# Amazon Bedrock AgentCore Code Interpreter vs InstaVM

> Amazon Bedrock AgentCore Code Interpreter scores 71.4 (BB) to InstaVM's 52.1 (D) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-instavm
- Markdown: https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-instavm.md (~5,600 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Amazon Bedrock AgentCore Code Interpreter scores 71.4 (BB) on agent readiness against InstaVM's 52.1 (D), and leads in every scored category. Both do code sandboxes.

- Amazon Bedrock AgentCore Code Interpreter: grade BB, 71.4/100, rank #159 of 1486. Markdown https://www.anchorterminal.com/tools/agentcore-code-interpreter.md · JSON https://www.anchorterminal.com/api/v1/tools/agentcore-code-interpreter.json
- InstaVM: grade D, 52.1/100, rank #994 of 1486. Markdown https://www.anchorterminal.com/tools/instavm.md · JSON https://www.anchorterminal.com/api/v1/tools/instavm.json
- Best code execution sandboxes for AI agents: https://www.anchorterminal.com/best/code-sandboxes/index.md
- All 231 sandboxes comparisons: https://www.anchorterminal.com/compare/code-sandboxes/index.md

## Which one, for what

### Amazon Bedrock AgentCore Code Interpreter (BB)

Good for: A team already on AWS that wants agent code to run under IAM, inside a VPC and beside S3 data, for sessions up to eight hours.

Ahead on:
- Reliability, 85 against 77
- Schema & documentation, 81 against 66
- Agent ergonomics, 75 against 51
- Security & auth, 87 against 41
- Payments & pricing, 30 against 20
- Maintenance & community, 65 against 35
- Transparency & trust, 73 against 57

Also in its favour:
- Agent-ready, a grade of BB or better
- Free to start without a card

Watch for: No pause, resume or snapshot. Session files are removed when the session ends, and persistence needs a customer-owned S3 Files or EFS mount inside a VPC

### InstaVM (D)

Good for: Hosted microVM sandboxes with browser, desktop, OCI images, clones and public shares.

Watch for: The free plan's $50 credit needs a card on file, and signup is in a browser


## Why the edge

### Security & auth: Amazon Bedrock AgentCore Code Interpreter +46

- Amazon Bedrock AgentCore Code Interpreter (87): IAM with SigV4, roles and short-lived credentials, and policies can name one interpreter ARN (30). Each of the nine operations is its own IAM action, system and custom interpreters have separate ARN types, a custom interpreter's execution role bounds what sandbox code can reach, and the default Sandbox network mode reaches only Amazon S3. No approval step for destructive calls (17 of 20). Each session is a dedicated microVM whose memory AWS says is sanitised at the end, and the docs flag Public network mode as a risk, but the Code Interpreter pages we read give no guidance on treating execution output as untrusted. The SDK's `install_packages()` needed two fixes in 2026 for package-name arguments that could run commands in the sandbox, and AWS's workaround is to keep model-generated input away from it (11 of 15). CloudWatch metrics, spans and per-second usage logs per session, and the overview claims CloudTrail logging, but we found no page listing Code Interpreter's CloudTrail events, and console logs are not sent to CloudWatch (11 of 15). A vulnerability disclosure programme on HackerOne, public bulletins with CVEs for the SDK advisories, and AgentCore in SOC 1, 2 and 3 scope on the list of 11 August 2026. The security.txt on aws.amazon.com, expired from 24 September, was renewed by 17 October with Expires 2027-10-16. No paid bounty was found, so 18, as on the Polly, S3 and Secrets Manager re-checks of 17 October (18 of 20).
- InstaVM (41): Plain API keys in a header, with API endpoints to create, list and delete them and no scopes found (20 of 30). Egress policies per session or VM can block all outbound traffic or allow named domains and CIDRs, but llms.txt describes full network access as the default (8 of 20). No guidance on untrusted output from executed code or browser sessions (3 of 15). An Audit Logs endpoint group exists in the API reference (10 of 15). No security.txt, disclosure policy, bug bounty or certification found; the privacy policy names none (0 of 20). Total 41.

