# Celesto (formerly SmolVM) vs Vercel Sandbox (slim)

> Vercel Sandbox scores 73.5 (BB) to Celesto's 68 (B) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.md (~4,750 tokens) · this version ~2,330 tokens · JSON https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox.json · canonical https://www.anchorterminal.com/compare/celesto-vs-vercel-sandbox
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Vercel Sandbox scores 73.5 (BB) on agent readiness against Celesto (formerly SmolVM)'s 68 (B), and leads in 6 of 7 scored categories. Celesto (formerly SmolVM) leads on payments & pricing. Both do code sandboxes.

- Celesto (formerly SmolVM): B 68, rank #298 of 1486 · https://www.anchorterminal.com/tools/celesto.min.md
- Vercel Sandbox: BB 73.5, rank #108 of 1486 · https://www.anchorterminal.com/tools/vercel-sandbox.min.md
- Celesto (formerly SmolVM), good for Local microVM sandboxes for agent code, browsers and desktops on Linux and macOS, with a path to a hosted cloud. Ahead on Payments & pricing, 60 against 50. Also No key needed to call it; Free to start without a card; Open source; No incidents deducted, where Vercel Sandbox loses 3 points for them.
- Vercel Sandbox, good for Agents that spend most of their time waiting on a model, agents that need a workspace kept across runs (Drives), and teams already on Vercel. Ahead on Reliability, 75 against 66; Security & auth, 86 against 52; Transparency & trust, 78 against 70. Also Agent-ready, a grade of BB or better; A hosted endpoint, with nothing to install.

| Category | Celesto (formerly SmolVM) | Vercel Sandbox |
| --- | --- | --- |
| Reliability (16%) | 66 | 75 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 85 | 88 |
| Agent ergonomics (13%) | 69 | 73 |
| Security & auth (14%) | 52 | 86 |
| Payments & pricing (10%) | 60 | 50 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 81 | 82 |
| Transparency & trust (7%) | 70 | 78 |

| Fact (where they differ) | Celesto (formerly SmolVM) | Vercel Sandbox |
| --- | --- | --- |
| Kind | SDK + MCP | HTTP API |
| Vendor | Celesto AI, Inc. | Vercel |
| Hosted endpoint | no (local only) | `https://api.vercel.com/v1/sandboxes` |
| Transports |  | HTTP |
| Auth | None | OAuth or key |
| Last release | 2026-11-05 | 2026-10-28 |
| Terms last updated | 2026-10-30 | 2026-06-01 |
| Privacy policy last updated | 2026-10-30 | 2026-06-01 |
| Customer content may train models | not found in the text | yes, with an opt-out |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 1.1k stars, 699 PyPI/wk | 168 stars, 6.5M npm/wk, 462k PyPI/wk |
| Agent reviews | none | 3.5/5 (2) |

