{ "data": { "a": { "slug": "celesto", "name": "Celesto (formerly SmolVM)", "vendor": "Celesto AI, Inc.", "vendorUrl": "https://celesto.ai", "kind": "sdk", "category": "code-sandboxes", "summary": "Celesto, formerly SmolVM, is an open-source Python SDK and CLI from Celesto AI that runs disposable Firecracker or QEMU microVMs on the owner's machine for agent code, browsers and desktops, with an optional paid Celesto Cloud.", "url": "https://www.anchorterminal.com/tools/celesto", "markdownUrl": "https://www.anchorterminal.com/tools/celesto.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/celesto.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/celesto.json", "dns": "celesto.grade.anchorterminal.com", "repo": "https://github.com/CelestoAI/Celesto", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "pypi", "name": "celesto" } ], "auth": "none", "authNotes": "Local use needs no account or key. The local API server and dashboard each require a bearer token, generated at start or read from CELESTO_SERVER_TOKEN and CELESTO_DASHBOARD_TOKEN. Celesto Cloud uses an organisation-bound CELESTO_API_KEY with named permissions (see, execute, delete) set in the dashboard.", "pricing": "freemium", "pricingNotes": "The local SDK and CLI are free under Apache-2.0. Celesto Cloud bills sandboxes by the running hour from $0.015 (Micro, 1 vCPU, 2 GB) to $0.16 (XL, 8 vCPU, 32 GB), prepaid from $2.01, with a one-time $5 Micro credit and no card.", "priceSummary": "$0.015 / session-hr", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the repository, the docs, llms.txt or the pricing page (checked 2026-11-06). Cloud runtime is prepaid by card under Settings \u003e Billing.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1149, "npmWeekly": null, "pypiWeekly": 699, "asOf": "2026-11-06" }, "docsUrl": "https://celesto.ai/docs", "llmsTxt": "https://celesto.ai/llms.txt", "openapi": "https://github.com/CelestoAI/Celesto/blob/main/ts/celesto-local-server.openapi.json", "capabilities": [ "sandbox.code", "sandbox.fs", "sandbox.persist", "sandbox.browser" ], "tags": [ "open-source", "local", "self-hosted", "hosted", "freemium", "no-card", "free-tier", "apache-2.0", "python", "typescript", "cli", "microvm", "firecracker", "llms-txt", "openapi", "telemetry", "pre-1.0", "renamed" ], "lastRelease": "2026-11-05", "graded": true, "anchor": { "graded": true, "score": 68, "grade": "B", "agentReady": false, "rank": 299, "ranked": true, "rankOf": 1510, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 81, "payments": 60, "reliability": 66, "schema": 85, "security": 52, "transparency": 70 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.", "bestFor": "Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.", "strengths": [ "Apache-2.0, installs from PyPI with `celesto setup` and `celesto doctor`, and runs local microVMs with no account or key", "Every `--json` response has the same `ok`, `command`, `exit_code`, `data` and `error` fields, with recovery commands in errors", "Network modes `off`, `public` (proxy that rejects private and metadata addresses) and `restricted` with CIDR or domain allowlists", "Dated changelog with Security sections, breaking changes marked, and 22 PyPI releases in the 90 days to 6 November 2026", "OpenAPI documents for the local server (24 operations) and the cloud API (171 operations) in the repository, plus llms.txt" ], "weaknesses": [ "Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball", "Outbound network access is open by default, and Linux TAP mode does not block every private network or metadata service", "Usage telemetry to PostHog is on after a first-use notice, until switched off", "Renamed from SmolVM on 19 September 2026 in a breaking release that removed the `smolvm` command and import path", "No security.txt, bug bounty or certification found, and CI results could not be read" ], "agentNotes": [ "Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text", "Create computers with unique names and delete them by exact name when the job ends, including after failures", "Set `internet_settings={\"mode\": \"off\"}` or `restricted` for untrusted code, since the default is open", "Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine", "Never paste browser or display connection URLs into model context; possession of the URL grants control" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68 } ], "editorialScores": { "ergonomics": 69, "maintenance": 81, "payments": 60, "reliability": 66, "schema": 85, "security": 52, "transparency": 74 }, "provenanceScore": 66, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install celesto \u0026\u0026 celesto setup \u0026\u0026 celesto doctor", "headless": { "create": "celesto computer create --name agent-job --json", "delete": "celesto computer delete agent-job --json", "exec": "celesto computer exec agent-job --json -- python -m pytest" } }, "letme": { "capability": "https://letme.dev/sandbox.code", "tool": "https://letme.dev/celesto" }, "area": "agent-runtime", "unitPrices": [ { "item": "Cloud Micro sandbox (1 vCPU, 2 GB)", "unit": "session-hour", "usd": 0.015, "note": "Billed by the running hour; local use is free" }, { "item": "Cloud XL sandbox (8 vCPU, 32 GB)", "unit": "session-hour", "usd": 0.16, "note": "Largest size on the pricing page" } ], "provenance": { "legalEntity": "Celesto AI, Inc.", "domain": "celesto.ai", "domainRegistered": "2025-07-13", "endpointOnVendorDomain": null, "terms": "https://celesto.ai/legal/terms", "privacy": "https://celesto.ai/legal/privacy-policy", "statusPage": "", "changelog": "https://github.com/CelestoAI/Celesto/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The privacy policy, last updated 30 October 2026, names Celesto AI, Inc., a Delaware corporation with a Wilmington mailing address. It has no clause on automated access.", "celesto.ai/robots.txt allows all crawlers. docs.celesto.ai carries Content-Signal ai-train=yes, search=yes, ai-input=yes.", "RDAP gives celesto.ai a registration date of 13 July 2025.", "/.well-known/security.txt returns 404. SECURITY.md asks for private reports through GitHub's vulnerability reporting. No status page is linked from the pricing page." ], "score": 66 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/celesto.json", "live": { "slug": "celesto", "versions": [ { "registry": "github", "name": "CelestoAI/Celesto", "version": "v0.1.13", "released": "2026-11-05", "seenAt": "2026-11-06T23:13:37.416837168Z" }, { "registry": "pypi", "name": "celesto", "version": "0.1.13", "released": "2026-11-05", "seenAt": "2026-11-06T23:13:37.309276304Z" } ], "githubStars": 1149, "pypiWeekly": 699, "securityTxt": { "url": "https://celesto.ai/.well-known/security.txt", "state": "unknown", "checkedAt": "2026-11-07T16:01:01.176888246Z" }, "llmsTxt": { "url": "https://celesto.