# Celesto (formerly SmolVM) vs Together Code Sandbox (slim)

> Celesto scores 68 (B) to Together Code Sandbox's 54.7 (C) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.md (~4,900 tokens) · this version ~2,280 tokens · JSON https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.json · canonical https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Celesto (formerly SmolVM) scores 68 (B) on agent readiness against Together Code Sandbox's 54.7 (C), and leads in 4 of 7 scored categories. Both do code sandboxes.

- Celesto (formerly SmolVM): B 68, rank #298 of 1486 · https://www.anchorterminal.com/tools/celesto.min.md
- Together Code Sandbox: C 54.7, rank #896 of 1486 · https://www.anchorterminal.com/tools/together-code-sandbox.min.md
- Celesto (formerly SmolVM), good for Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud. Ahead on Reliability, 66 against 32; Security & auth, 52 against 46; Payments & pricing, 60 against 20; Transparency & trust, 70 against 59. Also No key needed to call it; Free to start without a card; Open source.
- Together Code Sandbox, good for Teams already buying from Together, and former CodeSandbox SDK users, who want Docker-defined sandboxes with disk and memory snapshots from Python or TypeScript. Also A hosted endpoint, with nothing to install.

| Category | Celesto (formerly SmolVM) | Together Code Sandbox |
| --- | --- | --- |
| Reliability (16%) | 66 | 32 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 85 | 86 |
| Agent ergonomics (13%) | 69 | 70 |
| Security & auth (14%) | 52 | 46 |
| Payments & pricing (10%) | 60 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 81 | 83 |
| Transparency & trust (7%) | 70 | 59 |

| Fact (where they differ) | Celesto (formerly SmolVM) | Together Code Sandbox |
| --- | --- | --- |
| Kind | SDK + MCP | HTTP API |
| Vendor | Celesto AI, Inc. | Together AI |
| Hosted endpoint | no (local only) | `https://api.bartender.codesandbox.io` |
| Transports |  | HTTP |
| Auth | None | API key |
| Pricing | Freemium | Pay per use |
| Licence | Apache-2.0 | Proprietary service under Together's terms of service. The SDKs, CLI and OpenAPI documents on GitHub are MIT |
| Last release | 2026-11-05 | 2026-10-07 |
| Terms last updated | 2026-10-30 | no date given |
| Privacy policy last updated | 2026-10-30 | no date given |
| Terms restrict benchmarking | not found in the text | yes |
| Popularity | 1.1k stars, 699 PyPI/wk | 3 stars, 1.3k npm/wk |

Why the edge:
- Payments & pricing, Celesto (formerly SmolVM) +40: Celesto (formerly SmolVM) 60 (Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.); Together Code Sandbox 20 (No x402, MPP or L402 found (0). The pricing page still lists Code Sandbox at $0.0446 per vCPU-hour and $0.0149 per GiB of RAM per hour without a login, and does not say whether the rate covers the new SDK as well as the legacy one (20). The billing docs say Together has no free trial and that platform access needs a minimum $15 credit purchase (0). Access needs a browser signup, a payment and a request to Together to enable the organisation (0). 0 + 20 + 0 + 0 = 20.)
- Reliability, Celesto (formerly SmolVM) +34: Celesto (formerly SmolVM) 66 (Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.); Together Code Sandbox 32 (Read with the hosted lines. status.together.ai lists the website, the playground and inference models with no component for the sandbox service, and a vendor status page with no component for the product takes 15. Incident line kept at 5. The Together page posts no incident since 6 January 2025, while status.codesandbox.io, which lists the CodeSandbox API and two clusters, wasn't re-read on 4 November (codesandbox.io answers a bot check, so its terms are unread), per the 8 October check (5). No rate or concurrency limits found, and the migration guide says the concurrency count and limit are not exposed (0). Both SDKs retry 408, 429, 500, 502, 503 and 504 three times with exponential backoff from 0.5 seconds plus jitter, and the SDK references say `snapshots.create` is not idempotent and should be excluded from retries. That is safe-retry guidance with no idempotency keys (12). No SLA found, and the terms make no uptime guarantee outside an order form (0). The docs still say the SDK must be enabled for an organisation, on request to sales, which is not general availability (0). 15 + 5 + 0 + 12 + 0 + 0 = 32.)
- Transparency & trust, Celesto (formerly SmolVM) +11: Celesto (formerly SmolVM) 70 (Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.); Together Code Sandbox 59 (A closed service under Together's terms of service (19 May 2026). The SDKs, CLI and OpenAPI documents are MIT, which doesn't raise the line for a closed API, as for the Together inference and fine-tuning listings (15). The privacy policy (17 December 2025) says data is not used for training without opt-in. Its table of data types covers inference, fine-tuning and GPU clusters with no sandbox row, and no retention period for sandbox filesystems or snapshots was found beyond an optional snapshot `ttl` (12). The legacy `@codesandbox/sdk` page is still marked deprecated with no end date, the deprecations page covers models only, and breaking SDK changes are marked in the changelog. Kept as a partial (8). No sub-processor list or data locations for sandboxes found. A docs example names a cluster `na-us-ce-01`, and the trust centre was unread (3). 15 + 12 + 8 + 3 = 38.)
- Security & auth, Celesto (formerly SmolVM) +6: Celesto (formerly SmolVM) 52 (Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.); Together Code Sandbox 46 (Project-scoped API keys, revocable within about five minutes, with optional expiry and rotation guidance, read as the Together inference and fine-tuning listings read the same key model (30). The in-VM OpenAPI document still lists `?token=` as a documented way to authenticate the WebSocket exec path, so the checklist's fixed 10 comes off (20). Each sandbox is a virtual machine. Every port is open to everyone unless the experimental inbound policy is set, no outbound rules exist, and project roles are admin and editor with no read-only role (8). The sandbox returns the output of code the agent ran, with no guidance on untrusted output found (8). Sandboxes can be listed with tags and `status_reason`. No audit log found (3). A PGP-signed security.txt (Expires 2028-09-30) points Contact and Policy at HackerOne with no acknowledgement time, the value this run gives a disclosure route with no stated time (7). 20 + 8 + 8 + 3 + 7 = 46.)