Celesto (formerly SmolVM) vs Together Code Sandbox

Celesto (formerly SmolVM) 60

Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.

Together Code Sandbox 20

No x402, MPP or L402 found (0). The pricing page still lists Code Sandbox at $0.0446 per vCPU-hour and $0.0149 per GiB of RAM per hour without a login, and does not say whether the rate covers the new SDK as well as the legacy one (20). The billing docs say Together has no free trial and that platform access needs a minimum $15 credit purchase (0). Access needs a browser signup, a payment and a request to Together to enable the organisation (0). 0 + 20 + 0 + 0 = 20.

Celesto (formerly SmolVM) 66

Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as celesto with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.

Together Code Sandbox 32

Read with the hosted lines. status.together.ai lists the website, the playground and inference models with no component for the sandbox service, and a vendor status page with no component for the product takes 15. Incident line kept at 5. The Together page posts no incident since 6 January 2025, while status.codesandbox.io, which lists the CodeSandbox API and two clusters, wasn't re-read on 4 November (codesandbox.io answers a bot check, so its terms are unread), per the 8 October check (5). No rate or concurrency limits found, and the migration guide says the concurrency count and limit are not exposed (0). Both SDKs retry 408, 429, 500, 502, 503 and 504 three times with exponential backoff from 0.5 seconds plus jitter, and the SDK references say snapshots.create is not idempotent and should be excluded from retries. That is safe-retry guidance with no idempotency keys (12). No SLA found, and the terms make no uptime guarantee outside an order form (0). The docs still say the SDK must be enabled for an organisation, on request to sales, which is not general availability (0). 15 + 5 + 0 + 12 + 0 + 0 = 32.

Celesto (formerly SmolVM) 70

Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.

Together Code Sandbox 59

A closed service under Together's terms of service (19 May 2026). The SDKs, CLI and OpenAPI documents are MIT, which doesn't raise the line for a closed API, as for the Together inference and fine-tuning listings (15). The privacy policy (17 December 2025) says data is not used for training without opt-in. Its table of data types covers inference, fine-tuning and GPU clusters with no sandbox row, and no retention period for sandbox filesystems or snapshots was found beyond an optional snapshot ttl (12). The legacy @codesandbox/sdk page is still marked deprecated with no end date, the deprecations page covers models only, and breaking SDK changes are marked in the changelog. Kept as a partial (8). No sub-processor list or data locations for sandboxes found. A docs example names a cluster na-us-ce-01, and the trust centre was unread (3). 15 + 12 + 8 + 3 = 38.

Celesto (formerly SmolVM) 52

Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). computer logs shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.

Together Code Sandbox 46

Project-scoped API keys, revocable within about five minutes, with optional expiry and rotation guidance, read as the Together inference and fine-tuning listings read the same key model (30). The in-VM OpenAPI document still lists ?token= as a documented way to authenticate the WebSocket exec path, so the checklist's fixed 10 comes off (20). Each sandbox is a virtual machine. Every port is open to everyone unless the experimental inbound policy is set, no outbound rules exist, and project roles are admin and editor with no read-only role (8). The sandbox returns the output of code the agent ran, with no guidance on untrusted output found (8). Sandboxes can be listed with tags and status_reason. No audit log found (3). A PGP-signed security.txt (Expires 2028-09-30) points Contact and Policy at HackerOne with no acknowledgement time, the value this run gives a disclosure route with no stated time (7). 20 + 8 + 8 + 3 + 7 = 46.