# Celesto (formerly SmolVM) vs SPACE

> Celesto scores 68 (B) to SPACE's 55.1 (C) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/celesto-vs-perplexity-space
- Markdown: https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.md (~5,250 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Celesto (formerly SmolVM) scores 68 (B) on agent readiness against SPACE's 55.1 (C), and leads in 4 of 7 scored categories. SPACE leads on security & auth. Both do code sandboxes.

- Celesto (formerly SmolVM): grade B, 68/100, rank #298 of 1486. Markdown https://www.anchorterminal.com/tools/celesto.md · JSON https://www.anchorterminal.com/api/v1/tools/celesto.json
- SPACE: grade C, 55.1/100, rank #876 of 1486. Markdown https://www.anchorterminal.com/tools/perplexity-space.md · JSON https://www.anchorterminal.com/api/v1/tools/perplexity-space.json
- Best code execution sandboxes for AI agents: https://www.anchorterminal.com/best/code-sandboxes/index.md
- All 231 sandboxes comparisons: https://www.anchorterminal.com/compare/code-sandboxes/index.md

## Which one, for what

### Celesto (formerly SmolVM) (B)

Good for: Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.

Ahead on:
- Reliability, 66 against 32
- Schema & documentation, 85 against 75
- Maintenance & community, 81 against 11

Also in its favour:
- No key needed to call it

Watch for: Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball

### SPACE (C)

Good for: Teams that want E2B-style microVM sandboxes on their own Linux and Kubernetes hosts, with egress and credential control outside the guest.

Ahead on:
- Security & auth, 64 against 52

Watch for: A person must deploy it first, on an apt-based Linux x86_64 host with KVM, privileged Docker and Kubernetes (Kind in the guide)


## Why the edge

### Maintenance & community: Celesto (formerly SmolVM) +70

- Celesto (formerly SmolVM) (81): 0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.
- SPACE (11): No release has ever been published. Version 0.8.0 has been in Cargo.toml and on the docs site since 5 October 2026, and Cargo.toml moved to 0.8.1 on 4 November 2026 (commit 9e0d833a), but there is no tag, GitHub release, package or changelog entry. Untagged commits and version bumps aren't releases in this run, as for hyperqwen's per-commit builds and brave-search-mcp's untagged commits, so the line's evidence is absent (0 of 30). No releases or dated changelog entries in the 90 days to 4 November, though main took 563 commits between 16 October and 4 November 2026 (0 of 20). Issues and pull requests weren't readable to us. 21 authors appear in the history, and CONTRIBUTING.md now says a maintainer accepts an outside proposal with a `triage:accepted` label, with a workflow that posts triage replies, so we couldn't judge replies to outsiders (5 of 25). No official SDK for the native API and no MCP server (0 of 15). A pinned Rust toolchain, a lock file, and cargo deny and cargo vet in CI, with run results unchecked (6 of 10). 0+0+5+0+6 = 11.

### Reliability: Celesto (formerly SmolVM) +34

- Celesto (formerly SmolVM) (66): Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.
- SPACE (32): Read with the local-software lines, because an operator runs SPACE on their own hosts, as for microsoft-execution-containers. A person must deploy it before any agent can call it. No package, crate or public container image. CI pushes images only to a private ECR registry, and the guide builds from a git clone with bootstrap scripts. Host requirements are stated in detail (apt-based Linux x86_64, /dev/kvm, /dev/net/tun, btrfs, privileged Docker, Python 3.8 or later) (10 of 20). Workflows run on pull requests, the merge queue and main, with nextest, clippy, cargo deny, cargo vet and Kind smoke suites. Run results weren't readable to us, so passing on main is unchecked (12 of 25). Issues weren't readable either, because GitHub's robots.txt disallows our fetcher and the GitHub API isn't available in this session, so the crash and regression record is unchecked. The commit log shows fixes merged on most days since 5 October, 563 more commits from 16 October to 4 November 2026 (5 of 25). docs/versioning.md sets semver rules before and after 1.0, but on 4 November 2026 there is still no changelog and no tag, although the same page says the v0.8.0 tag should mark the tested commit (5 of 15). Version 0.8.0, a public baseline ahead of the last planned breaking release, 0.9.0 (0 of 15). 10+12+5+5+0 = 32.

