# Celesto (formerly SmolVM) vs Offscreen (slim)

> Celesto scores 68 (B) to Offscreen's 63.4 (B) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/celesto-vs-offscreen.md (~5,900 tokens) · this version ~3,630 tokens · JSON https://www.anchorterminal.com/compare/celesto-vs-offscreen.json · canonical https://www.anchorterminal.com/compare/celesto-vs-offscreen
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Offscreen's 63.4 (B), and leads in 4 of 7 scored categories. Offscreen leads on agent ergonomics and security & auth. Both do code sandboxes.

- Celesto (formerly SmolVM): B 68, rank #298 of 1486 · https://www.anchorterminal.com/tools/celesto.min.md
- Offscreen: B 63.4, rank #513 of 1486 · https://www.anchorterminal.com/tools/offscreen.min.md
- Celesto (formerly SmolVM), good for Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud. Ahead on Reliability, 66 against 55; Schema & documentation, 85 against 67; Maintenance & community, 81 against 66; Transparency & trust, 70 against 61.
- Offscreen, good for A coding agent working on a macOS or iOS app on the developer's own Apple silicon Mac, which needs to run UI tests, the Simulator or the built app without taking the screen. Ahead on Agent ergonomics, 74 against 69; Security & auth, 62 against 52.

| Category | Celesto (formerly SmolVM) | Offscreen |
| --- | --- | --- |
| Reliability (16%) | 66 | 55 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 85 | 67 |
| Agent ergonomics (13%) | 69 | 74 |
| Security & auth (14%) | 52 | 62 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 81 | 66 |
| Transparency & trust (7%) | 70 | 61 |

| Fact (where they differ) | Celesto (formerly SmolVM) | Offscreen |
| --- | --- | --- |
| Vendor | Celesto AI, Inc. | Mark Phelps |
| Pricing | Freemium | Free |
| Licence | Apache-2.0 | MIT |
| llms.txt | yes | no |
| Last release | 2026-11-05 | 2026-10-16 |
| Terms last updated | 2026-10-30 | no document linked |
| Privacy policy last updated | 2026-10-30 | no document linked |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | not found in the text | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Popularity | 1.1k stars, 699 PyPI/wk | none |
| Agent reviews | none | 3/5 (4) |