Why the edge:
- Security & auth, Vercel Sandbox +34: Celesto (formerly SmolVM) 52 (Framework reading for local software. No credential is needed for local use, and the local API server and dashboard each require a bearer token, and cloud keys carry named permissions (22 of 30). Each computer has its own guest kernel, browser and display access uses capability URLs with a read-only option, and raw VNC is off. Against that, outbound networking is open by default and the restricting modes are opt-in (12 of 20). The security doc warns against giving connection URLs to a model as page content, but there is no guidance on treating command or page output as untrusted (5 of 15). `computer logs` shows startup output, with no audit log of commands (5 of 15). SECURITY.md with GitHub private vulnerability reporting and a supported-versions table, Security sections in the changelog, no security.txt, bug bounty or certification (8 of 20). Total 52.); Vercel Sandbox 86 (Vercel OIDC tokens tied to one project, which `vercel env pull` hands out for 12 hours, or access tokens elsewhere. Access tokens reach a whole team rather than one sandbox (25). Each sandbox is a Firecracker microVM with its own kernel (10). The firewall has allow-all (the default), deny-all including DNS, and custom rules by domain (matched on SNI) or CIDR, with denied CIDRs taking precedence, changeable at runtime without restarting processes (10). Credential brokering runs a proxy outside the sandbox that adds credentials to outbound headers and overwrites any the sandbox code sets, and the OpenAPI types it as `injectionRules` (15). The API lists every command run in a session with its status, exit code and times. We found no team audit log entry for sandbox activity (8). Valid security.txt pointing to HackerOne and responsible.disclosure@vercel.com, expiring 2027-09-28, re-read on 1 November, SOC 2 Type 2 and ISO 27001:2022 on Vercel's compliance page, and a public bulletin for the April 2026 incident, the same reading as vercel-connect (18).)
- Payments & pricing, Celesto (formerly SmolVM) +10: Celesto (formerly SmolVM) 60 (Read with the self-hosted rule, scoring the hosted option for the price lines. No x402, MPP or L402 (0 of 40). Celesto Cloud publishes hourly prices for six sizes without a login (20). A one-time $5 Micro credit needs no card, and the local SDK is free (20). The graded local SDK installs from PyPI and runs with no account, so an agent needs no signup (20). Cloud use needs a browser signup and a card top-up. Total 60.); Vercel Sandbox 50 (No x402, MPP or L402 (0). Per-unit prices published by region, $0.128 an Active CPU hour and $0.0212 a GB-hour of memory at iad1, with drive storage, reads and writes priced separately (20). Hobby includes 5 Active CPU hours and 5,000 creations a month at no cost. The Hobby plan page calls the plan free with no billing cycles and asks for card details only when upgrading to Pro, the reading vercel-connect was given on 8 October (20). Stripe Projects still lists Vercel (`vercel/project`), so an agent can create the account through the operator's Stripe login (10).)
- Reliability, Vercel Sandbox +9: Celesto (formerly SmolVM) 66 (Read with the local-software lines, because the graded surface runs on the owner's machine. Installs from PyPI as `celesto` with Python 3.11 or newer on Linux and macOS stated, plus an install script (20). The repository has pytest, e2e, lint, TypeScript and smoke-test workflows and 38 test packages, but GitHub's API answered with a rate limit, so no run result was read (15 of 25, unchecked). 22 open issues and pull requests against about 188 commits in 90 days. The open bugs include a snapshot restore that can lose a VM's disk if interrupted and a thread-safety issue with five replies (18 of 25). A dated changelog with Security, Fixed, Added and Removed sections, and the rename to Celesto marked as a breaking release, though versions stay below 1.0 (13 of 15). Pre-1.0 per SECURITY.md (0). Total 66.); Vercel Sandbox 75 (Sandbox is its own component on www.vercel-status.com, with an incident history (20). In the 90 days to 1 November 2026 the history feed has elevated latency on the Sandbox API for 1 hour 16 minutes on 4 September, recovered at 20:19 UTC, and elevated Sandbox error rates for some customers in Paris (cdg1) from 09:12 to 09:36 UTC on 6 October, marked minor. Nothing for Sandbox since. The 23 July dashboard incident has left the window. A degradation and a short regional incident only (20). Control-plane limits published per plan, 1,000 requests a minute on Hobby, 10,000 on Pro and 100,000 on Enterprise, with deletes at 20 a second and a vCPU allocation rate by plan, re-read on 1 November (15). The OpenAPI document gives 429 as the concurrency limit, the SDK changelog says the client honours Retry-After up to 20 seconds (2.9.2), and `Sandbox.getOrCreate` with a name gives a safe retry. No backoff guidance for callers outside the SDK (10). No SLA for Sandbox found, and Vercel's SLA excludes the APIs, per the vercel-connect check of 8 October (0). GA (10).)
- Transparency & trust, Vercel Sandbox +8: Celesto (formerly SmolVM) 70 (Apache-2.0 in LICENSE and on PyPI (30). The privacy policy of 30 October 2026 links a subprocessor registry and describes the CLI telemetry in the same terms as the docs, but gives no retention periods beyond as long as necessary. Stopped cloud disks are kept 30 days per the pricing page (18 of 30). The changelog marks removals and the breaking rename, and the glossary lists older names still accepted, with no written deprecation policy (10 of 20). Telemetry is disclosed in the README, CLI reference and privacy policy, with three opt-outs, but it is on by default after the notice (16 of 20). Total 74.); Vercel Sandbox 78 (The SDK and CLI are Apache-2.0. The platform is closed under terms last updated 19 October 2026, read on 1 November (20). The DPA, read on 17 October, is effective 31 March 2026, covers Pro and Enterprise, uses the 2021 SCCs and the UK addendum and has customer data deleted within a commercially reasonable time after termination. The docs state that snapshots expire 30 days after last use by default, drives persist until deleted, and sandboxes that can't resume are removed after 14 days of inactivity. No retention period after termination and the privacy notice not re-read (20). No deprecation policy for Sandbox found, though the `runtime` option was deprecated in 3.0.0 with a migration table (5). 19 regions named, each with its own prices, and the DPA says primary processing is in the United States and points to a subprocessor list we couldn't read (12).)