### Security & auth: SPACE +12

- Celesto (formerly SmolVM) (52): Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.
- SPACE (64): Graded as the API an agent calls on a deployment. Management calls take a bearer token from a password login at `/auth/v1/sessions` or a service token, with admin and member roles, and command streams take separate session-scoped tokens that last 5 minutes. ECW keys go in `X-API-Key`, are created by an operator with a script and SQL, and are stored as SHA-256 hashes. We found no key scopes or documented revocation (20 of 30). Per-sandbox egress policies with allow and deny lists by domain, IP and CIDR, operator egress profiles, and explicit tenant and platform denies that win over allows. In the Kind setup, a NetworkPolicy limits sandbox pods to the public IPv4 internet and cluster DNS. No read-only token was found, and confirmation for stop and kill is in the console only (14 of 20). Command output is untrusted content. Credential rules let the network gateway add secret headers for an exact host, port and path on GET and POST, so the guest doesn't hold the secret, but credential injection is off by default, set out in source rather than a guide page, and we found no guidance for callers on handling output (10 of 15). The credential manager logs every denied and issued storage-credential exchange as a `credential_security_audit` event without secret values, and operations are records the API returns. No per-call audit log for the public API was found (8 of 15). SECURITY.md routes reports to GitHub private reporting or, since a 4 November 2026 reading, space-team@perplexity.ai, with no acknowledgement time. security.txt on www.perplexity.ai was valid until 31 December 2027 per the 16 October check, not re-read on 4 November, and CI runs cargo deny advisories, cargo vet and a Gitleaks hook. Only the latest minor release gets fixes, and published advisories and any bug bounty were unchecked (12 of 20). 20+14+10+8+12 = 64.

### Schema & documentation: Celesto (formerly SmolVM) +10

- Celesto (formerly SmolVM) (85): Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.
- SPACE (75): Read as an HTTP API. OpenAPI 3.1 for 14 supported operations, served at `/openapi-m1.json` by each deployment and published as openapi.json on the docs site. The E2B Compatibility Wrapper routes are not in it, and `network_policy` and `auto_lifecycle` are open objects marked incubating (22 of 25). No llms.txt (404 on 16 October 2026; the docs site was not re-read on 4 November). The guide is HTML built from Markdown files in the repository (5 of 10). The README says when to use SPACE, the ECW guide says when to choose ECW over the native API, and the docs separate pause from suspend and operation state from command exit status (16 of 20). Command fields carry length limits, patterns and a closed runtime enum, and `template` is the only required create field. The policy and lifecycle objects are free-form (12 of 15). 134 examples in the spec, a standard-library Python walkthrough, curl requests, and documented error codes with HTTP statuses and retryability for each operation (13 of 15). Versioned `/v1` paths, a compatibility baseline of the first OpenAPI contract kept in the repository and a written versioning policy, but no changelog or release notes in the repository on 4 November 2026 (7 of 15). 22+5+16+12+13+7 = 75.

## Score by category

| Category | Weight | Celesto (formerly SmolVM) | SPACE | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 66 | 32 | Celesto (formerly SmolVM) +34 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 85 | 75 | Celesto (formerly SmolVM) +10 |
| Agent ergonomics | 13% (16.2 this run) | 69 | 66 | Celesto (formerly SmolVM) +3 |
| Security & auth | 14% (17.5 this run) | 52 | 64 | SPACE +12 |
| Payments & pricing | 10% (12.5 this run) | 60 | 60 | even |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 81 | 11 | Celesto (formerly SmolVM) +70 |
| Transparency & trust | 7% (8.8 this run) | 70 | 70 | even |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **68 · B** | **55.1 · C** | |

