Agent 37 Cloud vs InstaVM

Agent 37 Cloud 65

Scored on the closed-service scale. The newest template image tag is b2b-hermes/2026.11.01a (Hermes v0.22.5), four days before the check (30). The repository holds 77 dated image tags for the API's system templates (14 more are for the Personal Agents app), on 16 days from 2 October to 1 November 2026, each pushed by the publish script for a commit that names the change (20). No public changelog. Support is by email, a dashboard chat and a founder's booking link, and we couldn't read GitHub issues (5 of 15). No SDK library. The agent37 CLI on npm was at 0.4.0 per the 8 October check, not re-read on 5 November, and langchain-agent37 0.1.0 was tagged on 26 October (5 of 15). The templates repository has a test workflow, whose results we couldn't read (5 of 10). Total 65.

InstaVM 35

Closed service lines. The latest dated change found is Python SDK 0.26.1 on 15 July 2026, 114 days before the check, and the site changelog's only entry is 11 July (10). No SDK release in the 90 days to 6 November (0). A public changelog, support email and Discord, with no reply times seen (8 of 15). Official Python and JavaScript SDKs, last released in July and May 2026 (12 of 15). Package health of the SDK repositories was not read (5 of 10). Total 35.

Agent 37 Cloud 57

Graded as a hosted service. A Better Stack status page now answers at status.agent37.com, with components for the website and dashboard, the API, sandbox creation, sandbox URLs and three regions (20). It did not exist on 8 October, when the host answered 404, so the record is short. Its feed lists two incidents, both partial: on 20 October fewer than 1 per cent of US sandboxes restarted (21 minutes degraded), and on 29 October some sandbox creations failed from 14:55 to 16:00 UTC while running sandboxes were not affected. A short record with minor incidents only (15). No request rate limits are published. The only numbers are one on-demand backup per instance every 15 minutes, three concurrent template builds and 20 feedback reports a day (0). Retry guidance is written per code, with backoff for try_again, no_capacity and 429, a Retry-After header on the backup limit, an idempotency key on budget top-ups and a warning that a timed-out exec keeps running, but instance create and exec take no idempotency key (12 of 15). The terms promise no uptime level unless agreed in writing (0). The Cloud API carries no beta label (10). Total 57.

InstaVM 77

Hosted lines. Better Stack status page with four components, including the public API (20). The incident history shows no incidents for September, October or November 2026 (30). No rate limits with numbers found; Pro promises higher limits without figures (0). The Python SDK has a RateLimitError and an example retry loop with exponential backoff, but no 429 or Retry-After is documented, and there is no idempotency guidance (7 of 15). The terms commit to 99.9% monthly uptime with service credits, and Pro lists 99.9% (10). No beta or preview label on the API (10). Total 77.

Agent 37 Cloud 30

No x402, MPP or L402 on the API (0). Per-unit prices for vCPU, memory and disk are published without login (20). The one-time $5 credit is granted only after a card is added in the dashboard, and accounts created by API get no credit, so there is no free tier without a card (0). POST /v1/signup, unauthenticated, now creates a workspace and returns a full API key and a Stripe Checkout link, and POST /v1/billing/top-up mints further links. Nothing runs until someone pays that link, so a person completes the step that makes access useful (10 of 20). Total 30.

InstaVM 20

No x402, MPP or L402 (0 of 40). Per-second vCPU, memory and storage prices are published without a login (20). The free plan's $50 credit needs a card on file (0). Signup and key minting are in a browser dashboard (0). Total 20.

Agent 37 Cloud 57

No OpenAPI or other machine-readable contract is shown or linked, and the 794 KB llms-full.txt never mentions one (0). llms.txt now lists 84 pages, with llms-full.txt and a Markdown copy of every page (10). Pages say what each call is for and when to choose another, such as stop against delete, resize against fork and exec for anything unwrapped (17). Parameters are documented with types, ranges, defaults and patterns in prose, with no schema to validate against (10). Curl, Python and JavaScript examples with responses on each page, and an error reference for the Hosting API, transport failures and the Agent API (15). The path is versioned at /v1 and template images carry immutable dated tags, but no public changelog was found (5). Total 57.

InstaVM 66

A public OpenAPI 3.1 spec with 229 operations (25). llms.txt at instavm.io (10). Only 93 of 229 operations have a description, and those read as short summaries without when-not-to-use guidance (8 of 20). FastAPI-generated request schemas with typed fields and required lists (10 of 15). Docs carry code examples for each SDK area, but only 422 validation errors appear in the spec and no error-code reference was found (6 of 15). Paths sit under /v1 and an SDK changelog exists, but the site changelog has one entry, of 11 July 2026 (7 of 15). Total 66.

Agent 37 Cloud 60

Exec output is capped at 512 KB a stream with a truncated flag, logs take a tail and chat can return one JSON body instead of a stream, but there is no field selection and GET /v1/instances returns every full object (12). No pagination or filters were found on the instance, session or file lists. Usage and metrics take date or hour windows (8). Errors carry stable codes, with param, hint and response_id on the Agent API and a remedy per code (20). An idempotency key on budget top-ups, X-Expected-Mtime and overwrite=false on file writes and documented safe retries, with none on create or exec (12). An empty create body works and every field is optional. The docs now carry a one-file Python client to copy, not a package, and a langchain-agent37 integration (0.1.0, 26 October), beside the CLI and raw HTTP examples (8). Total 60.

InstaVM 51

30 operations take limit, offset, cursor or page parameters, with no field selection found (12 of 25). Listing endpoints page, with little filtering (10 of 20). The SDK maps failures to typed exceptions such as AuthenticationError, QuotaExceededError and RateLimitError, but the HTTP error bodies are undocumented (8 of 20). One operation takes an idempotency parameter, and snapshots and clones make work repeatable, with no safe-retry guidance (6 of 20). client.execute(code=..., language=...) needs two arguments, with Python and JavaScript SDKs (15). Total 51.

Agent 37 Cloud 48

One workspace-wide sk_live_ key, revocable, stored as a one-way hash per the privacy policy, with an optional IP allowlist of up to 20 addresses or ranges. No scopes were found, and the docs say no endpoint mints further keys (20). Signed URLs carry an expiring token in the query string for browser access. We don't deduct for that, as with presigned URLs elsewhere, but the token can't be revoked and can last seven days. No read-only keys and no confirmation on delete or restore. Exec runs as the image user unless root is requested, each instance has a managed-spend cap, and an agent has no route to open a public port (8). The agent returns untrusted content. The docs warn about serving agent-written files inline and about empty channel allowlists, and the vendor says sandboxes run under gVisor with egress limited to the public internet (10). A usage endpoint breaks spend down by instance and model, and container logs are readable, but no audit log of API calls was found (5). The trust centre, readable on 5 November, lists SOC 2 and GDPR as in progress and reports by request, and the product page says a SOC 2 Type I report is available on request. No security.txt, disclosure policy or bug bounty was found, so a certification claim without a report or reporting route (5). Total 48.

InstaVM 41

Plain API keys in a header, with API endpoints to create, list and delete them and no scopes found (20 of 30). Egress policies per session or VM can block all outbound traffic or allow named domains and CIDRs, but llms.txt describes full network access as the default (8 of 20). No guidance on untrusted output from executed code or browser sessions (3 of 15). An Audit Logs endpoint group exists in the API reference (10 of 15). No security.txt, disclosure policy, bug bounty or certification found; the privacy policy names none (0 of 20). Total 41.