerly SmolVM) vs Vercel Sandbox](https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.md)
- [Cloudflare Sandbox SDK vs Offscreen](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-offscreen.md)
- [Daytona vs Offscreen](https://www.anchorterminal.com/compare/daytona-vs-offscreen.md)
- [Deno Sandbox vs Offscreen](https://www.anchorterminal.com/compare/deno-sandbox-vs-offscreen.md)
- [E2B vs Offscreen](https://www.anchorterminal.com/compare/e2b-vs-offscreen.md)
- [Freestyle vs Offscreen](https://www.anchorterminal.com/compare/freestyle-vs-offscreen.md)
- [InstaVM vs Offscreen](https://www.anchorterminal.com/compare/instavm-vs-offscreen.md)
- [Maritime vs Offscreen](https://www.anchorterminal.com/compare/maritime-vs-offscreen.md)
- [Microsoft Execution Containers vs Offscreen](https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-offscreen.md)
- [Modal Sandboxes vs Offscreen](https://www.anchorterminal.com/compare/modal-sandboxes-vs-offscreen.md)
- [Morph Cloud vs Offscreen](https://www.anchorterminal.com/compare/morph-cloud-vs-offscreen.md)
- [Offscreen vs SPACE](https://www.anchorterminal.com/compare/offscreen-vs-perplexity-space.md)
- [Offscreen vs Runloop Devboxes](https://www.anchorterminal.com/compare/offscreen-vs-runloop.md)
- [Offscreen vs Sandbox0](https://www.anchorterminal.com/compare/offscreen-vs-sandbox0.md)
- [Offscreen vs Sprites](https://www.anchorterminal.com/compare/offscreen-vs-sprites.md)
- [Offscreen vs Together Code Sandbox](https://www.anchorterminal.com/compare/offscreen-vs-together-code-sandbox.md)
- [Offscreen vs Vercel Sandbox](https://www.anchorterminal.com/compare/offscreen-vs-vercel-sandbox.md)
- [Agent 37 Cloud vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agent37-vs-celesto.md)
- [DeltaBox Lite vs Offscreen](https://www.anchorterminal.com/compare/deltabox-lite-vs-offscreen.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp