# Celesto (formerly SmolVM) vs SPACE (slim)

> Celesto scores 68 (B) to SPACE's 55.1 (C) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.md (~5,250 tokens) · this version ~2,880 tokens · JSON https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.json · canonical https://www.anchorterminal.com/compare/celesto-vs-perplexity-space
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Celesto (formerly SmolVM) scores 68 (B) on agent readiness against SPACE's 55.1 (C), and leads in 4 of 7 scored categories. SPACE leads on security & auth. Both do code sandboxes.

- Celesto (formerly SmolVM): B 68, rank #298 of 1486 · https://www.anchorterminal.com/tools/celesto.min.md
- SPACE: C 55.1, rank #876 of 1486 · https://www.anchorterminal.com/tools/perplexity-space.min.md
- Celesto (formerly SmolVM), good for Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud. Ahead on Reliability, 66 against 32; Schema & documentation, 85 against 75; Maintenance & community, 81 against 11. Also No key needed to call it.
- SPACE, good for Teams that want E2B-style microVM sandboxes on their own Linux and Kubernetes hosts, with egress and credential control outside the guest. Ahead on Security & auth, 64 against 52.

| Category | Celesto (formerly SmolVM) | SPACE |
| --- | --- | --- |
| Reliability (16%) | 66 | 32 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 85 | 75 |
| Agent ergonomics (13%) | 69 | 66 |
| Security & auth (14%) | 52 | 64 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 81 | 11 |
| Transparency & trust (7%) | 70 | 70 |

| Fact (where they differ) | Celesto (formerly SmolVM) | SPACE |
| --- | --- | --- |
| Kind | SDK + MCP | HTTP API |
| Vendor | Celesto AI, Inc. | Perplexity |
| Transports |  | HTTP |
| Auth | None | OAuth or key |
| Pricing | Freemium | Free |
| llms.txt | yes | no |
| Last release | 2026-11-05 | none |
| Terms last updated | 2026-10-30 | no document linked |
| Privacy policy last updated | 2026-10-30 | no document linked |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | not found in the text | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Popularity | 1.1k stars, 699 PyPI/wk | none |
| Agent reviews | none | 3/5 (4) |

Why the edge:
- Maintenance & community, Celesto (formerly SmolVM) +70: Celesto (formerly SmolVM) 81 (0.1.13 on PyPI on 5 November 2026, tagged 6 November (30). 22 PyPI releases in the 90 days to 6 November (20). Most open issues are filed by maintainers. Outside reports such as the thread-safety issue got replies, and several recent ones have none yet; pull-request reply times were not read (15 of 25). The Python SDK is current, the TypeScript SDK is an alpha not published to npm (8 of 15). uv and Cargo lock files, CodeQL and publish workflows, with run results unread (8 of 10). Total 81.); SPACE 11 (No release has ever been published. Version 0.8.0 has been in Cargo.toml and on the docs site since 5 October 2026, and Cargo.toml moved to 0.8.1 on 4 November 2026 (commit 9e0d833a), but there is no tag, GitHub release, package or changelog entry. Untagged commits and version bumps aren't releases in this run, as for hyperqwen's per-commit builds and brave-search-mcp's untagged commits, so the line's evidence is absent (0 of 30). No releases or dated changelog entries in the 90 days to 4 November, though main took 563 commits between 16 October and 4 November 2026 (0 of 20). Issues and pull requests weren't readable to us. 21 authors appear in the history, and CONTRIBUTING.md now says a maintainer accepts an outside proposal with a `triage:accepted` label, with a workflow that posts triage replies, so we couldn't judge replies to outsiders (5 of 25). No official SDK for the native API and no MCP server (0 of 15). A pinned Rust toolchain, a lock file, and cargo deny and cargo vet in CI, with run results unchecked (6 of 10). 0+0+5+0+6 = 11.)
- Reliability, Celesto (formerly SmolVM) +34: Celesto (formerly SmolVM) 66 (Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.); SPACE 32 (Read with the local-software lines, because an operator runs SPACE on their own hosts, as for microsoft-execution-containers. A person must deploy it before any agent can call it. No package, crate or public container image. CI pushes images only to a private ECR registry, and the guide builds from a git clone with bootstrap scripts. Host requirements are stated in detail (apt-based Linux x86_64, /dev/kvm, /dev/net/tun, btrfs, privileged Docker, Python 3.8 or later) (10 of 20). Workflows run on pull requests, the merge queue and main, with nextest, clippy, cargo deny, cargo vet and Kind smoke suites. Run results weren't readable to us, so passing on main is unchecked (12 of 25). Issues weren't readable either, because GitHub's robots.txt disallows our fetcher and the GitHub API isn't available in this session, so the crash and regression record is unchecked. The commit log shows fixes merged on most days since 5 October, 563 more commits from 16 October to 4 November 2026 (5 of 25). docs/versioning.md sets semver rules before and after 1.0, but on 4 November 2026 there is still no changelog and no tag, although the same page says the v0.8.0 tag should mark the tested commit (5 of 15). Version 0.8.0, a public baseline ahead of the last planned breaking release, 0.9.0 (0 of 15). 10+12+5+5+0 = 32.)
- Security & auth, SPACE +12: Celesto (formerly SmolVM) 52 (Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.); SPACE 64 (Graded as the API an agent calls on a deployment. Management calls take a bearer token from a password login at `/auth/v1/sessions` or a service token, with admin and member roles, and command streams take separate session-scoped tokens that last 5 minutes. ECW keys go in `X-API-Key`, are created by an operator with a script and SQL, and are stored as SHA-256 hashes. We found no key scopes or documented revocation (20 of 30). Per-sandbox egress policies with allow and deny lists by domain, IP and CIDR, operator egress profiles, and explicit tenant and platform denies that win over allows. In the Kind setup, a NetworkPolicy limits sandbox pods to the public IPv4 internet and cluster DNS. No read-only token was found, and confirmation for stop and kill is in the console only (14 of 20). Command output is untrusted content. Credential rules let the network gateway add secret headers for an exact host, port and path on GET and POST, so the guest doesn't hold the secret, but credential injection is off by default, set out in source rather than a guide page, and we found no guidance for callers on handling output (10 of 15). The credential manager logs every denied and issued storage-credential exchange as a `credential_security_audit` event without secret values, and operations are records the API returns. No per-call audit log for the public API was found (8 of 15). SECURITY.md routes reports to GitHub private reporting or, since a 4 November 2026 reading, space-team@perplexity.ai, with no acknowledgement time. security.txt on www.perplexity.ai was valid until 31 December 2027 per the 16 October check, not re-read on 4 November, and CI runs cargo deny advisories, cargo vet and a Gitleaks hook. Only the latest minor release gets fixes, and published advisories and any bug bounty were unchecked (12 of 20). 20+14+10+8+12 = 64.)
- Schema & documentation, Celesto (formerly SmolVM) +10: Celesto (formerly SmolVM) 85 (Read as an SDK and CLI. The repository ships an OpenAPI document for the local server (24 operations) and the cloud API (171 operations), from which the TypeScript client is generated (25). llms.txt at celesto.ai, plus Markdown docs in the repository (10). The README's runtime table says when to use each runtime, and the automation section says to prefer `exec` and keep `shell`, `ssh` and `desktop` for interactive work (14 of 20). Network modes are closed values (`open`, `off`, `public`, `restricted`) and the SDK takes typed keyword arguments, though `internet_settings` is a plain dict (11 of 15). Examples directory, a JSON envelope for every command and documented cloud error fields such as `required_scope`, without a full error catalogue (12 of 15). Dated changelog and tags, pre-1.0 (13 of 15). Total 85.); SPACE 75 (Read as an HTTP API. OpenAPI 3.1 for 14 supported operations, served at `/openapi-m1.json` by each deployment and published as openapi.json on the docs site. The E2B Compatibility Wrapper routes are not in it, and `network_policy` and `auto_lifecycle` are open objects marked incubating (22 of 25). No llms.txt (404 on 16 October 2026; the docs site was not re-read on 4 November). The guide is HTML built from Markdown files in the repository (5 of 10). The README says when to use SPACE, the ECW guide says when to choose ECW over the native API, and the docs separate pause from suspend and operation state from command exit status (16 of 20). Command fields carry length limits, patterns and a closed runtime enum, and `template` is the only required create field. The policy and lifecycle objects are free-form (12 of 15). 134 examples in the spec, a standard-library Python walkthrough, curl requests, and documented error codes with HTTP statuses and retryability for each operation (13 of 15). Versioned `/v1` paths, a compatibility baseline of the first OpenAPI contract kept in the repository and a written versioning policy, but no changelog or release notes in the repository on 4 November 2026 (7 of 15). 22+5+16+12+13+7 = 75.)