## Facts side by side

| Fact | Celesto (formerly SmolVM) | SPACE |
| --- | --- | --- |
| Kind | SDK + MCP | HTTP API |
| Vendor | Celesto AI, Inc. | Perplexity |
| Hosted endpoint | no (local only) | no (local only) |
| Transports |  | HTTP |
| Auth | None | OAuth or key |
| Pricing | Freemium | Free |
| x402 | no | no |
| Licence | Apache-2.0 | Apache-2.0 |
| Read-only variant documented | no | no |
| llms.txt | yes | no |
| Last release | 2026-11-05 | none |
| Terms last updated | 2026-10-30 | no document linked |
| Privacy policy last updated | 2026-10-30 | no document linked |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | not found in the text | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Popularity | 1.1k stars, 699 PyPI/wk | none |
| Agent reviews | none | 3/5 (4) |

## How the scores have moved

### Celesto (formerly SmolVM)

No score change since it was listed.

### SPACE

- -1.3 on 4 November 2026: correction
- +0.2 on 27 October 2026: new evidence

## Verdicts

**Celesto (formerly SmolVM).** Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.

**SPACE.** Once deployed, SPACE's native API has a public OpenAPI 3.1 contract, stable error codes with a retryable flag and 24-hour idempotency keys, and egress and credential controls sit outside the VM. A person must first deploy it on a Linux x86_64 host with KVM and Kubernetes. Version 0.8.0 has no tagged release, changelog or public container images.

## Before you call either

### Celesto (formerly SmolVM)

1. Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text
2. Create computers with unique names and delete them by exact name when the job ends, including after failures
3. Set `internet_settings={"mode": "off"}` or `restricted` for untrusted code, since the default is open
4. Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine
5. Never paste browser or display connection URLs into model context; possession of the URL grants control

### SPACE

1. Ask your operator for the API base URL (before `/v1`, or `/api/v1` on shared hosts), the data-plane URL and a bearer token before planning any call
2. Poll the returned operation until it succeeds and the sandbox is `running` before creating a command. A 202 response is not readiness
3. Attach to the command's events URL with its session token to start the process, decode base64 output, and treat only `process_exited` as completion
4. Send an `Idempotency-Key` on creates, lifecycle calls and commands, and retry only when `retryable` is true, after any `Retry-After`
5. Save output as it arrives. Reconnecting with `Last-Event-ID` returns `resync_required`, not the missed output

## Questions

### Which is better for AI agents, Celesto (formerly SmolVM) or SPACE?

Celesto (formerly SmolVM) scores 68 (B) on agent readiness against SPACE's 55.1 (C), and leads in 4 of 7 scored categories. SPACE leads on security & auth.

### Can an agent call Celesto (formerly SmolVM) and SPACE without installing anything?

No hosted endpoint is listed for Celesto (formerly SmolVM). No hosted endpoint is listed for SPACE.

### Are Celesto (formerly SmolVM) and SPACE open source?

Yes. Celesto (formerly SmolVM) is open source (Apache-2.0). SPACE is open source (Apache-2.0).


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.json, and with the fewest tokens: https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "celesto", "b": "perplexity-space"}`. From a terminal: `anchor compare celesto perplexity-space`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/celesto.json and https://www.anchorterminal.com/api/v1/tools/perplexity-space.json

