InstaVM vs Runloop Devboxes

InstaVM 35

Closed service lines. The latest dated change found is Python SDK 0.26.1 on 15 July 2026, 114 days before the check, and the site changelog's only entry is 11 July (10). No SDK release in the 90 days to 6 November (0). A public changelog, support email and Discord, with no reply times seen (8 of 15). Official Python and JavaScript SDKs, last released in July and May 2026 (12 of 15). Package health of the SDK repositories was not read (5 of 10). Total 35.

Runloop Devboxes 83

SDK 3.0.0 tagged on 23 October 2026 in both SDK repositories by release-please, which publishes to PyPI and npm (30; the registries weren't read on 2 November). Six SDK releases in the 90 days from 4 August (1.29.0 to 1.32.0 in August and September, 2.0.0 on 8 October, 3.0.0 on 23 October) (20). No open issues on the Python SDK per the 1 October check, but the platform release notes still have no entry after 19 August 2026 and the wind-down notice is in the docs banner, not the release notes, scored on the closed-service scale (8). Current official Python and TypeScript SDKs (15). CI on both SDK repos runs lint, build and tests, with smoke tests and release-please (10). 30+20+8+15+10 = 83.

InstaVM 20

No x402, MPP or L402 (0 of 40). Per-second vCPU, memory and storage prices are published without a login (20). The free plan's $50 credit needs a card on file (0). Signup and key minting are in a browser dashboard (0). Total 20.

Runloop Devboxes 50

No x402, MPP or L402 (0). Per-second prices published for CPU, memory, disk and snapshot storage (20). $50 of trial credit and the trial page still says "no credit card is required to sign up" on 2 November, while the service winds down (20). Stripe Projects lists Runloop, so an agent can create the account through the operator's Stripe login, per the 1 October check (10).

InstaVM 66

A public OpenAPI 3.1 spec with 229 operations (25). llms.txt at instavm.io (10). Only 93 of 229 operations have a description, and those read as short summaries without when-not-to-use guidance (8 of 20). FastAPI-generated request schemas with typed fields and required lists (10 of 15). Docs carry code examples for each SDK area, but only 422 validation errors appear in the spec and no error-code reference was found (6 of 15). Paths sit under /v1 and an SDK changelog exists, but the site changelog has one entry, of 11 July 2026 (7 of 15). Total 66.

Runloop Devboxes 85

Public OpenAPI at docs.runloop.ai/openapi-specs/stainless-processed-openapi.json (25). llms.txt (10). The docs explain the lifecycle, what suspend keeps (disk only) and when to use blueprints or snapshots (15). Typed fields with enums for sizes from X_SMALL to XX_LARGE and for idle actions (15). Examples in the API reference, and the SDK READMEs map 400, 401, 403, 404, 422, 429 and 5xx to typed errors, but the docs have no error-body reference (10). Platform release notes jump from 21 November 2025 to 19 August 2026 and had nothing newer on 2 October, while the SDK changelogs are kept by release-please with breaking changes marked (10).

InstaVM 41

Plain API keys in a header, with API endpoints to create, list and delete them and no scopes found (20 of 30). Egress policies per session or VM can block all outbound traffic or allow named domains and CIDRs, but llms.txt describes full network access as the default (8 of 20). No guidance on untrusted output from executed code or browser sessions (3 of 15). An Audit Logs endpoint group exists in the API reference (10 of 15). No security.txt, disclosure policy, bug bounty or certification found; the privacy policy names none (0 of 20). Total 41.

Runloop Devboxes 60

Bearer API key on api.runloop.ai. We found no scopes or rotation guidance (20). Runloop's security page lists microVM isolation (10). Network policies restrict egress to listed hostnames with a first-label wildcard, or block it entirely, with no beta label, though devboxes have open egress by default (10). Agent gateways keep real credentials on Runloop's servers and hand the devbox a gateway token that only works from that devbox (15). No audit log, and no API-key or permissions page in the docs index (0). SOC 2 Type II, with the report on request. No security.txt, disclosure policy or bug bounty found (5).

InstaVM 77

Hosted lines. Better Stack status page with four components, including the public API (20). The incident history shows no incidents for September, October or November 2026 (30). No rate limits with numbers found; Pro promises higher limits without figures (0). The Python SDK has a RateLimitError and an example retry loop with exponential backoff, but no 429 or Retry-After is documented, and there is no idempotency guidance (7 of 15). The terms commit to 99.9% monthly uptime with service credits, and Pro lists 99.9% (10). No beta or preview label on the API (10). Total 77.

Runloop Devboxes 60

Status page at status.runloop.ai, now on incident.io, with component history (20). Its feed (feed.rss) and incident pages hold three incidents in the 90 days from 4 August to 2 November 2026, each marked partial outage and under an hour (a Devbox Lifecycle outage of under a minute on 3 September, Devbox Lifecycle for 29 minutes on 2 October, the Blueprint component for 40 to 44 minutes on 5 October). Minor only (20). The 28 July terminations have left the window. No published rate limits, and the docs index has no rate-limit page (0). The official SDK READMEs document 429 as RateLimitError and retry it five times with exponential backoff, retrying POSTs only on 429 and GETs also on 408, 409 and 5xx. No Retry-After or API-level retry guidance found (10). No SLA found (0). GA (10). Runloop is winding down its services, with support for existing customers through 13 November 2026, and the score reads the service as it runs until then. 20+20+0+10+0+10 = 60.

InstaVM 51

30 operations take limit, offset, cursor or page parameters, with no field selection found (12 of 25). Listing endpoints page, with little filtering (10 of 20). The SDK maps failures to typed exceptions such as AuthenticationError, QuotaExceededError and RateLimitError, but the HTTP error bodies are undocumented (8 of 20). One operation takes an idempotency parameter, and snapshots and clones make work repeatable, with no safe-retry guidance (6 of 20). client.execute(code=..., language=...) needs two arguments, with Python and JavaScript SDKs (15). Total 51.

Runloop Devboxes 66

Devbox objects are small and bounded, with no field selection (15). List calls take limit (default 20, maximum 5,000), a starting_after cursor and a status filter, and the SDKs auto-paginate (18). The SDKs raise a typed error per status code, RateLimitError for 429 among them, but there's no reference for the API's error bodies (10). No idempotency keys (the SDK's idempotency header is unset), though the SDKs only retry POSTs on 429, which keeps retries from repeating a create (8). Python and TypeScript SDKs and a CLI, an empty create body works, and keep-alive defaults to 1 hour (15).