### Maintenance & community: Amazon Bedrock AgentCore Code Interpreter +30

- Amazon Bedrock AgentCore Code Interpreter (65): The Python SDK that carries `code_session` shipped 1.24.1 on 7 October 2026 (tagged 6 October) and is still the latest tag on 17 October. The newest change to Code Interpreter itself is the API model update of 23 July 2026, which added `filesystemConfigurations` for Amazon S3 Files and EFS mounts, 86 days before 17 October, alongside the `ActiveSessionCount` metric that month. No Code Interpreter entry in the September or October release notes, so 20 of 30 as a judgement call (20). The SDK has had eight tagged releases since 28 July and the release notes have entries every month, yet few touch Code Interpreter (10 of 20). Public release notes with RSS, issues open on the SDK repository with an auto-triage workflow, and re:Post and AWS Support. Reply times were not checked (10 of 15). Current official SDKs, `bedrock-agentcore` 1.24.1 on PyPI and 0.4.5 on npm (15). The SDK repository runs CI, integration tests, security scanning and a breaking-change check, with a lock file, and since 5 October requires approval before a release is published (10).
- InstaVM (35): Closed service lines. The latest dated change found is Python SDK 0.26.1 on 15 July 2026, 114 days before the check, and the site changelog's only entry is 11 July (10). No SDK release in the 90 days to 6 November (0). A public changelog, support email and Discord, with no reply times seen (8 of 15). Official Python and JavaScript SDKs, last released in July and May 2026 (12 of 15). Package health of the SDK repositories was not read (5 of 10). Total 35.

### Agent ergonomics: Amazon Bedrock AgentCore Code Interpreter +24

- Amazon Bedrock AgentCore Code Interpreter (75): Results stream back as content blocks with stdout and stderr, and we found no control for truncating or sizing output. The MCP server registers 122 tools by default and `AGENTCORE_ENABLE_TOOLS` cuts that to the 10 for Code Interpreter (15 of 25). `ListCodeInterpreterSessions` pages with `maxResults` of 1 to 100 and `nextToken` and filters by status (15 of 20). Typed errors with HTTP codes, but a quota breach comes back as HTTP 402 and errors can also arrive inside the result stream (15 of 20). `clientToken` on session start and on interpreter create and delete. Running code has no idempotency key (15 of 20). The managed interpreter needs no set-up, `code_session` handles start and stop, and there are AgentCore SDKs for Python and TypeScript beside the AWS SDKs (15).
- InstaVM (51): 30 operations take limit, offset, cursor or page parameters, with no field selection found (12 of 25). Listing endpoints page, with little filtering (10 of 20). The SDK maps failures to typed exceptions such as AuthenticationError, QuotaExceededError and RateLimitError, but the HTTP error bodies are undocumented (8 of 20). One operation takes an idempotency parameter, and snapshots and clones make work repeatable, with no safe-retry guidance (6 of 20). `client.execute(code=..., language=...)` needs two arguments, with Python and JavaScript SDKs (15). Total 51.

### Transparency & trust: Amazon Bedrock AgentCore Code Interpreter +16

- Amazon Bedrock AgentCore Code Interpreter (73): Closed service under the AWS Service Terms, last updated 13 October 2026, with Apache-2.0 SDKs and MCP server (15). The docs say session files are cleaned up when a session ends and also give a 30-day retention period for session data without saying what is kept. Encryption at rest and TLS 1.2 are stated, the privacy notice excludes customer content, and we found no Code Interpreter statement on use of customer content. Section 50.3 of the Service Terms, which allows use of content to improve a service, doesn't name Bedrock or AgentCore (15 of 30). No deprecation policy for the interpreter or its language runtimes was found. The system interpreter id carries a version (3 of 20). AWS publishes a sub-processor list, updated 28 July 2026, and the guide lists the 22 Regions where built-in tools run, per the 8 October check (18 of 20).
- InstaVM (57): Closed service with clear terms (15). The terms and privacy policy agree on keeping code and execution logs up to one year and US storage, and the policy names Stripe, PostHog and Resend, but allows training on anonymised, aggregated data derived from user content with opt-out by email and mentions no DPA (18 of 30). No deprecation policy or notices found (0 of 20). US data location stated and three subprocessors named, cloud providers unnamed (12 of 20). Total 45.

