{ "data": { "a": { "slug": "celesto", "name": "Celesto (formerly SmolVM)", "vendor": "Celesto AI, Inc.", "vendorUrl": "https://celesto.ai", "kind": "sdk", "category": "code-sandboxes", "summary": "Celesto, formerly SmolVM, is an open-source Python SDK and CLI from Celesto AI that runs disposable Firecracker or QEMU microVMs on the owner's machine for agent code, browsers and desktops, with an optional paid Celesto Cloud.", "url": "https://www.anchorterminal.com/tools/celesto", "markdownUrl": "https://www.anchorterminal.com/tools/celesto.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/celesto.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/celesto.json", "dns": "celesto.grade.anchorterminal.com", "repo": "https://github.com/CelestoAI/Celesto", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "pypi", "name": "celesto" } ], "auth": "none", "authNotes": "Local use needs no account or key. The local API server and dashboard each require a bearer token, generated at start or read from CELESTO_SERVER_TOKEN and CELESTO_DASHBOARD_TOKEN. Celesto Cloud uses an organisation-bound CELESTO_API_KEY with named permissions (see, execute, delete) set in the dashboard.", "pricing": "freemium", "pricingNotes": "The local SDK and CLI are free under Apache-2.0. Celesto Cloud bills sandboxes by the running hour from $0.015 (Micro, 1 vCPU, 2 GB) to $0.16 (XL, 8 vCPU, 32 GB), prepaid from $2.01, with a one-time $5 Micro credit and no card.", "priceSummary": "$0.015 / session-hr", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the repository, the docs, llms.txt or the pricing page (checked 2026-11-06). Cloud runtime is prepaid by card under Settings \u003e Billing.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1149, "npmWeekly": null, "pypiWeekly": 699, "asOf": "2026-11-06" }, "docsUrl": "https://celesto.ai/docs", "llmsTxt": "https://celesto.ai/llms.txt", "openapi": "https://github.com/CelestoAI/Celesto/blob/main/ts/celesto-local-server.openapi.json", "capabilities": [ "sandbox.code", "sandbox.fs", "sandbox.persist", "sandbox.browser" ], "tags": [ "open-source", "local", "self-hosted", "hosted", "freemium", "no-card", "free-tier", "apache-2.0", "python", "typescript", "cli", "microvm", "firecracker", "llms-txt", "openapi", "telemetry", "pre-1.0", "renamed" ], "lastRelease": "2026-11-05", "graded": true, "anchor": { "graded": true, "score": 68, "grade": "B", "agentReady": false, "rank": 298, "ranked": true, "rankOf": 1486, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 81, "payments": 60, "reliability": 66, "schema": 85, "security": 52, "transparency": 70 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.", "bestFor": "Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.", "strengths": [ "Apache-2.0, installs from PyPI with `celesto setup` and `celesto doctor`, and runs local microVMs with no account or key", "Every `--json` response has the same `ok`, `command`, `exit_code`, `data` and `error` fields, with recovery commands in errors", "Network modes `off`, `public` (proxy that rejects private and metadata addresses) and `restricted` with CIDR or domain allowlists", "Dated changelog with Security sections, breaking changes marked, and 22 PyPI releases in the 90 days to 6 November 2026", "OpenAPI documents for the local server (24 operations) and the cloud API (171 operations) in the repository, plus llms.txt" ], "weaknesses": [ "Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball", "Outbound network access is open by default, and Linux TAP mode does not block every private network or metadata service", "Usage telemetry to PostHog is on after a first-use notice, until switched off", "Renamed from SmolVM on 19 September 2026 in a breaking release that removed the `smolvm` command and import path", "No security.txt, bug bounty or certification found, and CI results could not be read" ], "agentNotes": [ "Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text", "Create computers with unique names and delete them by exact name when the job ends, including after failures", "Set `internet_settings={\"mode\": \"off\"}` or `restricted` for untrusted code, since the default is open", "Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine", "Never paste browser or display connection URLs into model context; possession of the URL grants control" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68 } ], "editorialScores": { "ergonomics": 69, "maintenance": 81, "payments": 60, "reliability": 66, "schema": 85, "security": 52, "transparency": 74 }, "provenanceScore": 66, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install celesto \u0026\u0026 celesto setup \u0026\u0026 celesto doctor", "headless": { "create": "celesto computer create --name agent-job --json", "delete": "celesto computer delete agent-job --json", "exec": "celesto computer exec agent-job --json -- python -m pytest" } }, "letme": { "capability": "https://letme.dev/sandbox.code", "tool": "https://letme.dev/celesto" }, "area": "agent-runtime", "unitPrices": [ { "item": "Cloud Micro sandbox (1 vCPU, 2 GB)", "unit": "session-hour", "usd": 0.015, "note": "Billed by the running hour; local use is free" }, { "item": "Cloud XL sandbox (8 vCPU, 32 GB)", "unit": "session-hour", "usd": 0.16, "note": "Largest size on the pricing page" } ], "provenance": { "legalEntity": "Celesto AI, Inc.", "domain": "celesto.ai", "domainRegistered": "2025-07-13", "endpointOnVendorDomain": null, "terms": "https://celesto.ai/legal/terms", "privacy": "https://celesto.ai/legal/privacy-policy", "statusPage": "", "changelog": "https://github.com/CelestoAI/Celesto/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The privacy policy, last updated 30 October 2026, names Celesto AI, Inc., a Delaware corporation with a Wilmington mailing address. It has no clause on automated access.", "celesto.ai/robots.txt allows all crawlers. docs.celesto.ai carries Content-Signal ai-train=yes, search=yes, ai-input=yes.", "RDAP gives celesto.ai a registration date of 13 July 2025.", "/.well-known/security.txt returns 404. SECURITY.md asks for private reports through GitHub's vulnerability reporting. No status page is linked from the pricing page." ], "score": 66 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/celesto.json", "live": { "slug": "celesto", "versions": [ { "registry": "github", "name": "CelestoAI/Celesto", "version": "v0.1.13", "released": "2026-11-05", "seenAt": "2026-11-06T23:13:37.416837168Z" }, { "registry": "pypi", "name": "celesto", "version": "0.1.13", "released": "2026-11-05", "seenAt": "2026-11-06T23:13:37.309276304Z" } ], "githubStars": 1149, "pypiWeekly": 699, "securityTxt": { "url": "https://celesto.ai/.well-known/security.txt", "state": "unknown", "checkedAt": "2026-11-07T16:01:01.176888246Z" }, "llmsTxt": { "url": "https://celesto.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:46.784166983Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/CelestoAI/Celesto/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:18:00.719411253Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8ddae4a6adbd" }, { "url": "https://celesto.ai/legal/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:00:50.868104256Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "87ce310b1db6" }, { "url": "https://celesto.ai/legal/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:00:53.107282947Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1dece6f9a42e" } ], "updatedAt": "2026-11-07T16:01:01.176888246Z" } }, "answer": "Vercel Sandbox scores 73.5 (BB) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 6 of 7 scored categories. Celesto (formerly SmolVM) leads on payments \u0026 pricing.", "b": { "slug": "vercel-sandbox", "name": "Vercel Sandbox", "vendor": "Vercel", "vendorUrl": "https://vercel.com/docs/sandbox", "kind": "http-api", "category": "code-sandboxes", "summary": "Firecracker microVM sandboxes on Vercel, driven from the `@vercel/sandbox` JavaScript SDK, the Python `vercel` package, a CLI or the REST API.", "url": "https://www.anchorterminal.com/tools/vercel-sandbox", "markdownUrl": "https://www.anchorterminal.com/tools/vercel-sandbox.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/vercel-sandbox.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/vercel-sandbox.json", "dns": "vercel-sandbox.grade.anchorterminal.com", "repo": "https://github.com/vercel/sandbox", "license": "Apache-2.0", "transports": [ "http" ], "remoteUrl": "https://api.vercel.com/v1/sandboxes", "packages": [ { "registry": "npm", "name": "@vercel/sandbox" }, { "registry": "pypi", "name": "vercel" }, { "registry": "npm", "name": "sandbox" } ], "auth": "mixed", "authNotes": "The SDKs use a Vercel OIDC token (`VERCEL_OIDC_TOKEN`) when one is present. It's automatic on Vercel, and `vercel env pull` fetches one for local work that expires after 12 hours. Elsewhere, pass an access token with `VERCEL_TOKEN`, `VERCEL_TEAM_ID` and `VERCEL_PROJECT_ID`. The REST API takes the access token as a Bearer header.", "pricing": "freemium", "pricingNotes": "Hobby includes 5 hours of Active CPU, 420 GB-hours of memory, 5,000 sandbox creations, 20 GB of transfer, 15 GB of snapshot storage, 15 GB of drive storage and 30 GB each of drive reads and writes, after which creation pauses until the next cycle. Pro and Enterprise pay $0.128 an Active CPU hour, $0.0212 a GB-hour of provisioned memory, $0.60 per million creations, $0.08 a GB-month of snapshot storage, $0.05 a GB-month for drives, $0.0015 a GB of drive reads and $0.004 a GB of drive writes, at iad1 rates, with CPU, memory, transfer and drive rates varying by region. Pro usage draws first on the plan's $20 monthly credit. Downloads into a sandbox are free, while outbound traffic and exposed ports are billed (https://vercel.com/docs/sandbox/pricing, checked 2026-10-17).", "priceSummary": "$0.128 / vCPU-hr", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 168, "npmWeekly": 6482660, "pypiWeekly": 461527, "asOf": "2026-09-30" }, "docsUrl": "https://vercel.com/docs/sandbox", "llmsTxt": "https://vercel.com/llms.txt", "openapi": "https://openapi.vercel.sh/", "capabilities": [ "sandbox.code", "sandbox.fs", "sandbox.persist" ], "tags": [ "hosted", "freemium", "free-tier", "typescript", "python", "llms-txt", "enterprise", "openapi" ], "lastRelease": "2026-10-28", "graded": true, "anchor": { "graded": true, "score": 73.5, "grade": "BB", "agentReady": true, "rank": 108, "ranked": true, "rankOf": 1486, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 73, "maintenance": 82, "payments": 50, "reliability": 75, "schema": 88, "security": 86, "transparency": 78 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -3, "negativeNotes": [ "April 2026. Vercel's security bulletin says an attacker took over an employee's account through a compromised third-party AI tool (Context.ai), reached internal systems and decrypted non-sensitive environment variables of a limited subset of customers, and a later review found a small number of further affected accounts. Vercel closed the incident on 16 October 2026 with all remediation complete, re-read on 1 November. @vercel/sandbox had been on npm since May 2025, and Sandbox runs under the same Vercel accounts, projects and tokens. A fixed and documented incident that reached customer secrets, about six months old, so 3 of a possible 15 is taken, the same deduction as vercel-connect. The 1 October check took none for it (https://vercel.com/kb/bulletin/vercel-april-2026-security-incident)." ], "verdict": "Active CPU billing means waiting on model responses costs only memory, and the REST API is in Vercel's public OpenAPI document. Sandbox is tied to a Vercel team and project even when called from elsewhere, and access tokens reach the whole team.", "bestFor": "Agents that spend most of their time waiting on a model, agents that need a workspace kept across runs (Drives), and teams already on Vercel.", "strengths": [ "Active CPU billing, so waiting on model responses costs only memory", "Credential brokering proxy outside the sandbox that overwrites headers set by sandbox code", "Firecracker microVM with root access, and a firewall with deny-all, domain and CIDR rules", "Drives, generally available since 15 October 2026, keep files across sandboxes and can be forked for parallel workers", "Sandbox endpoints are in Vercel's public OpenAPI document, with paginated, filterable list calls" ], "weaknesses": [ "Tied to a Vercel team and project even when called from elsewhere, and access tokens reach the whole team", "Hobby caps sessions at 45 minutes and pauses creation once the monthly allowance is spent", "Snapshots keep the filesystem, not memory or running processes", "Egress is allow-all until you set a policy", "No MCP server for Sandbox and no SLA found" ], "agentNotes": [ "Call `sandbox.stop()` when the task is done. Memory bills until the session ends", "Use `Sandbox.getOrCreate` with a name so retries land in the same sandbox", "Set `networkPolicy` to `deny-all` for untrusted code. The default is allow-all", "Put API keys in credential brokering rules, not in the sandbox environment", "Calling `POST /v4/sandboxes` directly, snapshots expire after 7 days and only the latest is kept unless you set `keepLastSnapshots`. The SDK still uses v3, with 30 days" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 73.5 } ], "editorialScores": { "ergonomics": 73, "maintenance": 82, "payments": 50, "reliability": 75, "schema": 88, "security": 86, "transparency": 57 }, "provenanceScore": 99, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-10-17", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm i @vercel/sandbox # or pip install vercel", "http": "curl -X POST \"https://api.vercel.com/v1/sandboxes?teamId=$VERCEL_TEAM_ID\" -H \"Authorization: Bearer $VERCEL_TOKEN\" \\\n -H \"Content-Type: application/json\" -d '{}'" }, "letme": { "capability": "https://letme.dev/sandbox.code", "tool": "https://letme.dev/vercel-sandbox" }, "sameCompany": [ "vercel-ai-gateway", "vercel-connect" ], "area": "agent-runtime", "unitPrices": [ { "item": "Active CPU (iad1)", "unit": "vcpu-hour", "usd": 0.128, "note": "Billed only while the CPU is busy. Memory extra at $0.0212 a GB-hour" }, { "item": "Snapshot storage", "unit": "gb-month", "usd": 0.08 }, { "item": "Drive storage (iad1)", "unit": "gb-month", "usd": 0.05 }, { "item": "Drive reads (iad1)", "unit": "gb", "usd": 0.0015, "note": "Hobby includes 30 GB a month" }, { "item": "Drive writes (iad1)", "unit": "gb", "usd": 0.004, "note": "Hobby includes 30 GB a month" }, { "item": "Data transfer on Enterprise (iad1)", "unit": "gb", "usd": 0.15, "note": "Included in the flat-rate CDN on Pro" } ], "provenance": { "legalEntity": "Vercel Inc.", "domain": "vercel.com", "domainRegistered": "1999-10-04", "domainNote": "vercel.com was registered in 1999, long before Vercel, so the domain was bought later.", "endpointOnVendorDomain": true, "terms": "https://vercel.com/legal/terms", "privacy": "https://vercel.com/legal/privacy-policy", "statusPage": "https://www.vercel-status.com", "changelog": "https://vercel.com/changelog", "securityTxt": "valid", "checked": "2026-11-01", "notes": [ "Terms (last updated 19 October 2026) name Vercel Inc., 440 N Barranca Ave #4133, Covina, California, read on 1 November 2026.", "security.txt points to HackerOne and responsible.disclosure@vercel.com and expires 2027-09-28, re-read on 1 November 2026.", "The status page lists Sandbox as its own component. Its history feed from 3 August to 1 November 2026 has a Sandbox API latency incident on 4 September and a 24-minute minor incident in cdg1 on 6 October.", "The DPA (effective 31 March 2026) names Vercel Inc., a Delaware corporation, and applies to Pro and Enterprise." ], "score": 99 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/vercel-sandbox.json", "live": { "slug": "vercel-sandbox", "probe": { "target": "https://api.vercel.com/v1/sandboxes", "method": "get", "lastAt": "2026-11-07T18:21:03.501794121Z", "lastOk": true, "lastStatus": 403, "lastMs": 163, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 99.99, "p50ms24h": 107, "p95ms24h": 246, "samples24h": 239, "samples30d": 7910, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 248 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://www.vercel-status.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:22:08.438304762Z" }, "versions": [ { "registry": "github", "name": "vercel/sandbox", "version": "sandbox@4.11.1", "released": "2026-10-28", "seenAt": "2026-11-07T00:15:14.720427652Z" }, { "registry": "npm", "name": "@vercel/sandbox", "version": "3.9.1", "seenAt": "2026-11-07T00:15:12.534893931Z" }, { "registry": "npm", "name": "sandbox", "version": "4.11.1", "seenAt": "2026-11-07T00:15:13.533263413Z" }, { "registry": "pypi", "name": "vercel", "version": "0.12.2", "released": "2026-11-03", "seenAt": "2026-11-07T00:15:13.351050226Z" } ], "githubStars": 220, "npmWeekly": 7999086, "pypiWeekly": 1064824, "securityTxt": { "url": "https://vercel.com/.well-known/security.txt", "state": "valid", "expires": "2027-09-28T12:00:00.000Z", "checkedAt": "2026-11-07T16:01:04.63743298Z" }, "llmsTxt": { "url": "https://vercel.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:19.902078464Z" }, "domain": { "domain": "vercel.com", "registered": "1999-10-04", "source": "https://rdap.verisign.com/com/v1/domain/vercel.com", "checkedAt": "2026-11-01T14:26:56.031194695Z" }, "pages": [ { "url": "https://vercel.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:25:35.711588091Z", "changedAt": "2026-10-08T18:25:35.711588091Z", "fingerprint": "304566010012" }, { "url": "https://vercel.com/docs/sandbox/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:23:29.262155324Z", "changedAt": "2026-11-06T13:44:50.033823321Z", "fingerprint": "983dbae48ac2" }, { "url": "https://vercel.com/legal/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:25:40.648740851Z", "changedAt": "2026-10-06T16:13:29.92763016Z", "fingerprint": "7ab1f9d3393a" }, { "url": "https://vercel.com/legal/terms", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:25:41.831234474Z", "changedAt": "2026-10-06T16:13:31.349375221Z", "fingerprint": "35995712008a" } ], "github": { "repo": "vercel/sandbox", "checkedAt": "2026-11-02T09:35:42.463283775Z", "stars": 219, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-31T18:09:13Z", "openIssues": 12, "openPRs": 44, "issuesOpened90d": 13, "issuesClosed90d": 4, "prsMerged90d": 95, "ci": { "branch": "main", "runs": 50, "success": 49, "failure": 1, "other": 0, "latest": "failure", "latestAt": "2026-10-30T21:40:17Z" }, "replies": { "sampled": 25, "unanswered": 12, "medianDays": 6 } }, "updatedAt": "2026-11-07T18:22:08.438304762Z" } }, "edges": [ { "by": 34, "category": "security", "leads": "vercel-sandbox", "name": "Security \u0026 auth", "reasons": { "a": "Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.", "b": "Vercel OIDC tokens tied to one project, which `vercel env pull` hands out for 12 hours, or access tokens elsewhere. Access tokens reach a whole team rather than one sandbox (25). Each sandbox is a Firecracker microVM with its own kernel (10). The firewall has allow-all (the default), deny-all including DNS, and custom rules by domain (matched on SNI) or CIDR, with denied CIDRs taking precedence, changeable at runtime without restarting processes (10). Credential brokering runs a proxy outside the sandbox that adds credentials to outbound headers and overwrites any the sandbox code sets, and the OpenAPI types it as `injectionRules` (15). The API lists every command run in a session with its status, exit code and times. We found no team audit log entry for sandbox activity (8). Valid security.txt pointing to HackerOne and responsible.disclosure@vercel.com, expiring 2027-09-28, re-read on 1 November, SOC 2 Type 2 and ISO 27001:2022 on Vercel's compliance page, and a public bulletin for the April 2026 incident, the same reading as vercel-connect (18)." }, "scores": { "a": 52, "b": 86 } }, { "by": 10, "category": "payments", "leads": "celesto", "name": "Payments \u0026 pricing", "reasons": { "a": "Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.", "b": "No x402, MPP or L402 (0). Per-unit prices published by region, $0.128 an Active CPU hour and $0.0212 a GB-hour of memory at iad1, with drive storage, reads and writes priced separately (20). Hobby includes 5 Active CPU hours and 5,000 creations a month at no cost. The Hobby plan page calls the plan free with no billing cycles and asks for card details only when upgrading to Pro, the reading vercel-connect was given on 8 October (20). Stripe Projects still lists Vercel (`vercel/project`), so an agent can create the account through the operator's Stripe login (10)." }, "scores": { "a": 60, "b": 50 } }, { "by": 9, "category": "reliability", "leads": "vercel-sandbox", "name": "Reliability", "reasons": { "a": "Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.", "b": "Sandbox is its own component on www.vercel-status.com, with an incident history (20). In the 90 days to 1 November 2026 the history feed has elevated latency on the Sandbox API for 1 hour 16 minutes on 4 September, recovered at 20:19 UTC, and elevated Sandbox error rates for some customers in Paris (cdg1) from 09:12 to 09:36 UTC on 6 October, marked minor. Nothing for Sandbox since. The 23 July dashboard incident has left the window. A degradation and a short regional incident only (20). Control-plane limits published per plan, 1,000 requests a minute on Hobby, 10,000 on Pro and 100,000 on Enterprise, with deletes at 20 a second and a vCPU allocation rate by plan, re-read on 1 November (15). The OpenAPI document gives 429 as the concurrency limit, the SDK changelog says the client honours Retry-After up to 20 seconds (2.9.2), and `Sandbox.getOrCreate` with a name gives a safe retry. No backoff guidance for callers outside the SDK (10). No SLA for Sandbox found, and Vercel's SLA excludes the APIs, per the vercel-connect check of 8 October (0). GA (10)." }, "scores": { "a": 66, "b": 75 } }, { "by": 8, "category": "transparency", "leads": "vercel-sandbox", "name": "Transparency \u0026 trust", "reasons": { "a": "Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.", "b": "The SDK and CLI are Apache-2.0. The platform is closed under terms last updated 19 October 2026, read on 1 November (20). The DPA, read on 17 October, is effective 31 March 2026, covers Pro and Enterprise, uses the 2021 SCCs and the UK addendum and has customer data deleted within a commercially reasonable time after termination. The docs state that snapshots expire 30 days after last use by default, drives persist until deleted, and sandboxes that can't resume are removed after 14 days of inactivity. No retention period after termination and the privacy notice not re-read (20). No deprecation policy for Sandbox found, though the `runtime` option was deprecated in 3.0.0 with a migration table (5). 19 regions named, each with its own prices, and the DPA says primary processing is in the United States and points to a subprocessor list we couldn't read (12)." }, "scores": { "a": 70, "b": 78 } } ], "facts": [ { "a": "SDK + MCP", "b": "HTTP API", "name": "Kind" }, { "a": "Celesto AI, Inc.", "b": "Vercel", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.vercel.com/v1/sandboxes", "name": "Hosted endpoint" }, { "a": "", "b": "HTTP", "name": "Transports" }, { "a": "None", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-11-05", "b": "2026-10-28", "name": "Last release" }, { "a": "2026-10-30", "b": "2026-06-01", "name": "Terms last updated" }, { "a": "2026-10-30", "b": "2026-06-01", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "yes, with an opt-out", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "1.1k stars, 699 PyPI/wk", "b": "168 stars, 6.5M npm/wk, 462k PyPI/wk", "name": "Popularity" }, { "a": "none", "b": "3.5/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "Vercel Sandbox scores 73.5 (BB) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 6 of 7 scored categories. Celesto (formerly SmolVM) leads on payments \u0026 pricing.", "question": "Which is better for AI agents, Celesto (formerly SmolVM) or Vercel Sandbox?" }, { "answer": "No hosted endpoint is listed for Celesto (formerly SmolVM). Vercel Sandbox has a hosted endpoint at https://api.vercel.com/v1/sandboxes.", "question": "Can an agent call Celesto (formerly SmolVM) and Vercel Sandbox without installing anything?" }, { "answer": "Celesto (formerly SmolVM) is open source (Apache-2.0). No open-source release is listed for Vercel Sandbox.", "question": "Are Celesto (formerly SmolVM) and Vercel Sandbox open source?" } ], "goodFor": [ { "aheadOn": [ "Payments \u0026 pricing, 60 against 50" ], "also": [ "No key needed to call it", "Free to start without a card", "Open source", "No incidents deducted, where Vercel Sandbox loses 3 points for