InstaVM vs Sprites

InstaVM 35

Closed service lines. The latest dated change found is Python SDK 0.26.1 on 15 July 2026, 114 days before the check, and the site changelog's only entry is 11 July (10). No SDK release in the 90 days to 6 November (0). A public changelog, support email and Discord, with no reply times seen (8 of 15). Official Python and JavaScript SDKs, last released in July and May 2026 (12 of 15). Package health of the SDK repositories was not read (5 of 10). Total 35.

Sprites 80

@fly/sprites v0.2.4 and sprites-go v0.2.2 on 20 October 2026, 15 days ago, each with a code fix (HTTP exec exit frames; directory stat and connection diagnostics) (30). Since 6 August, tags v0.2.1 to v0.2.4 of the JavaScript SDK, v0.5.1 to v0.7.2 of sprites-py, v0.1.1 to v0.2.2 of the Go SDK and v0.2.1 to v0.2.4 of the Elixir SDK, many more than three even at half (20). No product changelog was found. Support is the community forum below the Hero plan and email above it. Issue response on GitHub was not read (7). Current official SDKs for JavaScript, Go, Python and Elixir (15). All four SDK repositories run a checks workflow in CI and take dependency updates. The JavaScript SDK requires Node.js 24 or later (8). 30 + 20 + 7 + 15 + 8 = 80.

InstaVM 41

Plain API keys in a header, with API endpoints to create, list and delete them and no scopes found (20 of 30). Egress policies per session or VM can block all outbound traffic or allow named domains and CIDRs, but llms.txt describes full network access as the default (8 of 20). No guidance on untrusted output from executed code or browser sessions (3 of 15). An Audit Logs endpoint group exists in the API reference (10 of 15). No security.txt, disclosure policy, bug bounty or certification found; the privacy policy names none (0 of 20). Total 41.

Sprites 61

Bearer tokens are created and removed at sprites.dev/account per organisation, with no scopes found. The MCP connector uses OAuth, and its default token can only create a capped number of Sprites under a name prefix (22). Sprite URLs are private by default, Connectors deny by default and can limit provider paths, and a privileges policy can drop capabilities. The network allowlist is opt-in, so egress is open by default (15). Connectors keep provider credentials out of the Sprite and the MCP page describes what its tools can destroy. No prompt-injection guidance was found (9). No audit log of API calls was found in the reviewed documentation (0). fly.io now publishes a security.txt (Contact security@fly.io, Expires 2027-10-22, Policy docs.fly.io/security), and the policy says reports are acknowledged within 3 business days. SOC 2 Type 2 and named third-party penetration testers. No bug bounty, which the policy confirms, and no advisories for the Sprites SDKs in OSV (15; was 13). 22 + 15 + 9 + 0 + 15 = 61.

InstaVM 20

No x402, MPP or L402 (0 of 40). Per-second vCPU, memory and storage prices are published without a login (20). The free plan's $50 credit needs a card on file (0). Signup and key minting are in a browser dashboard (0). Total 20.

Sprites 40

No x402, MPP or L402 (0). Unit prices are public without a login, $0.0385 a CPU-hour, $0.021875 a GB-hour of memory, $0.000683 a GB-hour of hot storage and $0.000027 a GB-hour of cold storage (20). The product page and the pricing page now say every new user gets a $1 free trial with no credit card, invoices under $5 are waived, and new organisations get a $30 trial credit (20; was 10). A person signs up with a Fly.io account in a browser and creates the token (0). 0 + 20 + 20 + 0 = 40.

InstaVM 51

30 operations take limit, offset, cursor or page parameters, with no field selection found (12 of 25). Listing endpoints page, with little filtering (10 of 20). The SDK maps failures to typed exceptions such as AuthenticationError, QuotaExceededError and RateLimitError, but the HTTP error bodies are undocumented (8 of 20). One operation takes an idempotency parameter, and snapshots and clones make work repeatable, with no safe-retry guidance (6 of 20). client.execute(code=..., language=...) needs two arguments, with Python and JavaScript SDKs (15). Total 51.

Sprites 68

List calls take max_results, and service logs take lines and duration. Exec returns command output directly, with a WebSocket route for streaming (17). Sprite lists page with continuation_token and filter by prefix (16). Status codes are listed per operation and the SDKs raise typed errors with a machine code, but no code list is published (10). No idempotency keys. Service creation is a PUT by name and Sprite names are unique per organisation, and the hosted MCP server marks tools as read-only or destructive (10). Creating a Sprite needs only a name, and there are official SDKs in four languages and a CLI (15).

InstaVM 57

Closed service with clear terms (15). The terms and privacy policy agree on keeping code and execution logs up to one year and US storage, and the policy names Stripe, PostHog and Resend, but allows training on anonymised, aggregated data derived from user content with opt-out by email and mentions no DPA (18 of 30). No deprecation policy or notices found (0 of 20). US data location stated and three subprocessors named, cloud providers unnamed (12 of 20). Total 45.

Sprites 66

The SDKs are MIT and the platform is closed under terms of service effective 29 April 2026 (18). The privacy statement, effective 24 September 2026, keeps account data while the account is active and analytics data for at most 12 months. A pre-signed DPA is available on request. The terms grant Fly.io a licence to use customer data to run and improve the services. No retention period for Sprite data after deletion was found beyond the docs calling destruction permanent (18). No deprecation policy was found. The maintenance page says Sprites on Ubuntu 25.04 must upgrade, without a date (3). A sub-processor list of 34 vendors with countries and a dated change log, last updated 24 September 2026, names Tigris for Sprites object storage. The docs do not say which region a Sprite runs in (15). The four SDKs send coarse client-signal headers (interactive, CI or agent detection) by default; their READMEs disclose this and give the SPRITES_CLIENT_SIGNALS=0 opt-out, so no deduction. 18 + 18 + 3 + 15 = 54.

InstaVM 66

A public OpenAPI 3.1 spec with 229 operations (25). llms.txt at instavm.io (10). Only 93 of 229 operations have a description, and those read as short summaries without when-not-to-use guidance (8 of 20). FastAPI-generated request schemas with typed fields and required lists (10 of 15). Docs carry code examples for each SDK area, but only 422 validation errors appear in the spec and no error-code reference was found (6 of 15). Paths sit under /v1 and an SDK changelog exists, but the site changelog has one entry, of 11 July 2026 (7 of 15). Total 66.

Sprites 74

A public OpenAPI 3.1 document with 44 operations and 59 schemas, plus an AsyncAPI file for the WebSocket calls (25). llms.txt and a Markdown copy of every docs page (10). Concept pages say when to use Services, Tasks and checkpoints and when not to, while operation descriptions are one line each (15). Request bodies have required fields and examples, but the document has 6 enums and no schema for error bodies (10). 116 examples in the OpenAPI document. Error responses are a status code and a short phrase, and the product page's create and exec examples disagree with the OpenAPI document (8). Paths are versioned under /v1. No API changelog was found, and only the Python SDK keeps a changelog file (6).