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:46.784166983Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/CelestoAI/Celesto/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:18:00.719411253Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8ddae4a6adbd" }, { "url": "https://celesto.ai/legal/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:00:50.868104256Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "87ce310b1db6" }, { "url": "https://celesto.ai/legal/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:00:53.107282947Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1dece6f9a42e" } ], "updatedAt": "2026-11-07T16:01:01.176888246Z" } }, "answer": "Celesto (formerly SmolVM) scores 68 (B) on agent readiness against SPACE's 55.1 (C), and leads in 4 of 7 scored categories. SPACE leads on security \u0026 auth.", "b": { "slug": "perplexity-space", "name": "SPACE", "vendor": "Perplexity", "vendorUrl": "https://space.docs.perplexity.ai/guide/index.html", "kind": "http-api", "category": "code-sandboxes", "summary": "SPACE is Perplexity's open-source, self-hosted platform for running agent code in Firecracker microVMs. An operator deploys it on Linux with KVM, and applications drive sandboxes through its HTTP and SSE API or an E2B-compatible API.", "url": "https://www.anchorterminal.com/tools/perplexity-space", "markdownUrl": "https://www.anchorterminal.com/tools/perplexity-space.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/perplexity-space.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/perplexity-space.json", "dns": "perplexity-space.grade.anchorterminal.com", "repo": "https://github.com/perplexityai/SPACE", "license": "Apache-2.0", "transports": [ "http" ], "packages": [], "auth": "mixed", "authNotes": "Nothing to sign up for with Perplexity. On a deployment, the native API takes `Authorization: Bearer` with a token from a password login at `/auth/v1/sessions` or a service token, and users hold admin or member roles. Command streams on the data plane take a separate session-scoped token, valid for 5 minutes, that the API returns with each command. The E2B Compatibility Wrapper takes an E2B-style key in `X-API-Key`, which an operator creates with scripts/seed-api-key.sh and an SQL insert. SPACE stores only its SHA-256 hash. No key scopes or revocation call were found in the reviewed documentation.", "pricing": "free", "pricingNotes": "Free under Apache-2.0, with nothing to buy from Perplexity and no hosted SPACE service. The cost is the operator's own hosts, which need Linux x86_64 with KVM (bare-metal instances in Perplexity's reference EKS deployment), plus PostgreSQL and S3-compatible object storage, with Valkey in the reference EKS deployment (checked 2026-10-16).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the README, the docs, the OpenAPI document or the source read on 16 October 2026. Self-hosted open-source software with no paid endpoint.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-16" }, "docsUrl": "https://space.docs.perplexity.ai/guide/index.html", "openapi": "https://space.docs.perplexity.ai/api/openapi.json", "capabilities": [ "sandbox.code", "sandbox.persist", "sandbox.fs" ], "tags": [ "open-source", "self-hosted", "free", "no-card", "apache-2.0", "rust", "linux", "kubernetes", "microvm", "openapi", "e2b-compatible", "pre-1.0", "new" ], "graded": true, "anchor": { "graded": true, "score": 55.1, "grade": "C", "agentReady": false, "rank": 881, "ranked": true, "rankOf": 1510, "categoryRank": 17, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 66, "maintenance": 11, "payments": 60, "reliability": 32, "schema": 75, "security": 64, "transparency": 70 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": 0, "verdict": "Once deployed, SPACE's native API has a public OpenAPI 3.1 contract, stable error codes with a retryable flag and 24-hour idempotency keys, and egress and credential controls sit outside the VM. A person must first deploy it on a Linux x86_64 host with KVM and Kubernetes. Version 0.8.0 has no tagged release, changelog or public container images.", "bestFor": "Teams that want E2B-style microVM sandboxes on their own Linux and Kubernetes hosts, with egress and credential control outside the guest.", "strengths": [ "OpenAPI 3.1 for 14 supported operations, served by each deployment at `/openapi-m1.json` and published on the docs site", "Errors carry a stable `code`, a `retryable` flag and a request ID, and lifecycle calls and command creation take a 24-hour `Idempotency-Key`", "Per-sandbox egress policies with allow and deny lists, operator egress profiles and TLS interception are enforced by a gateway outside the guest", "The network gateway can add secret headers from AWS Secrets Manager for an exact host and path, so the guest never holds the value", "An E2B Compatibility Wrapper lets the E2B Python SDK, tested at e2b 2.21.1, use a SPACE deployment as its backend" ], "weaknesses": [ "A person must deploy it first, on an apt-based Linux x86_64 host with KVM, privileged Docker and Kubernetes (Kind in the guide)", "Version 0.8.0 has no git tag, GitHub release or changelog, and CI pushes container images only to a private registry", "The `network_policy` and idle-lifecycle create fields are marked incubating, outside the supported contract, and typed as open objects", "Credential injection is off by default, needs AWS Secrets Manager, and has no page of its own in the user guide", "The wrapper rejects E2B's `mcp`, `volumeMounts` and `iam` options, team template names and pause without memory, and only Python is tested" ], "agentNotes": [ "Ask your operator for the API base URL (before `/v1`, or `/api/v1` on shared hosts), the data-plane URL and a bearer token before planning any call", "Poll the returned operation until it succeeds and the sandbox is `running` before creating a command. A 202 response is not readiness", "Attach to the command's events URL with its session token to start the