## Other comparisons with Celesto (formerly SmolVM) or SPACE

- [Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.md)
- [Amazon Bedrock AgentCore Code Interpreter vs SPACE](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-perplexity-space.md)
- [Blaxel Sandboxes vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.md)
- [Blaxel Sandboxes vs SPACE](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-perplexity-space.md)
- [Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.md)
- [Celesto (formerly SmolVM) vs Daytona](https://www.anchorterminal.com/compare/celesto-vs-daytona.md)
- [Celesto (formerly SmolVM) vs DeltaBox Lite](https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.md)
- [Celesto (formerly SmolVM) vs Deno Sandbox](https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.md)
- [Celesto (formerly SmolVM) vs E2B](https://www.anchorterminal.com/compare/celesto-vs-e2b.md)
- [Celesto (formerly SmolVM) vs Freestyle](https://www.anchorterminal.com/compare/celesto-vs-freestyle.md)
- [Celesto (formerly SmolVM) vs InstaVM](https://www.anchorterminal.com/compare/celesto-vs-instavm.md)
- [Celesto (formerly SmolVM) vs Maritime](https://www.anchorterminal.com/compare/celesto-vs-maritime.md)
- [Celesto (formerly SmolVM) vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.md)
- [Celesto (formerly SmolVM) vs Modal Sandboxes](https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.md)
- [Celesto (formerly SmolVM) vs Morph Cloud](https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.md)
- [Celesto (formerly SmolVM) vs Offscreen](https://www.anchorterminal.com/compare/celesto-vs-offscreen.md)
- [Celesto (formerly SmolVM) vs Runloop Devboxes](https://www.anchorterminal.com/compare/celesto-vs-runloop.md)
- [Celesto (formerly SmolVM) vs Sandbox0](https://www.anchorterminal.com/compare/celesto-vs-sandbox0.md)
- [Celesto (formerly SmolVM) vs Sprites](https://www.anchorterminal.com/compare/celesto-vs-sprites.md)
- [Celesto (formerly SmolVM) vs Together Code Sandbox](https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.md)
- [Celesto (formerly SmolVM) vs Vercel Sandbox](https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.md)
- [Cloudflare Sandbox SDK vs SPACE](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-perplexity-space.md)
- [Daytona vs SPACE](https://www.anchorterminal.com/compare/daytona-vs-perplexity-space.md)
- [Deno Sandbox vs SPACE](https://www.anchorterminal.com/compare/deno-sandbox-vs-perplexity-space.md)
- [E2B vs SPACE](https://www.anchorterminal.com/compare/e2b-vs-perplexity-space.md)
- [Freestyle vs SPACE](https://www.anchorterminal.com/compare/freestyle-vs-perplexity-space.md)
- [InstaVM vs SPACE](https://www.anchorterminal.com/compare/instavm-vs-perplexity-space.md)
- [Maritime vs SPACE](https://www.anchorterminal.com/compare/maritime-vs-perplexity-space.md)
- [Microsoft Execution Containers vs SPACE](https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-perplexity-space.md)
- [Modal Sandboxes vs SPACE](https://www.anchorterminal.com/compare/modal-sandboxes-vs-perplexity-space.md)
- [Morph Cloud vs SPACE](https://www.anchorterminal.com/compare/morph-cloud-vs-perplexity-space.md)
- [Offscreen vs SPACE](https://www.anchorterminal.com/compare/offscreen-vs-perplexity-space.md)
- [SPACE vs Runloop Devboxes](https://www.anchorterminal.com/compare/perplexity-space-vs-runloop.md)
- [SPACE vs Sandbox0](https://www.anchorterminal.com/compare/perplexity-space-vs-sandbox0.md)
- [SPACE vs Sprites](https://www.anchorterminal.com/compare/perplexity-space-vs-sprites.md)
- [SPACE vs Together Code Sandbox](https://www.anchorterminal.com/compare/perplexity-space-vs-together-code-sandbox.md)
- [SPACE vs Vercel Sandbox](https://www.anchorterminal.com/compare/perplexity-space-vs-vercel-sandbox.md)
- [Agent 37 Cloud vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agent37-vs-celesto.md)
- [Agent 37 Cloud vs SPACE](https://www.anchorterminal.com/compare/agent37-vs-perplexity-space.md)
- [DeltaBox Lite vs SPACE](https://www.anchorterminal.com/compare/deltabox-lite-vs-perplexity-space.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp