InstaVM vs SPACE

InstaVM 77

Hosted lines. Better Stack status page with four components, including the public API (20). The incident history shows no incidents for September, October or November 2026 (30). No rate limits with numbers found; Pro promises higher limits without figures (0). The Python SDK has a RateLimitError and an example retry loop with exponential backoff, but no 429 or Retry-After is documented, and there is no idempotency guidance (7 of 15). The terms commit to 99.9% monthly uptime with service credits, and Pro lists 99.9% (10). No beta or preview label on the API (10). Total 77.

SPACE 32

Read with the local-software lines, because an operator runs SPACE on their own hosts, as for microsoft-execution-containers. A person must deploy it before any agent can call it. No package, crate or public container image. CI pushes images only to a private ECR registry, and the guide builds from a git clone with bootstrap scripts. Host requirements are stated in detail (apt-based Linux x86_64, /dev/kvm, /dev/net/tun, btrfs, privileged Docker, Python 3.8 or later) (10 of 20). Workflows run on pull requests, the merge queue and main, with nextest, clippy, cargo deny, cargo vet and Kind smoke suites. Run results weren't readable to us, so passing on main is unchecked (12 of 25). Issues weren't readable either, because GitHub's robots.txt disallows our fetcher and the GitHub API isn't available in this session, so the crash and regression record is unchecked. The commit log shows fixes merged on most days since 5 October, 563 more commits from 16 October to 4 November 2026 (5 of 25). docs/versioning.md sets semver rules before and after 1.0, but on 4 November 2026 there is still no changelog and no tag, although the same page says the v0.8.0 tag should mark the tested commit (5 of 15). Version 0.8.0, a public baseline ahead of the last planned breaking release, 0.9.0 (0 of 15). 10+12+5+5+0 = 32.

InstaVM 20

No x402, MPP or L402 (0 of 40). Per-second vCPU, memory and storage prices are published without a login (20). The free plan's $50 credit needs a card on file (0). Signup and key minting are in a browser dashboard (0). Total 20.

SPACE 60

Read with the self-hosted rule. No x402, MPP or L402 (0 of 40). Apache-2.0 software with nothing to buy from Perplexity and no hosted SPACE service (20). Free with no card (20). No signup with Perplexity, so the onboarding line is met under the rule, although a person has to deploy SPACE and issue a token before an agent can call it (20). 0+20+20+20 = 60.

InstaVM 35

Closed service lines. The latest dated change found is Python SDK 0.26.1 on 15 July 2026, 114 days before the check, and the site changelog's only entry is 11 July (10). No SDK release in the 90 days to 6 November (0). A public changelog, support email and Discord, with no reply times seen (8 of 15). Official Python and JavaScript SDKs, last released in July and May 2026 (12 of 15). Package health of the SDK repositories was not read (5 of 10). Total 35.

SPACE 11

No release has ever been published. Version 0.8.0 has been in Cargo.toml and on the docs site since 5 October 2026, and Cargo.toml moved to 0.8.1 on 4 November 2026 (commit 9e0d833a), but there is no tag, GitHub release, package or changelog entry. Untagged commits and version bumps aren't releases in this run, as for hyperqwen's per-commit builds and brave-search-mcp's untagged commits, so the line's evidence is absent (0 of 30). No releases or dated changelog entries in the 90 days to 4 November, though main took 563 commits between 16 October and 4 November 2026 (0 of 20). Issues and pull requests weren't readable to us. 21 authors appear in the history, and CONTRIBUTING.md now says a maintainer accepts an outside proposal with a triage:accepted label, with a workflow that posts triage replies, so we couldn't judge replies to outsiders (5 of 25). No official SDK for the native API and no MCP server (0 of 15). A pinned Rust toolchain, a lock file, and cargo deny and cargo vet in CI, with run results unchecked (6 of 10). 0+0+5+0+6 = 11.

InstaVM 41

Plain API keys in a header, with API endpoints to create, list and delete them and no scopes found (20 of 30). Egress policies per session or VM can block all outbound traffic or allow named domains and CIDRs, but llms.txt describes full network access as the default (8 of 20). No guidance on untrusted output from executed code or browser sessions (3 of 15). An Audit Logs endpoint group exists in the API reference (10 of 15). No security.txt, disclosure policy, bug bounty or certification found; the privacy policy names none (0 of 20). Total 41.

SPACE 64

Graded as the API an agent calls on a deployment. Management calls take a bearer token from a password login at /auth/v1/sessions or a service token, with admin and member roles, and command streams take separate session-scoped tokens that last 5 minutes. ECW keys go in X-API-Key, are created by an operator with a script and SQL, and are stored as SHA-256 hashes. We found no key scopes or documented revocation (20 of 30). Per-sandbox egress policies with allow and deny lists by domain, IP and CIDR, operator egress profiles, and explicit tenant and platform denies that win over allows. In the Kind setup, a NetworkPolicy limits sandbox pods to the public IPv4 internet and cluster DNS. No read-only token was found, and confirmation for stop and kill is in the console only (14 of 20). Command output is untrusted content. Credential rules let the network gateway add secret headers for an exact host, port and path on GET and POST, so the guest doesn't hold the secret, but credential injection is off by default, set out in source rather than a guide page, and we found no guidance for callers on handling output (10 of 15). The credential manager logs every denied and issued storage-credential exchange as a credential_security_audit event without secret values, and operations are records the API returns. No per-call audit log for the public API was found (8 of 15). SECURITY.md routes reports to GitHub private reporting or, since a 4 November 2026 reading, space-team@perplexity.ai, with no acknowledgement time. security.txt on www.perplexity.ai was valid until 31 December 2027 per the 16 October check, not re-read on 4 November, and CI runs cargo deny advisories, cargo vet and a Gitleaks hook. Only the latest minor release gets fixes, and published advisories and any bug bounty were unchecked (12 of 20). 20+14+10+8+12 = 64.

InstaVM 51

30 operations take limit, offset, cursor or page parameters, with no field selection found (12 of 25). Listing endpoints page, with little filtering (10 of 20). The SDK maps failures to typed exceptions such as AuthenticationError, QuotaExceededError and RateLimitError, but the HTTP error bodies are undocumented (8 of 20). One operation takes an idempotency parameter, and snapshots and clones make work repeatable, with no safe-retry guidance (6 of 20). client.execute(code=..., language=...) needs two arguments, with Python and JavaScript SDKs (15). Total 51.

SPACE 66

Graded on the native API once deployed. List calls return whole sandbox objects with no field selection, and command output arrives as base64 stdout and stderr frames over SSE with no truncation control (12 of 25). Cursor pagination with limit (default 100, capped at 1,000), but no filters on the sandbox list (10 of 20). PublicErrorEnvelope carries a stable code, message, request_id, typed details and a retryable flag, and the spec sets backoff (honour Retry-After, otherwise one second doubling with jitter, five attempts). ECW returns E2B-shaped errors (19 of 20). Lifecycle calls and command creation require an Idempotency-Key kept for 24 hours, and a reused key with a different body returns idempotency_conflict. ECW command starts accept a 60-second key. Kill and signal don't deduplicate (18 of 20). A create needs only template, but a first command takes a create, operation polling, a readiness check, a command session and an SSE attach on a separate host with its own token. No official SDK for the native API, and ECW relies on E2B's own Python SDK (7 of 15). 12+10+19+18+7 = 66.

InstaVM 57

Closed service with clear terms (15). The terms and privacy policy agree on keeping code and execution logs up to one year and US storage, and the policy names Stripe, PostHog and Resend, but allows training on anonymised, aggregated data derived from user content with opt-out by email and mentions no DPA (18 of 30). No deprecation policy or notices found (0 of 20). US data location stated and three subprocessors named, cloud providers unnamed (12 of 20). Total 45.

SPACE 70

Apache-2.0 in LICENSE, copyright Perplexity AI 2026 (30). Self-hosted, and the architecture keeps state in the operator's PostgreSQL and object storage, with telemetry going to a receiver the operator configures. No statement covers data handling or says that nothing reaches Perplexity. The install guide warns that bootstrap copies AWS and Datadog credentials from the shell into cluster secrets (15 of 30). docs/versioning.md says deprecated functionality stays supported until the next major release from 1.0 and promises migration guidance before 0.9.0, and SECURITY.md fixes only the latest minor. No dated notices (12 of 20). docs/observability.md sets out every metrics and trace selector. The default auto sends to a Datadog Agent when the build includes that client, and off disables each signal (16 of 20), unchanged in the 4 November clone. 30+15+12+16 = 73.