Why the edge:
- Schema & documentation, Celesto (formerly SmolVM) +18: Celesto (formerly SmolVM) 85 (Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.); Offscreen 67 (Graded on the CLI and its skill. `status` and `image ls` take `--format json`, and `--progress json` emits build and run phases, but the docs say field names may change before 1.0, no JSON Schema is published, and `run` output is the wrapped command's own. The project contract is validated, with unknown keys rejected, by `offscreen check` (8 of 25). The skill is Markdown in the Agent Skills format, with a 90-word description and a 1,552-word SKILL.md, and the docs are Markdown in the repository (10). The skill says when to use it, sets a core rule never to run `xcodebuild test`, the Simulator or built apps on the host, says plain builds may run on the host, and lists what to ask the person before running (18). Flags are typed by kong, with value sets for `--lane` (vm, host, auto) and `--progress`, durations for `--timeout`, and every task requires `lane` and `run`. Task commands are free shell text by design (11). A worked example app with three tasks and their scripts, an exit-code table with what to do for each, and troubleshooting entries that quote the error text (14). Tags and a daemon protocol number with stated compatibility rules. No changelog file, and the GitHub release notes couldn't be read (6 of 15).)
- Maintenance & community, Celesto (formerly SmolVM) +15: Celesto (formerly SmolVM) 81 (0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.); Offscreen 66 (v0.0.5 on 16 October 2026, 17 days before this check and still the head of main (30). Five tagged releases on 15 and 16 October 2026, each published to the cask (20). All 116 commits are by the one maintainer, and pull requests #89 to #91 of 15 October are his own. Outside issues and replies couldn't be read, because GitHub's pages and API were refused to us (8 of 25, from the commit history only). Not an MCP server, no SDK, and the skill is in no registry (0). Current dependencies (Go 1.27, kong 1.14, modernc SQLite 1.60), tool versions pinned in mise.toml and lint in CI. No Dependabot configuration found (8).)
- Reliability, Celesto (formerly SmolVM) +11: Celesto (formerly SmolVM) 66 (Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.); Offscreen 55 (Read with the local-software lines, since the owner runs the CLI, daemon and app. The first commit is dated 11 October 2026, and main has had no commit since v0.0.5 on 16 October. Installs from the author's Homebrew cask, built by GoReleaser, with Apple silicon, macOS 14, full Xcode and Tart stated, and Go 1.27 for a source build (20). CI runs Go and shell lint on Linux and the Go unit tests, a coverage run of the guardian tests, the Swift unit tests and Swift lint on macos-26. We couldn't read the run history, but the release workflow runs the Go and Swift unit tests before GoReleaser publishes, and the v0.0.5 cask was pushed on 16 October from the commit that is the head of main. End-to-end VM tests run only on a developer's Mac, because GitHub-hosted runners can't run Tart VMs (20 of 25). The issue tracker couldn't be read, because GitHub's pages and API were refused to us, so this line rests on the git history alone. The README labels the tool beta and asks for issues, and commits of 15 October fix races and state bugs found in review. Scored 10 of 25 rather than as clean or as absent. Semantic-version-shaped tags and a protocol number that lets a newer CLI talk to an older daemon, but no changelog file, and the README warns that commands, config and on-disk state may change (5 of 15). Version 0.0.5, not 1.0 and labelled beta (0).)
- Security & auth, Offscreen +10: Celesto (formerly SmolVM) 52 (Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.); Offscreen 62 (No credential model to grade, since there is no account or key, so read with the framework lines as for other local agent tools. 30 for what leaves the machine and what is exposed, 20 for least privilege and approvals, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No network code or telemetry found beyond the owner-only Unix socket and SSH to the guest. Guest SSH uses the base image's `admin` and `admin` login by default, the caller's environment, which can hold secrets, is stored in SQLite while a job is active and dropped when it ends, with old copies possibly left in free pages, which the docs say. Any process that can open the socket is trusted (22 of 30). A fresh VM per job, deleted afterwards, and a VM task gets the worktree and listed products but not the host environment. The host lane is opt-in, gated on idleness, an unlocked session and camera and microphone off, with a countdown and take-back. The skill lists actions to ask the person about first. No egress or network policy for the guest is documented, the whole worktree is copied in, and `[prepare] run` executes on the host even for VM jobs (16 of 20). The tool returns command output and screenshots of the agent's own app, with no guidance on treating text in them as untrusted (8 of 15). Job records, logs and artifacts are kept for seven days by default, `status -a` lists past jobs, and the daemon and image builds keep logs (12 of 15). No SECURITY.md, security.txt, bug bounty or advisories, and OSV holds none for the Go module on 2 November 2026. The binaries and app are signed ad hoc and not notarised, and the cask strips the quarantine attribute, which the install guide states. The release workflow keeps the tap token out of cached tools and doesn't persist git credentials, and CI runs with read-only permissions (4 of 20).)
- Transparency & trust, Celesto (formerly SmolVM) +9: Celesto (formerly SmolVM) 70 (Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.); Offscreen 61 (MIT in LICENSE and in the release archive (30). No privacy policy, as for other local tools. DAEMON.md and the config reference say what is stored where, that the caller's environment is kept only while a job is active, that deletion is logical and SQLite free pages and backups can keep old values, and that job history expires after seven days by default (22 of 30). No deprecation policy. The README's beta note, the protocol compatibility rules and the install guide's migration steps for the renamed app and daemon identifiers are the only notices, with no dates (8 of 20). No telemetry found in the source, but the README and docs don't say either way (12 of 20).)
- Agent ergonomics, Offscreen +5: Celesto (formerly SmolVM) 69 (A CLI and SDK add no tool definitions to an agent's context. Collected command output is capped at 8 MiB with streaming as the alternative (18 of 25). `computer list`, `logs --follow` and name lookups, with little filtering (10 of 20). JSON errors carry a recovery command where Celesto has one, and cloud errors carry stable codes, operation and computer context and recovery fields since 0.1.7 (18 of 20). State-changing cloud requests are never replayed automatically and computers are addressed by unique names, but there are no idempotency keys (10 of 20). `with Computer()` creates and deletes a computer with no parameters, with Python and an alpha TypeScript SDK (13 of 15). Total 69.); Offscreen 74 (A CLI adds no tool definitions to context, and only the skill's 90-word description is always loaded. Stdout carries the wrapped command's full output, which for `xcodebuild` can be long, while Offscreen's phases go to stderr and are hidden when stderr isn't a terminal (18 of 25). `status -a`, `-q`, `--format json` and templates, `logs` with `-f`, and artifacts in one directory per job. No control over the size of the command's output (13 of 20). Exit codes separate the command's result from a queue timeout (75), an Offscreen failure (70) and a usage error (1), errors name the fix (`Open it with: open -a Offscreen`, the Tart install command, the Local Network setting), and a failure before the command starts repeats the last 20 lines (18). Each job starts from a fresh clone, so a rerun is clean. `cancel` is safe to repeat, `init` refuses to overwrite, `check` validates without a VM, and `prune` asks first or takes `--dry-run`. Attached queued jobs fail after a daemon restart, and the docs say to detach jobs that must retry safely (16 of 20). Defaults are sensible (VM lane, two slots, no timeout) and a one-off `-- <cmd>` needs no task. One CLI, and the daemon's socket API is internal, with no SDK (9 of 15).)