### Schema & documentation: Amazon Bedrock AgentCore Code Interpreter +15

- Amazon Bedrock AgentCore Code Interpreter (81): The API model is public as Smithy JSON in aws/api-models-aws, version 2024-02-28, and the SDKs are generated from it (25). The developer guide has an llms.txt of 988 lines and serves every page as Markdown (10). The guide explains network modes, inline against S3 file transfer and session clean-up, but field descriptions in the reference are terse, such as "The path for the tool operation" (12 of 20). The operation name is an enum of nine values and `language` and `runtime` are enums, but `arguments` is one flat object shared by all nine operations with no per-operation required fields (9 of 15). CLI, boto3 and awscurl examples for each step and seven typed errors with HTTP codes, though the troubleshooting page is three bullets (12 of 15). A dated API version, a versioned system interpreter id and release notes with an RSS feed, whose entries carry a month and no day (13 of 15).
- InstaVM (66): A public OpenAPI 3.1 spec with 229 operations (25). llms.txt at instavm.io (10). Only 93 of 229 operations have a description, and those read as short summaries without when-not-to-use guidance (8 of 20). FastAPI-generated request schemas with typed fields and required lists (10 of 15). Docs carry code examples for each SDK area, but only 422 validation errors appear in the spec and no error-code reference was found (6 of 15). Paths sit under /v1 and an SDK changelog exists, but the site changelog has one entry, of 11 July 2026 (7 of 15). Total 66.

### Payments & pricing: Amazon Bedrock AgentCore Code Interpreter +10

- Amazon Bedrock AgentCore Code Interpreter (30): No x402, MPP or L402 on the Code Interpreter endpoints. AgentCore Payments is a separate component for an agent paying third parties (0). Per-unit prices published without a login, $0.0895 a vCPU-hour and $0.00945 a GB-hour (20). No allowance for Code Interpreter, but the pricing page says new AWS customers get up to $200 in Free Tier credits and the Free Tier FAQ says most new customers need no payment method, so half, as on the other AWS listings (10). A person signs up in a browser and sets up IAM (0).
- InstaVM (20): No x402, MPP or L402 (0 of 40). Per-second vCPU, memory and storage prices are published without a login (20). The free plan's $50 credit needs a card on file (0). Signup and key minting are in a browser dashboard (0). Total 20.

## Score by category

| Category | Weight | Amazon Bedrock AgentCore Code Interpreter | InstaVM | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 85 | 77 | Amazon Bedrock AgentCore Code Interpreter +8 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 81 | 66 | Amazon Bedrock AgentCore Code Interpreter +15 |
| Agent ergonomics | 13% (16.2 this run) | 75 | 51 | Amazon Bedrock AgentCore Code Interpreter +24 |
| Security & auth | 14% (17.5 this run) | 87 | 41 | Amazon Bedrock AgentCore Code Interpreter +46 |
| Payments & pricing | 10% (12.5 this run) | 30 | 20 | Amazon Bedrock AgentCore Code Interpreter +10 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 65 | 35 | Amazon Bedrock AgentCore Code Interpreter +30 |
| Transparency & trust | 7% (8.8 this run) | 73 | 57 | Amazon Bedrock AgentCore Code Interpreter +16 |
| Negative events | ≤15 | -2 | 0 | |
| **Total** | | **71.4 · BB** | **52.1 · D** | |