process, decode base64 output, and treat only `process_exited` as completion", "Send an `Idempotency-Key` on creates, lifecycle calls and commands, and retry only when `retryable` is true, after any `Retry-After`", "Save output as it arrives. Reconnecting with `Last-Event-ID` returns `resync_required`, not the missed output" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 55.1 } ], "editorialScores": { "ergonomics": 66, "maintenance": 11, "payments": 60, "reliability": 32, "schema": 75, "security": 64, "transparency": 73 }, "provenanceScore": 66, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "git clone https://github.com/perplexityai/SPACE.git \u0026\u0026 cd SPACE\nbash infra/space/kind/scripts/install-prereqs.sh\nexport SPACE_VENDOR_ROOT=\"$HOME/.local/share/space/vendor\"\nexport SPACE_KIND_CLUSTER=space-local\nbash infra/space/kind/scripts/install-fc-vendor.sh\nbash infra/space/kind/scripts/bootstrap.sh", "http": "curl --fail-with-body --silent --show-error \\\n --header \"Authorization: Bearer $SPACE_API_TOKEN\" \\\n \"${SPACE_API_URL%/}/v1/sandboxes\"" }, "letme": { "capability": "https://letme.dev/sandbox.code", "tool": "https://letme.dev/perplexity-space" }, "sameCompany": [ "perplexity-search-api", "pplx-decider", "pplx-decider-flash" ], "area": "agent-runtime", "provenance": { "legalEntity": "Perplexity AI", "domain": "perplexity.ai", "domainRegistered": "2022-07-08", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "valid", "checked": "2026-10-16", "notes": [ "LICENSE reads 'Copyright 2026 Perplexity AI', and the repository's Claude Code plugin manifest names Perplexity AI as owner. No fuller legal entity name was found in the repository or the docs.", "The docs site is space.docs.perplexity.ai and the repository is under GitHub's perplexityai organisation. RDAP from Identity Digital gives perplexity.ai a registration date of 8 July 2022.", "No terms or privacy policy applies to the self-hosted software beyond the Apache-2.0 licence. There is no hosted SPACE endpoint, so no status page.", "No changelog or release notes. docs/versioning.md says the v0.8.0 tag should mark the tested commit, and the clone had no tags on 16 October 2026.", "https://www.perplexity.ai/.well-known/security.txt and https://space.docs.perplexity.ai/.well-known/security.txt both returned Contact security@perplexity.ai, Expires 2027-12-31T00:00:00Z and Policy https://www.perplexity.ai/security on 16 October 2026. The robots.txt of www.perplexity.ai allows that path.", "WebFetch refused the docs site as outside its allowed set, so the guide index, API index, openapi.json, build.json files and security.txt were read with curl. space.docs.perplexity.ai has no robots.txt (404). WebFetch refused github.com under its robots.txt, so stars, issues and CI results were not read." ], "score": 66 }, "requirements": { "setupChecked": true, "complianceChecked": true, "card": "no", "freeTier": true, "minutes": 120, "credential": "mixed", "hosting": [ "self-hosted" ], "euResidency": "unknown", "trainsOnData": "no", "zeroRetention": "unknown", "selfHost": "yes" }, "pageJsonUrl": "https://www.anchorterminal.com/tools/perplexity-space.json", "live": { "slug": "perplexity-space", "githubStars": 2070, "securityTxt": { "url": "https://perplexity.ai/.well-known/security.txt", "state": "valid", "expires": "2027-12-31T00:00:00Z", "checkedAt": "2026-11-07T16:01:03.917430365Z" }, "domain": { "domain": "perplexity.ai", "registered": "2022-07-08", "source": "https://rdap.identitydigital.services/rdap/domain/perplexity.ai", "checkedAt": "2026-11-01T14:21:45.858640947Z" }, "github": { "repo": "perplexityai/space", "checkedAt": "2026-11-02T09:15:48.047668055Z", "stars": 2040, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T09:00:40Z", "openIssues": 15, "openPRs": 157, "issuesOpened90d": 25, "issuesClosed90d": 10, "prsMerged90d": 786, "ci": { "branch": "main", "runs": 50, "success": 45, "failure": 5, "other": 0, "latest": "success", "latestAt": "2026-11-02T07:12:51Z" }, "replies": { "sampled": 23, "unanswered": 3, "medianDays": 3.7 } }, "updatedAt": "2026-11-07T16:01:03.917430365Z" } }, "edges": [ { "by": 70, "category": "maintenance", "leads": "celesto", "name": "Maintenance \u0026 community", "reasons": { "a": "0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.", "b": "No release has ever been published. Version 0.8.0 has been in Cargo.toml and on the docs site since 5 October 2026, and Cargo.toml moved to 0.8.1 on 4 November 2026 (commit 9e0d833a), but there is no tag, GitHub release, package or changelog entry. Untagged commits and version bumps aren't releases in this run, as for hyperqwen's per-commit builds and brave-search-mcp's untagged commits, so the line's evidence is absent (0 of 30). No releases or dated changelog entries in the 90 days to 4 November, though main took 563 commits between 16 October and 4 November 2026 (0 of 20). Issues and pull requests weren't readable to us. 21 authors appear in the history, and CONTRIBUTING.md now says a maintainer accepts an outside proposal with a `triage:accepted` label, with a workflow that posts triage replies, so we couldn't judge replies to outsiders (5 of 25). No official SDK for the native API and no MCP server (0 of 15). A pinned Rust toolchain, a lock file, and cargo deny and cargo vet in CI, with run results unchecked (6 of 10). 0+0+5+0+6 = 11." }, "scores": { "a": 81, "b": 11 } }, { "by": 34, "category": "reliability", "leads": "celesto", "name": "Reliability", "reasons": { "a": "Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.", "b": "Read with the local-software lines, because an operator runs SPACE on their own hosts, as for microsoft-execution-containers. A person must deploy it before any agent can call it. No package, crate or public container image. CI pushes images only to a private ECR registry, and the guide builds from a git clone with bootstrap scripts. Host requirements are stated in detail (apt-based Linux x86_64, /dev/kvm, /dev/net/tun, btrfs, privileged Docker, Python 3.8 or later) (10 of 20). Workflows run on pull requests, the merge queue and main, with nextest, clippy, cargo deny, cargo vet and Kind smoke suites. Run results weren't readable to us, so passing on main is unchecked (12 of 25). Issues weren't readable either, because GitHub's robots.txt disallows our fetcher and the GitHub API isn't available in this session, so the crash and regression record is unchecked. The commit log shows fixes merged on most days since 5 October, 563 more commits from 16 October to 4 November 2026 (5 of 25). docs/versioning.md sets semver rules before and after 1.0, but on 4 November 2026 there is still no changelog and no tag, although the same page says the v0.8.0 tag should mark the tested commit (5 of 15). Version 0.8.0, a public baseline ahead of the last planned breaking release, 0.9.0 (0 of 15). 10+12+5+5+0 = 32." }, "scores": { "a": 66, "b": 32 } }, { "by": 12, "category": "security", "leads": "perplexity-space", "name": "Security \u0026 auth", "reasons": { "a": "Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.", "b": "Graded as the API an agent calls on a deployment. Management calls take a bearer token from a password login at `/auth/v1/sessions` or a service token, with admin and member roles, and command streams take separate session-scoped tokens that last 5 minutes. ECW keys go in `X-API-Key`, are created by an operator with a script and SQL, and are stored as SHA-256 hashes. We found no key scopes or documented revocation (20 of 30). Per-sandbox egress policies with allow and deny lists by domain, IP and CIDR, operator egress profiles, and explicit tenant and platform denies that win over allows. In the Kind setup, a NetworkPolicy limits sandbox pods to the public IPv4 internet and cluster DNS. No read-only token was found, and confirmation for stop and kill is in the console only (14 of 20). Command output is untrusted content. Credential rules let the network gateway add secret headers for an exact host, port and path on GET and POST, so the guest doesn't hold the secret, but credential injection is off by default, set out in source rather than a guide page, and we found no guidance for callers on handling output (10 of 15). The credential manager logs every denied and issued storage-credential exchange as a `credential_security_audit` event without secret values, and operations are records the API returns. No per-call audit log for the public API was found (8 of 15). SECURITY.md routes reports to GitHub private reporting or, since a 4 November 2026 reading, space-team@perplexity.ai, with no acknowledgement time. security.txt on www.perplexity.ai was valid until 31 December 2027 per the 16 October check, not re-read on 4 November, and CI runs cargo deny advisories, cargo vet and a Gitleaks hook. Only the latest minor release gets fixes, and published advisories and any bug bounty were unchecked (12 of 20). 20+14+10+8+12 = 64." }, "scores": { "a": 52, "b": 64 } }, { "by": 10, "category": "schema", "leads": "celesto", "name": "Schema \u0026 documentation", "reasons": { "a": "Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.", "b": "Read as an HTTP API. OpenAPI 3.1 for 14 supported operations, served at `/openapi-m1.json` by each deployment and published as openapi.json on the docs site. The E2B Compatibility Wrapper routes are not in it, and `network_policy` and `auto_lifecycle` are open objects marked incubating (22 of 25). No llms.txt (404 on 16 October 2026; the docs site was not re-read on 4 November). The guide is HTML built from Markdown files in the repository (5 of 10). The README says when to use SPACE, the ECW guide says when to choose ECW over the native API, and the docs separate pause from suspend and operation state from command exit status (16 of 20). Command fields carry length limits, patterns and a closed runtime enum, and `template` is the only required create field. The policy and lifecycle objects are free-form (12 of 15). 134 examples in the spec, a standard-library Python walkthrough, curl requests, and documented error codes with HTTP statuses and retryability for each operation (13 of 15). Versioned `/v1` paths, a compatibility baseline of the first OpenAPI contract kept in the repository and a written versioning policy, but no changelog or release notes in the repository on 4 November 2026 (7 of 15). 22+5+16+12+13+7 = 75." }, "scores": { "a": 85, "b": 75 } } ], "facts": [ { "a": "SDK + MCP", "b": "HTTP API", "name": "Kind" }, { "a": "Celesto AI, Inc.", "b": "Perplexity", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "HTTP", "name": "Transports" }, { "a": "None", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "2026-11-05", "b": "none", "name": "Last release" }, { "a": "2026-10-30", "b": "no document linked", "name": "Terms last updated" }, { "a": "2026-10-30", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not read yet", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not read yet", "name": "Arbitration or class-action waiver" }, { "a": "1.1k stars, 699 PyPI/wk", "b": "none", "name": "Popularity" }, { "a": "none", "b": "3/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Celesto (formerly SmolVM) scores 68 (B) on agent readiness against SPACE's 55.1 (C), and leads in 4 of 7 scored categories. SPACE leads on security \u0026 auth.", "question": "Which is better for AI agents, Celesto (formerly SmolVM) or SPACE?" }, { "answer": "No hosted endpoint is listed for Celesto (formerly SmolVM). No hosted endpoint is listed for SPACE.", "question": "Can an agent call Celesto (formerly SmolVM) and SPACE without installing anything?" }, { "answer": "Yes. Celesto (formerly SmolVM) is open source (Apache-2.0). SPACE is open source (Apache-2.0).", "question": "Are Celesto (formerly SmolVM) and SPACE open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 66 against 32", "Schema \u0026 documentation, 85 against 75", "Maintenance \u0026 community, 81 against 11" ], "also": [ "No key needed to call it" ], "goodFor": "Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.", "slug": "celesto", "watchFor": "Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball" }, { "aheadOn": [ "Security \u0026 auth, 64 against 52" ], "also": null, "goodFor": "Teams that want E2B-style microVM sandboxes on their own Linux and Kubernetes hosts, with egress and credential control outside the guest.", "slug": "perplexity-space", "watchFor": "A person must deploy it first, on an apt-based Linux x86_64 host with KVM, privileged Docker and Kubernetes (Kind in the guide)" } ], "history": { "celesto": null, "perplexity-space": [ { "causes": [ "correction" ], "date": "2026-11-04", "delta": -1.3, "from": 56.4, "fromGrade": "C", "to": 55.1, "toGrade": "C" }, { "causes": [ "evidence" ], "date": "2026-10-27", "delta": 0.2, "from": 56.2, "fromGrade": "C", "to": 56.4, "toGrade": "C" } ] }, "job": { "capability": "sandbox.code", "name": "Code sandboxes" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.json", "title": "Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-perplexity-space.json", "title": "Amazon Bedrock AgentCore Code Interpreter vs SPACE", "url": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.json", "title": "Blaxel Sandboxes vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-perplexity-space.json", "title": "Blaxel Sandboxes vs SPACE", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.json", "title": "Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK", "url": "https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-daytona.json", "title": "Celesto (formerly SmolVM) vs Daytona", "url": "https://www.anchorterminal.com/compare/celesto-vs-daytona" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.json", "title": "Celesto (formerly SmolVM) vs DeltaBox Lite", "url": "https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.json", "title": "Celesto (formerly SmolVM) vs Deno Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-e2b.json", "title": "Celesto (formerly SmolVM) vs E2B", "url": "https://www.anchorterminal.com/compare/celesto-vs-e2b" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-freestyle.json", "title": "Celesto (formerly SmolVM) vs Freestyle", "url": "https://www.anchorterminal.com/compare/celesto-vs-freestyle" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-instavm.json", "title": "Celesto (formerly SmolVM) vs InstaVM", "url": "https://www.anchorterminal.com/compare/celesto-vs-instavm" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-maritime.json", "title": "Celesto (formerly SmolVM) vs Maritime", "url": "https://www.anchorterminal.com/compare/celesto-vs-maritime" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.json", "title": "Celesto (formerly SmolVM) vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.json", "title": "Celesto (formerly SmolVM) vs Modal Sandboxes", "url": "https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.json", "title": "Celesto (formerly SmolVM) vs Morph Cloud", "url": "https://www.anchorterminal.com/compare/celesto-vs-morph-cloud" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-offscreen.json", "title": "Celesto (formerly SmolVM) vs Offscreen", "url": "https://www.anchorterminal.com/compare/celesto-vs-offscreen" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-runloop.json", "title": "Celesto (formerly SmolVM) vs Runloop Devboxes", "url": "https://www.anchorterminal.com/compare/celesto-vs-runloop" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-sandbox0.json", "title": "Celesto (formerly SmolVM) vs Sandbox0", "url": "https://www.anchorterminal.com/compare/celesto-vs-sandbox0" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-sprites.json", "title": "Celesto (formerly SmolVM) vs Sprites", "url": "https://www.anchorterminal.com/compare/celesto-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.json", "title": "Celesto (formerly SmolVM) vs Together Code Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.json", "title": "Celesto (formerly SmolVM) vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-perplexity-space.json", "title": "Cloudflare Sandbox SDK vs SPACE", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-perplexity-space.json", "title": "Daytona vs SPACE", "url": "https://www.anchorterminal.com/compare/daytona-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/deno-sandbox-vs-perplexity-space.json", "title": "Deno Sandbox vs SPACE", "url": "https://www.anchorterminal.com/compare/deno-sandbox-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/e2b-vs-perplexity-space.json", "title": "E2B vs SPACE", "url": "https://www.anchorterminal.com/compare/e2b-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/freestyle-vs-perplexity-space.json", "title": "Freestyle vs SPACE", "url": "https://www.anchorterminal.com/compare/freestyle-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/instavm-vs-perplexity-space.json", "title": "InstaVM vs SPACE", "url": "https://www.anchorterminal.com/compare/instavm-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/maritime-vs-perplexity-space.json", "title": "Maritime vs SPACE", "url": "https://www.anchorterminal.com/compare/maritime-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-perplexity-space.json", "title": "Microsoft Execution Containers vs SPACE", "url": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/modal-sandboxes-vs-perplexity-space.json", "title": "Modal Sandboxes vs SPACE", "url": "https://www.anchorterminal.com/compare/modal-sandboxes-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/morph-cloud-vs-perplexity-space.json", "title": "Morph Cloud vs SPACE", "url": "https://www.anchorterminal.com/compare/morph-cloud-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/offscreen-vs-perplexity-space.json", "title": "Offscreen vs SPACE", "url": "https://www.anchorterminal.com/compare/offscreen-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/perplexity-space-vs-runloop.json", "title": "SPACE vs Runloop Devboxes", "url": "https://www.anchorterminal.com/compare/perplexity-space-vs-runloop" }, { "json": "https://www.anchorterminal.com/compare/perplexity-space-vs-sandbox0.json", "title": "SPACE vs Sandbox0", "url": "https://www.anchorterminal.com/compare/perplexity-space-vs-sandbox0" }, { "json": "https://www.anchorterminal.com/compare/perplexity-space-vs-sprites.json", "title": "SPACE vs Sprites", "url": "https://www.anchorterminal.com/compare/perplexity-space-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/perplexity-space-vs-together-code-sandbox.json", "title": "SPACE vs Together Code Sandbox", "url": "https://www.anchorterminal.com/compare/perplexity-space-vs-together-code-sandbox" }, { "json": "https://www.anchorterminal.com/compare/perplexity-space-vs-vercel-sandbox.json", "title": "SPACE vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/perplexity-space-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/agent37-vs-celesto.json", "title": "Agent 37 Cloud vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/agent37-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/agent37-vs-perplexity-space.json", "title": "Agent 37 Cloud vs SPACE", "url": "https://www.anchorterminal.com/compare/agent37-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/deltabox-lite-vs-perplexity-space.json", "title": "DeltaBox Lite vs SPACE", "url": "https://www.anchorterminal.com/compare/deltabox-lite-vs-perplexity-space" } ], "panel": null, "scores": [ { "by": 34, "celesto": 66, "edge": "celesto", "key": "reliability", "name": "Reliability", "perplexity-space": 32, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 10, "celesto": 85, "edge": "celesto", "key": "schema", "name": "Schema \u0026 documentation", "perplexity-space": 75, "weight": 13 }, { "by": 3, "celesto": 69, "edge": "celesto", "key": "ergonomics", "name": "Agent ergonomics", "perplexity-space": 66, "weight": 13 }, { "by": 12, "celesto": 52, "edge": "perplexity-space", "key": "security", "name": "Security \u0026 auth", "perplexity-space": 64, "weight": 14 }, { "by": 0, "celesto": 60, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "perplexity-space": 60, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 70, "celesto": 81, "edge": "celesto", "key": "maintenance", "name": "Maintenance \u0026 community", "perplexity-space": 11, "weight": 7 }, { "by": 0, "celesto": 70, "edge": "", "key": "transparency", "name": "Transparency \u0026 trust", "perplexity-space": 70, "weight": 7 } ], "summary": "Celesto (formerly SmolVM) scores 68 (B) on agent readiness against SPACE's 55.1 (C), and leads in 4 of 7 scored categories. SPACE leads on security \u0026 auth. Both do code sandboxes.", "tasks": null, "tutorials": [], "verdicts": { "celesto": "Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.", "perplexity-space": "Once deployed, SPACE's native API has a public OpenAPI 3.1 contract, stable error codes with a retryable flag and 24-hour idempotency keys, and egress and credential controls sit outside the VM. A person must first deploy it on a Linux x86_64 host with KVM and Kubernetes. Version 0.8.0 has no tagged release, changelog or public container images." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/celesto-vs-perplexity-space", "json": "https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.min.md" }, "markdown": "Celesto (formerly SmolVM) scores 68 (B) on agent readiness against SPACE's 55.1 (C), and leads in 4 of 7 scored categories. SPACE leads on security \u0026 auth. Both do code sandboxes.\n\n- Celesto (formerly SmolVM): grade B, 68/100, rank #299 of 1510. Markdown https://www.anchorterminal.com/tools/celesto.md · JSON https://www.anchorterminal.com/api/v1/tools/celesto.json\n- SPACE: grade C, 55.1/100, rank #881 of 1510. Markdown https://www.anchorterminal.com/tools/perplexity-space.md · JSON https://www.anchorterminal.com/api/v1/tools/perplexity-space.json\n- Best code execution sandboxes for AI agents: https://www.anchorterminal.com/best/code-sandboxes/index.md\n- All 231 sandboxes comparisons: https://www.anchorterminal.com/compare/code-sandboxes/index.md\n\n## Which one, for what\n\n### Celesto (formerly SmolVM) (B)\n\nGood for: Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.\n\nAhead on:\n- Reliability, 66 against 32\n- Schema \u0026 documentation, 85 against 75\n- Maintenance \u0026 community, 81 against 11\n\nAlso in its favour:\n- No key needed to call it\n\nWatch for: Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball\n\n### SPACE (C)\n\nGood for: Teams that want E2B-style microVM sandboxes on their own Linux and Kubernetes hosts, with egress and credential control outside the guest.\n\nAhead on:\n- Security \u0026 auth, 64 against 52\n\nWatch for: A person must deploy it first, on an apt-based Linux x86_64 host with KVM, privileged Docker and Kubernetes (Kind in the guide)\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Celesto (formerly SmolVM) +70\n\n- Celesto (formerly SmolVM) (81): 0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.\n- SPACE (11): No release has ever been published. Version 0.8.0 has been in Cargo.toml and on the docs site since 5 October 2026, and Cargo.toml moved to 0.8.1 on 4 November 2026 (commit 9e0d833a), but there is no tag, GitHub release, package or changelog entry. Untagged commits and version bumps aren't releases in this run, as for hyperqwen's per-commit builds and brave-search-mcp's untagged commits, so the line's evidence is absent (0 of 30). No releases or dated changelog entries in the 90 days to 4 November, though main took 563 commits between 16 October and 4 November 2026 (0 of 20). Issues and pull requests weren't readable to us. 21 authors appear in the history, and CONTRIBUTING.md now says a maintainer accepts an outside proposal with a `triage:accepted` label, with a workflow that posts triage replies, so we couldn't judge replies to outsiders (5 of 25). No official SDK for the native API and no MCP server (0 of 15). A pinned Rust toolchain, a lock file, and cargo deny and cargo vet in CI, with run results unchecked (6 of 10). 0+0+5+0+6 = 11.\n\n### Reliability: Celesto (formerly SmolVM) +34\n\n- Celesto (formerly SmolVM) (66): Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.\n- SPACE (32): Read with the local-software lines, because an operator runs SPACE on their own hosts, as for microsoft-execution-containers. A person must deploy it before any agent can call it. No package, crate or public container image. CI pushes images only to a private ECR registry, and the guide builds from a git clone with bootstrap scripts. Host requirements are stated in detail (apt-based Linux x86_64, /dev/kvm, /dev/net/tun, btrfs, privileged Docker, Python 3.8 or later) (10 of 20). Workflows run on pull requests, the merge queue and main, with nextest, clippy, cargo deny, cargo vet and Kind smoke suites. Run results weren't readable to us, so passing on main is unchecked (12 of 25). Issues weren't readable either, because GitHub's robots.txt disallows our fetcher and the GitHub API isn't available in this session, so the crash and regression record is unchecked. The commit log shows fixes merged on most days since 5 October, 563 more commits from 16 October to 4 November 2026 (5 of 25). docs/versioning.md sets semver rules before and after 1.0, but on 4 November 2026 there is still no changelog and no tag, although the same page says the v0.8.0 tag should mark the tested commit (5 of 15). Version 0.8.0, a public baseline ahead of the last planned breaking release, 0.9.0 (0 of 15). 10+12+5+5+0 = 32.\n\n### Security \u0026 auth: SPACE +12\n\n- Celesto (formerly SmolVM) (52): Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.\n- SPACE (64): Graded as the API an agent calls on a deployment. Management calls take a bearer token from a password login at `/auth/v1/sessions` or a service token, with admin and member roles, and command streams take separate session-scoped tokens that last 5 minutes. ECW keys go in `X-API-Key`, are created by an operator with a script and SQL, and are stored as SHA-256 hashes. We found no key scopes or documented revocation (20 of 30). Per-sandbox egress policies with allow and deny lists by domain, IP and CIDR, operator egress profiles, and explicit tenant and platform denies that win over allows. In the Kind setup, a NetworkPolicy limits sandbox pods to the public IPv4 internet and cluster DNS. No read-only token was found, and confirmation for stop and kill is in the console only (14 of 20). Command output is untrusted content. Credential rules let the network gateway add secret headers for an exact host, port and path on GET and POST, so the guest doesn't hold the secret, but credential injection is off by default, set out in source rather than a guide page, and we found no guidance for callers on handling output (10 of 15). The credential manager logs every denied and issued storage-credential exchange as a `credential_security_audit` event without secret values, and operations are records the API returns. No per-call audit log for the public API was found (8 of 15). SECURITY.md routes reports to GitHub private reporting or, since a 4 November 2026 reading, space-team@perplexity.ai, with no acknowledgement time. security.txt on www.perplexity.ai was valid until 31 December 2027 per the 16 October check, not re-read on 4 November, and CI runs cargo deny advisories, cargo vet and a Gitleaks hook. Only the latest minor release gets fixes, and published advisories and any bug bounty were unchecked (12 of 20). 20+14+10+8+12 = 64.\n\n### Schema \u0026 documentation: Celesto (formerly SmolVM) +10\n\n- Celesto (formerly SmolVM) (85): Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.\n- SPACE (75): Read as an HTTP API. OpenAPI 3.1 for 14 supported operations, served at `/openapi-m1.json` by each deployment and published as openapi.json on the docs site. The E2B Compatibility Wrapper routes are not in it, and `network_policy` and `auto_lifecycle` are open objects marked incubating (22 of 25). No llms.txt (404 on 16 October 2026; the docs site was not re-read on 4 November). The guide is HTML built from Markdown files in the repository (5 of 10). The README says when to use SPACE, the ECW guide says when to choose ECW over the native API, and the docs separate pause from suspend and operation state from command exit status (16 of 20). Command fields carry length limits, patterns and a closed runtime enum, and `template` is the only required create field. The policy and lifecycle objects are free-form (12 of 15). 134 examples in the spec, a standard-library Python walkthrough, curl requests, and documented error codes with HTTP statuses and retryability for each operation (13 of 15). Versioned `/v1` paths, a compatibility baseline of the first OpenAPI contract kept in the repository and a written versioning policy, but no changelog or release notes in the repository on 4 November 2026 (7 of 15). 22+5+16+12+13+7 = 75.\n\n## Score by category\n\n| Category | Weight | Celesto (formerly SmolVM) | SPACE | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 66 | 32 | Celesto (formerly SmolVM) +34 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 85 | 75 | Celesto (formerly SmolVM) +10 |\n| Agent ergonomics | 13% (16.2 this run) | 69 | 66 | Celesto (formerly SmolVM) +3 |\n| Security \u0026 auth | 14% (17.5 this run) | 52 | 64 | SPACE +12 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 60 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 81 | 11 | Celesto (formerly SmolVM) +70 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 70 | 70 | even |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **68 · B** | **55.1 · C** | |\n\n## Facts side by side\n\n| Fact | Celesto (formerly SmolVM) | SPACE |\n| --- | --- | --- |\n| Kind | SDK + MCP | HTTP API |\n| Vendor | Celesto AI, Inc. | Perplexity |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | HTTP |\n| Auth | None | OAuth or key |\n| Pricing | Freemium | Free |\n| x402 | no | no |\n| Licence | Apache-2.0 | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | no |\n| Last release | 2026-11-05 | none |\n| Terms last updated | 2026-10-30 | no document linked |\n| Privacy policy last updated | 2026-10-30 | no document linked |\n| Customer content may train models | not found in the text | not read yet |\n| Terms restrict automated access | not found in the text | not read yet |\n| Terms restrict benchmarking | not found in the text | not read yet |\n| Terms or service can change without notice | not found in the text | not read yet |\n| Arbitration or class-action waiver | not found in the text | not read yet |\n| Popularity | 1.1k stars, 699 PyPI/wk | none |\n| Agent reviews | none | 3/5 (4) |\n\n## How the scores have moved\n\n### Celesto (formerly SmolVM)\n\nNo score change since it was listed.\n\n### SPACE\n\n- -1.3 on 4 November 2026: correction\n- +0.2 on 27 October 2026: new evidence\n\n## Verdicts\n\n**Celesto (formerly SmolVM).** Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.\n\n**SPACE.** Once deployed, SPACE's native API has a public OpenAPI 3.1 contract, stable error codes with a retryable flag and 24-hour idempotency keys, and egress and credential controls sit outside the VM. A person must first deploy it on a Linux x86_64 host with KVM and Kubernetes. Version 0.8.0 has no tagged release, changelog or public container images.\n\n## Before you call either\n\n### Celesto (formerly SmolVM)\n\n1. Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text\n2. Create computers with unique names and delete them by exact name when the job ends, including after failures\n3. Set `internet_settings={\"mode\": \"off\"}` or `restricted` for untrusted code, since the default is open\n4. Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine\n5. Never paste browser or display connection URLs into model context; possession of the URL grants control\n\n### SPACE\n\n1. Ask your operator for the API base URL (before `/v1`, or `/api/v1` on shared hosts), the data-plane URL and a bearer token before planning any call\n2. Poll the returned operation until it succeeds and the sandbox is `running` before creating a command. A 202 response is not readiness\n3. Attach to the command's events URL with its session token to start the process, decode base64 output, and treat only `process_exited` as completion\n4. Send an `Idempotency-Key` on creates, lifecycle calls and commands, and retry only when `retryable` is true, after any `Retry-After`\n5. Save output as it arrives. Reconnecting with `Last-Event-ID` returns `resync_required`, not the missed output\n\n## Questions\n\n### Which is better for AI agents, Celesto (formerly SmolVM) or SPACE?\n\nCelesto (formerly SmolVM) scores 68 (B) on agent readiness against SPACE's 55.1 (C), and leads in 4 of 7 scored categories. SPACE leads on security \u0026 auth.\n\n### Can an agent call Celesto (formerly SmolVM) and SPACE without installing anything?\n\nNo hosted endpoint is listed for Celesto (formerly SmolVM). No hosted endpoint is listed for SPACE.\n\n### Are Celesto (formerly SmolVM) and SPACE open source?\n\nYes. Celesto (formerly SmolVM) is open source (Apache-2.0). SPACE is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.json, and with the fewest tokens: https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"celesto\", \"b\": \"perplexity-space\"}`. From a terminal: `anchor compare celesto perplexity-space`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/celesto.json and https://www.anchorterminal.com/api/v1/tools/perplexity-space.json\n\n## Other comparisons with Celesto (formerly SmolVM) or SPACE\n\n- [Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.md)\n- [Amazon Bedrock AgentCore Code Interpreter vs SPACE](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-perplexity-space.md)\n- [Blaxel Sandboxes vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.md)\n- [Blaxel Sandboxes vs SPACE](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-perplexity-space.md)\n- [Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.md)\n- [Celesto (formerly SmolVM) vs Daytona](https://www.anchorterminal.com/compare/celesto-vs-daytona.md)\n- [Celesto (formerly SmolVM) vs DeltaBox Lite](https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.md)\n- [Celesto (formerly SmolVM) vs Deno Sandbox](https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.md)\n- [Celesto (formerly SmolVM) vs E2B](https://www.anchorterminal.com/compare/celesto-vs-e2b.md)\n- [Celesto (formerly SmolVM) vs Freestyle](https://www.anchorterminal.com/compare/celesto-vs-freestyle.md)\n- [Celesto (formerly SmolVM) vs InstaVM](https://www.anchorterminal.com/compare/celesto-vs-instavm.md)\n- [Celesto (formerly SmolVM) vs Maritime](https://www.anchorterminal.com/compare/celesto-vs-maritime.md)\n- [Celesto (formerly SmolVM) vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.md)\n- [Celesto (formerly SmolVM) vs Modal Sandboxes](https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.md)\n- [Celesto (formerly SmolVM) vs Morph Cloud](https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.md)\n- [Celesto (formerly SmolVM) vs Offscreen](https://www.anchorterminal.com/compare/celesto-vs-offscreen.md)\n- [Celesto (formerly SmolVM) vs Runloop Devboxes](https://www.anchorterminal.com/compare/celesto-vs-runloop.md)\n- [Celesto (formerly SmolVM) vs Sandbox0](https://www.anchorterminal.com/compare/celesto-vs-sandbox0.md)\n- [Celesto (formerly SmolVM) vs Sprites](https://www.anchorterminal.com/compare/celesto-vs-sprites.md)\n- [Celesto (formerly SmolVM) vs Together Code Sandbox](https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.md)\n- [Celesto (formerly SmolVM) vs Vercel Sandbox](https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.md)\n- [Cloudflare Sandbox SDK vs SPACE](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-perplexity-space.md)\n- [Daytona vs SPACE](https://www.anchorterminal.com/compare/daytona-vs-perplexity-space.md)\n- [Deno Sandbox vs SPACE](https://www.anchorterminal.com/compare/deno-sandbox-vs-perplexity-space.md)\n- [E2B vs SPACE](https://www.anchorterminal.com/compare/e2b-vs-perplexity-space.md)\n- [Freestyle vs SPACE](https://www.anchorterminal.com/compare/freestyle-vs-perplexity-space.md)\n- [InstaVM vs SPACE](https://www.anchorterminal.com/compare/instavm-vs-perplexity-space.md)\n- [Maritime vs SPACE](https://www.anchorterminal.com/compare/maritime-vs-perplexity-space.md)\n- [Microsoft Execution Containers vs SPACE](https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-perplexity-space.md)\n- [Modal Sandboxes vs SPACE](https://www.anchorterminal.com/compare/modal-sandboxes-vs-perplexity-space.md)\n- [Morph Cloud vs SPACE](https://www.anchorterminal.com/compare/morph-cloud-vs-perplexity-space.md)\n- [Offscreen vs SPACE](https://www.anchorterminal.com/compare/offscreen-vs-perplexity-space.md)\n- [SPACE vs Runloop Devboxes](https://www.anchorterminal.com/compare/perplexity-space-vs-runloop.md)\n- [SPACE vs Sandbox0](https://www.anchorterminal.com/compare/perplexity-space-vs-sandbox0.md)\n- [SPACE vs Sprites](https://www.anchorterminal.com/compare/perplexity-space-vs-sprites.md)\n- [SPACE vs Together Code Sandbox](https://www.anchorterminal.com/compare/perplexity-space-vs-together-code-sandbox.md)\n- [SPACE vs Vercel Sandbox](https://www.anchorterminal.com/compare/perplexity-space-vs-vercel-sandbox.md)\n- [Agent 37 Cloud vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agent37-vs-celesto.md)\n- [Agent 37 Cloud vs SPACE](https://www.anchorterminal.com/compare/agent37-vs-perplexity-space.md)\n- [DeltaBox Lite vs SPACE](https://www.anchorterminal.com/compare/deltabox-lite-vs-perplexity-space.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Celesto (formerly SmolVM) vs SPACE", "url": "" } ], "description": "Celesto scores 68 (B) to SPACE's 55.1 (C) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Celesto (formerly SmolVM) B 68", "SPACE C 55.1", "scores" ], "h1": "Celesto (formerly SmolVM) vs SPACE", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/celesto-vs-perplexity-space", "published": "2026-10-01", "section": "tools", "title": "Celesto vs SPACE for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/celesto-vs-perplexity-space" }, "tokens": { "markdown": 5250, "slim": 2880 }, "version": 1 }