them" ], "goodFor": "Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.", "slug": "celesto", "watchFor": "Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball" }, { "aheadOn": [ "Reliability, 75 against 66", "Security \u0026 auth, 86 against 52", "Transparency \u0026 trust, 78 against 70" ], "also": [ "Agent-ready, a grade of BB or better", "A hosted endpoint, with nothing to install" ], "goodFor": "Agents that spend most of their time waiting on a model, agents that need a workspace kept across runs (Drives), and teams already on Vercel.", "slug": "vercel-sandbox", "watchFor": "Tied to a Vercel team and project even when called from elsewhere, and access tokens reach the whole team" } ], "history": { "celesto": null, "vercel-sandbox": [ { "causes": [ "evidence", "correction", "event" ], "date": "2026-10-17", "delta": 3.9, "from": 69.6, "fromGrade": "B", "to": 73.5, "toGrade": "BB" } ] }, "job": { "capability": "sandbox.code", "name": "Code sandboxes" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.json", "title": "Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-vercel-sandbox.json", "title": "Amazon Bedrock AgentCore Code Interpreter vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.json", "title": "Blaxel Sandboxes vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-vercel-sandbox.json", "title": "Blaxel Sandboxes vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.json", "title": "Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK", "url": "https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-daytona.json", "title": "Celesto (formerly SmolVM) vs Daytona", "url": "https://www.anchorterminal.com/compare/celesto-vs-daytona" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.json", "title": "Celesto (formerly SmolVM) vs DeltaBox Lite", "url": "https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.json", "title": "Celesto (formerly SmolVM) vs Deno Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-e2b.json", "title": "Celesto (formerly SmolVM) vs E2B", "url": "https://www.anchorterminal.com/compare/celesto-vs-e2b" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-freestyle.json", "title": "Celesto (formerly SmolVM) vs Freestyle", "url": "https://www.anchorterminal.com/compare/celesto-vs-freestyle" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-instavm.json", "title": "Celesto (formerly SmolVM) vs InstaVM", "url": "https://www.anchorterminal.com/compare/celesto-vs-instavm" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-maritime.json", "title": "Celesto (formerly SmolVM) vs Maritime", "url": "https://www.anchorterminal.com/compare/celesto-vs-maritime" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.json", "title": "Celesto (formerly SmolVM) vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.json", "title": "Celesto (formerly SmolVM) vs Modal Sandboxes", "url": "https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.json", "title": "Celesto (formerly SmolVM) vs Morph Cloud", "url": "https://www.anchorterminal.com/compare/celesto-vs-morph-cloud" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-offscreen.json", "title": "Celesto (formerly SmolVM) vs Offscreen", "url": "https://www.anchorterminal.com/compare/celesto-vs-offscreen" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.json", "title": "Celesto (formerly SmolVM) vs SPACE", "url": "https://www.anchorterminal.com/compare/celesto-vs-perplexity-space" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-runloop.json", "title": "Celesto (formerly SmolVM) vs Runloop Devboxes", "url": "https://www.anchorterminal.com/compare/celesto-vs-runloop" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-sandbox0.json", "title": "Celesto (formerly SmolVM) vs Sandbox0", "url": "https://www.anchorterminal.com/compare/celesto-vs-sandbox0" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-sprites.json", "title": "Celesto (formerly SmolVM) vs Sprites", "url": "https://www.anchorterminal.com/compare/celesto-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.json", "title": "Celesto (formerly SmolVM) vs Together Code Sandbox", "url": "https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-vercel-sandbox.json", "title": "Cloudflare Sandbox SDK vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-vercel-sandbox.json", "title": "Daytona vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/daytona-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/deno-sandbox-vs-vercel-sandbox.json", "title": "Deno Sandbox vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/deno-sandbox-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/e2b-vs-vercel-sandbox.json", "title": "E2B vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/e2b-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/freestyle-vs-vercel-sandbox.json", "title": "Freestyle vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/freestyle-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/instavm-vs-vercel-sandbox.json", "title": "InstaVM vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/instavm-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/maritime-vs-vercel-sandbox.json", "title": "Maritime vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/maritime-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-vercel-sandbox.json", "title": "Microsoft Execution Containers vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/modal-sandboxes-vs-vercel-sandbox.json", "title": "Modal Sandboxes vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/modal-sandboxes-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/morph-cloud-vs-vercel-sandbox.json", "title": "Morph Cloud vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/morph-cloud-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/offscreen-vs-vercel-sandbox.json", "title": "Offscreen vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/offscreen-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/perplexity-space-vs-vercel-sandbox.json", "title": "SPACE vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/perplexity-space-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/runloop-vs-vercel-sandbox.json", "title": "Runloop Devboxes vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/runloop-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/sandbox0-vs-vercel-sandbox.json", "title": "Sandbox0 vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/sandbox0-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/sprites-vs-vercel-sandbox.json", "title": "Sprites vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/sprites-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/together-code-sandbox-vs-vercel-sandbox.json", "title": "Together Code Sandbox vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/together-code-sandbox-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/agent37-vs-celesto.json", "title": "Agent 37 Cloud vs Celesto (formerly SmolVM)", "url": "https://www.anchorterminal.com/compare/agent37-vs-celesto" }, { "json": "https://www.anchorterminal.com/compare/agent37-vs-vercel-sandbox.json", "title": "Agent 37 Cloud vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/agent37-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/deltabox-lite-vs-vercel-sandbox.json", "title": "DeltaBox Lite vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/deltabox-lite-vs-vercel-sandbox" } ], "panel": null, "scores": [ { "by": 9, "celesto": 66, "edge": "vercel-sandbox", "key": "reliability", "name": "Reliability", "vercel-sandbox": 75, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 3, "celesto": 85, "edge": "vercel-sandbox", "key": "schema", "name": "Schema \u0026 documentation", "vercel-sandbox": 88, "weight": 13 }, { "by": 4, "celesto": 69, "edge": "vercel-sandbox", "key": "ergonomics", "name": "Agent ergonomics", "vercel-sandbox": 73, "weight": 13 }, { "by": 34, "celesto": 52, "edge": "vercel-sandbox", "key": "security", "name": "Security \u0026 auth", "vercel-sandbox": 86, "weight": 14 }, { "by": 10, "celesto": 60, "edge": "celesto", "key": "payments", "name": "Payments \u0026 pricing", "vercel-sandbox": 50, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 1, "celesto": 81, "edge": "vercel-sandbox", "key": "maintenance", "name": "Maintenance \u0026 community", "vercel-sandbox": 82, "weight": 7 }, { "by": 8, "celesto": 70, "edge": "vercel-sandbox", "key": "transparency", "name": "Transparency \u0026 trust", "vercel-sandbox": 78, "weight": 7 } ], "summary": "Vercel Sandbox scores 73.5 (BB) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 6 of 7 scored categories. Celesto (formerly SmolVM) leads on payments \u0026 pricing. Both do code sandboxes.", "tasks": null, "tutorials": [], "verdicts": { "celesto": "Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.", "vercel-sandbox": "Active CPU billing means waiting on model responses costs only memory, and the REST API is in Vercel's public OpenAPI document. Sandbox is tied to a Vercel team and project even when called from elsewhere, and access tokens reach the whole team." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox", "json": "https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.min.md" }, "markdown": "Vercel Sandbox scores 73.5 (BB) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 6 of 7 scored categories. Celesto (formerly SmolVM) leads on payments \u0026 pricing. Both do code sandboxes.\n\n- Celesto (formerly SmolVM): grade B, 68/100, rank #298 of 1486. Markdown https://www.anchorterminal.com/tools/celesto.md · JSON https://www.anchorterminal.com/api/v1/tools/celesto.json\n- Vercel Sandbox: grade BB, 73.5/100, rank #108 of 1486. Markdown https://www.anchorterminal.com/tools/vercel-sandbox.md · JSON https://www.anchorterminal.com/api/v1/tools/vercel-sandbox.json\n- Best code execution sandboxes for AI agents: https://www.anchorterminal.com/best/code-sandboxes/index.md\n- All 231 sandboxes comparisons: https://www.anchorterminal.com/compare/code-sandboxes/index.md\n\n## Which one, for what\n\n### Celesto (formerly SmolVM) (B)\n\nGood for: Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud.\n\nAhead on:\n- Payments \u0026 pricing, 60 against 50\n\nAlso in its favour:\n- No key needed to call it\n- Free to start without a card\n- Open source\n- No incidents deducted, where Vercel Sandbox loses 3 points for them\n\nWatch for: Version 0.1.13 and declared pre-1.0 in SECURITY.md, with the TypeScript SDK an alpha installed from a GitHub tarball\n\n### Vercel Sandbox (BB)\n\nGood for: Agents that spend most of their time waiting on a model, agents that need a workspace kept across runs (Drives), and teams already on Vercel.\n\nAhead on:\n- Reliability, 75 against 66\n- Security \u0026 auth, 86 against 52\n- Transparency \u0026 trust, 78 against 70\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- A hosted endpoint, with nothing to install\n\nWatch for: Tied to a Vercel team and project even when called from elsewhere, and access tokens reach the whole team\n\n\n## Why the edge\n\n### Security \u0026 auth: Vercel Sandbox +34\n\n- Celesto (formerly SmolVM) (52): Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.\n- Vercel Sandbox (86): Vercel OIDC tokens tied to one project, which `vercel env pull` hands out for 12 hours, or access tokens elsewhere. Access tokens reach a whole team rather than one sandbox (25). Each sandbox is a Firecracker microVM with its own kernel (10). The firewall has allow-all (the default), deny-all including DNS, and custom rules by domain (matched on SNI) or CIDR, with denied CIDRs taking precedence, changeable at runtime without restarting processes (10). Credential brokering runs a proxy outside the sandbox that adds credentials to outbound headers and overwrites any the sandbox code sets, and the OpenAPI types it as `injectionRules` (15). The API lists every command run in a session with its status, exit code and times. We found no team audit log entry for sandbox activity (8). Valid security.txt pointing to HackerOne and responsible.disclosure@vercel.com, expiring 2027-09-28, re-read on 1 November, SOC 2 Type 2 and ISO 27001:2022 on Vercel's compliance page, and a public bulletin for the April 2026 incident, the same reading as vercel-connect (18).\n\n### Payments \u0026 pricing: Celesto (formerly SmolVM) +10\n\n- Celesto (formerly SmolVM) (60): Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.\n- Vercel Sandbox (50): No x402, MPP or L402 (0). Per-unit prices published by region, $0.128 an Active CPU hour and $0.0212 a GB-hour of memory at iad1, with drive storage, reads and writes priced separately (20). Hobby includes 5 Active CPU hours and 5,000 creations a month at no cost. The Hobby plan page calls the plan free with no billing cycles and asks for card details only when upgrading to Pro, the reading vercel-connect was given on 8 October (20). Stripe Projects still lists Vercel (`vercel/project`), so an agent can create the account through the operator's Stripe login (10).\n\n### Reliability: Vercel Sandbox +9\n\n- Celesto (formerly SmolVM) (66): Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.\n- Vercel Sandbox (75): Sandbox is its own component on www.vercel-status.com, with an incident history (20). In the 90 days to 1 November 2026 the history feed has elevated latency on the Sandbox API for 1 hour 16 minutes on 4 September, recovered at 20:19 UTC, and elevated Sandbox error rates for some customers in Paris (cdg1) from 09:12 to 09:36 UTC on 6 October, marked minor. Nothing for Sandbox since. The 23 July dashboard incident has left the window. A degradation and a short regional incident only (20). Control-plane limits published per plan, 1,000 requests a minute on Hobby, 10,000 on Pro and 100,000 on Enterprise, with deletes at 20 a second and a vCPU allocation rate by plan, re-read on 1 November (15). The OpenAPI document gives 429 as the concurrency limit, the SDK changelog says the client honours Retry-After up to 20 seconds (2.9.2), and `Sandbox.getOrCreate` with a name gives a safe retry. No backoff guidance for callers outside the SDK (10). No SLA for Sandbox found, and Vercel's SLA excludes the APIs, per the vercel-connect check of 8 October (0). GA (10).\n\n### Transparency \u0026 trust: Vercel Sandbox +8\n\n- Celesto (formerly SmolVM) (70): Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.\n- Vercel Sandbox (78): The SDK and CLI are Apache-2.0. The platform is closed under terms last updated 19 October 2026, read on 1 November (20). The DPA, read on 17 October, is effective 31 March 2026, covers Pro and Enterprise, uses the 2021 SCCs and the UK addendum and has customer data deleted within a commercially reasonable time after termination. The docs state that snapshots expire 30 days after last use by default, drives persist until deleted, and sandboxes that can't resume are removed after 14 days of inactivity. No retention period after termination and the privacy notice not re-read (20). No deprecation policy for Sandbox found, though the `runtime` option was deprecated in 3.0.0 with a migration table (5). 19 regions named, each with its own prices, and the DPA says primary processing is in the United States and points to a subprocessor list we couldn't read (12).\n\n## Score by category\n\n| Category | Weight | Celesto (formerly SmolVM) | Vercel Sandbox | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 66 | 75 | Vercel Sandbox +9 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 85 | 88 | Vercel Sandbox +3 |\n| Agent ergonomics | 13% (16.2 this run) | 69 | 73 | Vercel Sandbox +4 |\n| Security \u0026 auth | 14% (17.5 this run) | 52 | 86 | Vercel Sandbox +34 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 50 | Celesto (formerly SmolVM) +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 81 | 82 | Vercel Sandbox +1 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 70 | 78 | Vercel Sandbox +8 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **68 · B** | **73.5 · BB** | |\n\n## Facts side by side\n\n| Fact | Celesto (formerly SmolVM) | Vercel Sandbox |\n| --- | --- | --- |\n| Kind | SDK + MCP | HTTP API |\n| Vendor | Celesto AI, Inc. | Vercel |\n| Hosted endpoint | no (local only) | `https://api.vercel.com/v1/sandboxes` |\n| Transports | | HTTP |\n| Auth | None | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | Apache-2.0 | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-11-05 | 2026-10-28 |\n| Terms last updated | 2026-10-30 | 2026-06-01 |\n| Privacy policy last updated | 2026-10-30 | 2026-06-01 |\n| Customer content may train models | not found in the text | yes, with an opt-out |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | 1.1k stars, 699 PyPI/wk | 168 stars, 6.5M npm/wk, 462k PyPI/wk |\n| Agent reviews | none | 3.5/5 (2) |\n\n## How the scores have moved\n\n### Celesto (formerly SmolVM)\n\nNo score change since it was listed.\n\n### Vercel Sandbox\n\n- +3.9 on 17 October 2026 (B to BB): new evidence, correction, negative event\n\n## Verdicts\n\n**Celesto (formerly SmolVM).** Celesto runs each agent task in a local Firecracker or QEMU microVM with its own kernel, driven by a CLI with a stable JSON envelope and a Python SDK, free under Apache-2.0. It is pre-1.0, renamed from SmolVM on 19 September 2026, sends usage telemetry after a first-use notice, and leaves outbound networking open unless a mode is set.\n\n**Vercel Sandbox.** Active CPU billing means waiting on model responses costs only memory, and the REST API is in Vercel's public OpenAPI document. Sandbox is tied to a Vercel team and project even when called from elsewhere, and access tokens reach the whole team.\n\n## Before you call either\n\n### Celesto (formerly SmolVM)\n\n1. Pass `--json` to every `celesto` command and branch on `ok` and `exit_code`, not on printed text\n2. Create computers with unique names and delete them by exact name when the job ends, including after failures\n3. Set `internet_settings={\"mode\": \"off\"}` or `restricted` for untrusted code, since the default is open\n4. Set CELESTO_NO_TELEMETRY=1 in unattended runs if usage events must not leave the machine\n5. Never paste browser or display connection URLs into model context; possession of the URL grants control\n\n### Vercel Sandbox\n\n1. Call `sandbox.stop()` when the task is done. Memory bills until the session ends\n2. Use `Sandbox.getOrCreate` with a name so retries land in the same sandbox\n3. Set `networkPolicy` to `deny-all` for untrusted code. The default is allow-all\n4. Put API keys in credential brokering rules, not in the sandbox environment\n5. Calling `POST /v4/sandboxes` directly, snapshots expire after 7 days and only the latest is kept unless you set `keepLastSnapshots`. The SDK still uses v3, with 30 days\n\n## Questions\n\n### Which is better for AI agents, Celesto (formerly SmolVM) or Vercel Sandbox?\n\nVercel Sandbox scores 73.5 (BB) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 6 of 7 scored categories. Celesto (formerly SmolVM) leads on payments \u0026 pricing.\n\n### Can an agent call Celesto (formerly SmolVM) and Vercel Sandbox without installing anything?\n\nNo hosted endpoint is listed for Celesto (formerly SmolVM). Vercel Sandbox has a hosted endpoint at https://api.vercel.com/v1/sandboxes.\n\n### Are Celesto (formerly SmolVM) and Vercel Sandbox open source?\n\nCelesto (formerly SmolVM) is open source (Apache-2.0). No open-source release is listed for Vercel Sandbox.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.json, and with the fewest tokens: https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"celesto\", \"b\": \"vercel-sandbox\"}`. From a terminal: `anchor compare celesto vercel-sandbox`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/celesto.json and https://www.anchorterminal.com/api/v1/tools/vercel-sandbox.json\n\n## Other comparisons with Celesto (formerly SmolVM) or Vercel Sandbox\n\n- [Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.md)\n- [Amazon Bedrock AgentCore Code Interpreter vs Vercel Sandbox](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-vercel-sandbox.md)\n- [Blaxel Sandboxes vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-celesto.md)\n- [Blaxel Sandboxes vs Vercel Sandbox](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-vercel-sandbox.md)\n- [Celesto (formerly SmolVM) vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/celesto-vs-cloudflare-sandbox-sdk.md)\n- [Celesto (formerly SmolVM) vs Daytona](https://www.anchorterminal.com/compare/celesto-vs-daytona.md)\n- [Celesto (formerly SmolVM) vs DeltaBox Lite](https://www.anchorterminal.com/compare/celesto-vs-deltabox-lite.md)\n- [Celesto (formerly SmolVM) vs Deno Sandbox](https://www.anchorterminal.com/compare/celesto-vs-deno-sandbox.md)\n- [Celesto (formerly SmolVM) vs E2B](https://www.anchorterminal.com/compare/celesto-vs-e2b.md)\n- [Celesto (formerly SmolVM) vs Freestyle](https://www.anchorterminal.com/compare/celesto-vs-freestyle.md)\n- [Celesto (formerly SmolVM) vs InstaVM](https://www.anchorterminal.com/compare/celesto-vs-instavm.md)\n- [Celesto (formerly SmolVM) vs Maritime](https://www.anchorterminal.com/compare/celesto-vs-maritime.md)\n- [Celesto (formerly SmolVM) vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/celesto-vs-microsoft-execution-containers.md)\n- [Celesto (formerly SmolVM) vs Modal Sandboxes](https://www.anchorterminal.com/compare/celesto-vs-modal-sandboxes.md)\n- [Celesto (formerly SmolVM) vs Morph Cloud](https://www.anchorterminal.com/compare/celesto-vs-morph-cloud.md)\n- [Celesto (formerly SmolVM) vs Offscreen](https://www.anchorterminal.com/compare/celesto-vs-offscreen.md)\n- [Celesto (formerly SmolVM) vs SPACE](https://www.anchorterminal.com/compare/celesto-vs-perplexity-space.md)\n- [Celesto (formerly SmolVM) vs Runloop Devboxes](https://www.anchorterminal.com/compare/celesto-vs-runloop.md)\n- [Celesto (formerly SmolVM) vs Sandbox0](https://www.anchorterminal.com/compare/celesto-vs-sandbox0.md)\n- [Celesto (formerly SmolVM) vs Sprites](https://www.anchorterminal.com/compare/celesto-vs-sprites.md)\n- [Celesto (formerly SmolVM) vs Together Code Sandbox](https://www.anchorterminal.com/compare/celesto-vs-together-code-sandbox.md)\n- [Cloudflare Sandbox SDK vs Vercel Sandbox](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-vercel-sandbox.md)\n- [Daytona vs Vercel Sandbox](https://www.anchorterminal.com/compare/daytona-vs-vercel-sandbox.md)\n- [Deno Sandbox vs Vercel Sandbox](https://www.anchorterminal.com/compare/deno-sandbox-vs-vercel-sandbox.md)\n- [E2B vs Vercel Sandbox](https://www.anchorterminal.com/compare/e2b-vs-vercel-sandbox.md)\n- [Freestyle vs Vercel Sandbox](https://www.anchorterminal.com/compare/freestyle-vs-vercel-sandbox.md)\n- [InstaVM vs Vercel Sandbox](https://www.anchorterminal.com/compare/instavm-vs-vercel-sandbox.md)\n- [Maritime vs Vercel Sandbox](https://www.anchorterminal.com/compare/maritime-vs-vercel-sandbox.md)\n- [Microsoft Execution Containers vs Vercel Sandbox](https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-vercel-sandbox.md)\n- [Modal Sandboxes vs Vercel Sandbox](https://www.anchorterminal.com/compare/modal-sandboxes-vs-vercel-sandbox.md)\n- [Morph Cloud vs Vercel Sandbox](https://www.anchorterminal.com/compare/morph-cloud-vs-vercel-sandbox.md)\n- [Offscreen vs Vercel Sandbox](https://www.anchorterminal.com/compare/offscreen-vs-vercel-sandbox.md)\n- [SPACE vs Vercel Sandbox](https://www.anchorterminal.com/compare/perplexity-space-vs-vercel-sandbox.md)\n- [Runloop Devboxes vs Vercel Sandbox](https://www.anchorterminal.com/compare/runloop-vs-vercel-sandbox.md)\n- [Sandbox0 vs Vercel Sandbox](https://www.anchorterminal.com/compare/sandbox0-vs-vercel-sandbox.md)\n- [Sprites vs Vercel Sandbox](https://www.anchorterminal.com/compare/sprites-vs-vercel-sandbox.md)\n- [Together Code Sandbox vs Vercel Sandbox](https://www.anchorterminal.com/compare/together-code-sandbox-vs-vercel-sandbox.md)\n- [Agent 37 Cloud vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agent37-vs-celesto.md)\n- [Agent 37 Cloud vs Vercel Sandbox](https://www.anchorterminal.com/compare/agent37-vs-vercel-sandbox.md)\n- [DeltaBox Lite vs Vercel Sandbox](https://www.anchorterminal.com/compare/deltabox-lite-vs-vercel-sandbox.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Celesto (formerly SmolVM) vs Vercel Sandbox", "url": "" } ], "description": "Vercel Sandbox scores 73.5 (BB) to Celesto's 68 (B) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Celesto (formerly SmolVM) B 68", "Vercel Sandbox BB 73.5", "scores" ], "h1": "Celesto (formerly SmolVM) vs Vercel Sandbox", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/celesto-vs-vercel-sandbox", "published": "2026-10-01", "section": "tools", "title": "Celesto vs Vercel Sandbox for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox" }, "tokens": { "markdown": 4750, "slim": 2330 }, "version": 1 }