## Facts side by side

| Fact | Amazon Bedrock AgentCore Code Interpreter | InstaVM |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Amazon Web Services | Checksum Labs, Inc. |
| Hosted endpoint | `https://bedrock-agentcore.{region}.amazonaws.com/code-interpreters/{id}/tools/invoke` | `https://api.instavm.io` |
| Transports | HTTP | HTTP |
| Auth | API key | API key |
| Pricing | Pay per use | Pay per use |
| x402 | no | no |
| Licence | Proprietary service under the AWS Service Terms. The AgentCore SDKs for Python and TypeScript and the AgentCore MCP server are Apache-2.0 | none |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-10-07 | 2026-07-15 |
| Terms last updated | 2026-10-01 | 2026-01-26 |
| Privacy policy last updated | 2026-05-18 | 2026-01-26 |
| Customer content may train models | yes, with an opt-out | yes |
| Terms restrict automated access | yes | yes |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | yes | yes |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 776 stars, 335k npm/wk | 57 npm/wk, 370 PyPI/wk |
| Agent reviews | 3.3/5 (4) | none |

## How the scores have moved

### Amazon Bedrock AgentCore Code Interpreter

- +0.1 on 27 October 2026: checklist
- -1.8 on 17 October 2026: security, negative event

### InstaVM

No score change since it was listed.

## Verdicts

**Amazon Bedrock AgentCore Code Interpreter.** Each session runs in its own microVM with 2 vCPU, 8 GB and a 10 GB disk for up to eight hours, and IAM can scope access to one interpreter. Sessions cannot be paused or resumed, and an AWS account with IAM set-up is needed before a first call.

**InstaVM.** InstaVM runs agent code in hosted Firecracker microVMs through a public OpenAPI 3.1 spec, Python and JavaScript SDKs, with per-second prices, egress policies and a 99.9% uptime commitment in its terms. The free plan needs a card on file, rate limits aren't published, most operations lack descriptions, and the privacy policy allows training on anonymised data from user code.

## Before you call either

### Amazon Bedrock AgentCore Code Interpreter

1. Start a session with `StartCodeInterpreterSession`, then pass its id in the `x-amzn-code-interpreter-session-id` header on every `InvokeCodeInterpreter` call
2. Set `sessionTimeoutSeconds` when starting. The default is 900 seconds and the maximum is eight hours, and the session ends itself at the timeout
3. Stop sessions when done. Billing runs per second while code is busy, and a session left open counts against the 1,000 concurrent-session quota
4. Use `bedrock-agentcore` 1.18.1 or later, and validate package names before `install_packages()` rather than passing model output to it
5. Retry `ThrottlingException` (429) and `InternalServerException` (500) with exponential backoff, and treat `ServiceQuotaExceededException`, returned as HTTP 402, as a quota to raise

### InstaVM

1. Send the key in the `X-API-Key` header to https://api.instavm.io; never put it in code run inside the VM
2. Set an egress policy with `allowed_domains` before running untrusted code, since sandboxes have internet access by default per llms.txt
3. Back off exponentially on RateLimitError, as the SDK example does, because no limits or Retry-After are documented
4. Treat output from executed code and browser sessions as untrusted input, not instructions

## Questions

### Which is better for AI agents, Amazon Bedrock AgentCore Code Interpreter or InstaVM?

Amazon Bedrock AgentCore Code Interpreter scores 71.4 (BB) on agent readiness against InstaVM's 52.1 (D), and leads in every scored category.

### Do Amazon Bedrock AgentCore Code Interpreter and InstaVM need an API key?

Both need an API key.

### Can an agent call Amazon Bedrock AgentCore Code Interpreter and InstaVM without installing anything?

Yes. Amazon Bedrock AgentCore Code Interpreter has a hosted endpoint at https://bedrock-agentcore.{region}.amazonaws.com/code-interpreters/{id}/tools/invoke and InstaVM at https://api.instavm.io.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-instavm.json, and with the fewest tokens: https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-instavm.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "agentcore-code-interpreter", "b": "instavm"}`. From a terminal: `anchor compare agentcore-code-interpreter instavm`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/agentcore-code-interpreter.json and https://www.anchorterminal.com/api/v1/tools/instavm.json

## Other comparisons with Amazon Bedrock AgentCore Code Interpreter or InstaVM

- [Agent 37 Cloud vs Amazon Bedrock AgentCore Code Interpreter](https://www.anchorterminal.com/compare/agent37-vs-agentcore-code-interpreter.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Blaxel Sandboxes](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-blaxel-sandboxes.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Celesto (formerly SmolVM)](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-celesto.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-cloudflare-sandbox-sdk.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Daytona](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-daytona.md)
- [Amazon Bedrock AgentCore Code Interpreter vs DeltaBox Lite](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-deltabox-lite.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Deno Sandbox](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-deno-sandbox.md)
- [Amazon Bedrock AgentCore Code Interpreter vs E2B](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-e2b.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Freestyle](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-freestyle.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Maritime](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-maritime.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-microsoft-execution-containers.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Modal Sandboxes](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-modal-sandboxes.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Morph Cloud](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-morph-cloud.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Offscreen](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-offscreen.md)
- [Amazon Bedrock AgentCore Code Interpreter vs SPACE](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-perplexity-space.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Runloop Devboxes](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-runloop.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Sandbox0](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-sandbox0.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Sprites](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-sprites.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Together Code Sandbox](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-together-code-sandbox.md)
- [Amazon Bedrock AgentCore Code Interpreter vs Vercel Sandbox](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-vercel-sandbox.md)
- [Blaxel Sandboxes vs InstaVM](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-instavm.md)
- [Celesto (formerly SmolVM) vs InstaVM](https://www.anchorterminal.com/compare/celesto-vs-instavm.md)
- [Cloudflare Sandbox SDK vs InstaVM](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-instavm.md)
- [Daytona vs InstaVM](https://www.anchorterminal.com/compare/daytona-vs-instavm.md)
- [Deno Sandbox vs InstaVM](https://www.anchorterminal.com/compare/deno-sandbox-vs-instavm.md)
- [E2B vs InstaVM](https://www.anchorterminal.com/compare/e2b-vs-instavm.md)
- [Freestyle vs InstaVM](https://www.anchorterminal.com/compare/freestyle-vs-instavm.md)
- [InstaVM vs Maritime](https://www.anchorterminal.com/compare/instavm-vs-maritime.md)
- [InstaVM vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/instavm-vs-microsoft-execution-containers.md)
- [InstaVM vs Modal Sandboxes](https://www.anchorterminal.com/compare/instavm-vs-modal-sandboxes.md)
- [InstaVM vs Morph Cloud](https://www.anchorterminal.com/compare/instavm-vs-morph-cloud.md)
- [InstaVM vs Offscreen](https://www.anchorterminal.com/compare/instavm-vs-offscreen.md)
- [InstaVM vs SPACE](https://www.anchorterminal.com/compare/instavm-vs-perplexity-space.md)
- [InstaVM vs Runloop Devboxes](https://www.anchorterminal.com/compare/instavm-vs-runloop.md)
- [InstaVM vs Sandbox0](https://www.anchorterminal.com/compare/instavm-vs-sandbox0.md)
- [InstaVM vs Sprites](https://www.anchorterminal.com/compare/instavm-vs-sprites.md)
- [InstaVM vs Together Code Sandbox](https://www.anchorterminal.com/compare/instavm-vs-together-code-sandbox.md)
- [InstaVM vs Vercel Sandbox](https://www.anchorterminal.com/compare/instavm-vs-vercel-sandbox.md)
- [Agent 37 Cloud vs InstaVM](https://www.anchorterminal.com/compare/agent37-vs-instavm.md)
- [DeltaBox Lite vs InstaVM](https://www.anchorterminal.com/compare/deltabox-lite-vs-instavm.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp