InstaVM vs Offscreen

InstaVM 20

No x402, MPP or L402 (0 of 40). Per-second vCPU, memory and storage prices are published without a login (20). The free plan's $50 credit needs a card on file (0). Signup and key minting are in a browser dashboard (0). Total 20.

Offscreen 60

No payment protocol (0). Read with the self-hosted rule. Free under MIT with nothing to buy from the author (20). No card or account (20). Installs with one Homebrew command and needs no signup, though a person grants Local Network on the first VM job (20). Tart, which the cask installs, is under FSL-1.1-ALv2, and its licensing page says organisations above 100 host CPU cores need a paid licence. That is a cost of the dependency, named in the pricing notes, and not scored here.

InstaVM 35

Closed service lines. The latest dated change found is Python SDK 0.26.1 on 15 July 2026, 114 days before the check, and the site changelog's only entry is 11 July (10). No SDK release in the 90 days to 6 November (0). A public changelog, support email and Discord, with no reply times seen (8 of 15). Official Python and JavaScript SDKs, last released in July and May 2026 (12 of 15). Package health of the SDK repositories was not read (5 of 10). Total 35.

Offscreen 66

v0.0.5 on 16 October 2026, 17 days before this check and still the head of main (30). Five tagged releases on 15 and 16 October 2026, each published to the cask (20). All 116 commits are by the one maintainer, and pull requests #89 to #91 of 15 October are his own. Outside issues and replies couldn't be read, because GitHub's pages and API were refused to us (8 of 25, from the commit history only). Not an MCP server, no SDK, and the skill is in no registry (0). Current dependencies (Go 1.27, kong 1.14, modernc SQLite 1.60), tool versions pinned in mise.toml and lint in CI. No Dependabot configuration found (8).

InstaVM 51

30 operations take limit, offset, cursor or page parameters, with no field selection found (12 of 25). Listing endpoints page, with little filtering (10 of 20). The SDK maps failures to typed exceptions such as AuthenticationError, QuotaExceededError and RateLimitError, but the HTTP error bodies are undocumented (8 of 20). One operation takes an idempotency parameter, and snapshots and clones make work repeatable, with no safe-retry guidance (6 of 20). client.execute(code=..., language=...) needs two arguments, with Python and JavaScript SDKs (15). Total 51.

Offscreen 74

A CLI adds no tool definitions to context, and only the skill's 90-word description is always loaded. Stdout carries the wrapped command's full output, which for xcodebuild can be long, while Offscreen's phases go to stderr and are hidden when stderr isn't a terminal (18 of 25). status -a, -q, --format json and templates, logs with -f, and artifacts in one directory per job. No control over the size of the command's output (13 of 20). Exit codes separate the command's result from a queue timeout (75), an Offscreen failure (70) and a usage error (1), errors name the fix (Open it with: open -a Offscreen, the Tart install command, the Local Network setting), and a failure before the command starts repeats the last 20 lines (18). Each job starts from a fresh clone, so a rerun is clean. cancel is safe to repeat, init refuses to overwrite, check validates without a VM, and prune asks first or takes --dry-run. Attached queued jobs fail after a daemon restart, and the docs say to detach jobs that must retry safely (16 of 20). Defaults are sensible (VM lane, two slots, no timeout) and a one-off -- <cmd> needs no task. One CLI, and the daemon's socket API is internal, with no SDK (9 of 15).

InstaVM 77

Hosted lines. Better Stack status page with four components, including the public API (20). The incident history shows no incidents for September, October or November 2026 (30). No rate limits with numbers found; Pro promises higher limits without figures (0). The Python SDK has a RateLimitError and an example retry loop with exponential backoff, but no 429 or Retry-After is documented, and there is no idempotency guidance (7 of 15). The terms commit to 99.9% monthly uptime with service credits, and Pro lists 99.9% (10). No beta or preview label on the API (10). Total 77.

Offscreen 55

Read with the local-software lines, since the owner runs the CLI, daemon and app. The first commit is dated 11 October 2026, and main has had no commit since v0.0.5 on 16 October. Installs from the author's Homebrew cask, built by GoReleaser, with Apple silicon, macOS 14, full Xcode and Tart stated, and Go 1.27 for a source build (20). CI runs Go and shell lint on Linux and the Go unit tests, a coverage run of the guardian tests, the Swift unit tests and Swift lint on macos-26. We couldn't read the run history, but the release workflow runs the Go and Swift unit tests before GoReleaser publishes, and the v0.0.5 cask was pushed on 16 October from the commit that is the head of main. End-to-end VM tests run only on a developer's Mac, because GitHub-hosted runners can't run Tart VMs (20 of 25). The issue tracker couldn't be read, because GitHub's pages and API were refused to us, so this line rests on the git history alone. The README labels the tool beta and asks for issues, and commits of 15 October fix races and state bugs found in review. Scored 10 of 25 rather than as clean or as absent. Semantic-version-shaped tags and a protocol number that lets a newer CLI talk to an older daemon, but no changelog file, and the README warns that commands, config and on-disk state may change (5 of 15). Version 0.0.5, not 1.0 and labelled beta (0).

InstaVM 41

Plain API keys in a header, with API endpoints to create, list and delete them and no scopes found (20 of 30). Egress policies per session or VM can block all outbound traffic or allow named domains and CIDRs, but llms.txt describes full network access as the default (8 of 20). No guidance on untrusted output from executed code or browser sessions (3 of 15). An Audit Logs endpoint group exists in the API reference (10 of 15). No security.txt, disclosure policy, bug bounty or certification found; the privacy policy names none (0 of 20). Total 41.

Offscreen 62

No credential model to grade, since there is no account or key, so read with the framework lines as for other local agent tools. 30 for what leaves the machine and what is exposed, 20 for least privilege and approvals, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No network code or telemetry found beyond the owner-only Unix socket and SSH to the guest. Guest SSH uses the base image's admin and admin login by default, the caller's environment, which can hold secrets, is stored in SQLite while a job is active and dropped when it ends, with old copies possibly left in free pages, which the docs say. Any process that can open the socket is trusted (22 of 30). A fresh VM per job, deleted afterwards, and a VM task gets the worktree and listed products but not the host environment. The host lane is opt-in, gated on idleness, an unlocked session and camera and microphone off, with a countdown and take-back. The skill lists actions to ask the person about first. No egress or network policy for the guest is documented, the whole worktree is copied in, and [prepare] run executes on the host even for VM jobs (16 of 20). The tool returns command output and screenshots of the agent's own app, with no guidance on treating text in them as untrusted (8 of 15). Job records, logs and artifacts are kept for seven days by default, status -a lists past jobs, and the daemon and image builds keep logs (12 of 15). No SECURITY.md, security.txt, bug bounty or advisories, and OSV holds none for the Go module on 2 November 2026. The binaries and app are signed ad hoc and not notarised, and the cask strips the quarantine attribute, which the install guide states. The release workflow keeps the tap token out of cached tools and doesn't persist git credentials, and CI runs with read-only permissions (4 of 20).