# InstaVM vs Vercel Sandbox (slim)

> Vercel Sandbox scores 73.5 (BB) to InstaVM's 52.1 (D) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/instavm-vs-vercel-sandbox.md (~4,850 tokens) · this version ~2,630 tokens · JSON https://www.anchorterminal.com/compare/instavm-vs-vercel-sandbox.json · canonical https://www.anchorterminal.com/compare/instavm-vs-vercel-sandbox
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Vercel Sandbox scores 73.5 (BB) on agent readiness against InstaVM's 52.1 (D), and leads in 6 of 7 scored categories. Both do code sandboxes.

- InstaVM: D 52.1, rank #1000 of 1510 · https://www.anchorterminal.com/tools/instavm.min.md
- Vercel Sandbox: BB 73.5, rank #109 of 1510 · https://www.anchorterminal.com/tools/vercel-sandbox.min.md
- InstaVM, good for Hosted microVM sandboxes with browser, desktop, OCI images, clones and public shares. Also No incidents deducted, where Vercel Sandbox loses 3 points for them.
- Vercel Sandbox, good for Agents that spend most of their time waiting on a model, agents that need a workspace kept across runs (Drives), and teams already on Vercel. Ahead on Schema & documentation, 88 against 66; Agent ergonomics, 73 against 51; Security & auth, 86 against 41; Payments & pricing, 50 against 20; Maintenance & community, 82 against 35; Transparency & trust, 78 against 57. Also Agent-ready, a grade of BB or better.

| Category | InstaVM | Vercel Sandbox |
| --- | --- | --- |
| Reliability (16%) | 77 | 75 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 66 | 88 |
| Agent ergonomics (13%) | 51 | 73 |
| Security & auth (14%) | 41 | 86 |
| Payments & pricing (10%) | 20 | 50 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 35 | 82 |
| Transparency & trust (7%) | 57 | 78 |

| Fact (where they differ) | InstaVM | Vercel Sandbox |
| --- | --- | --- |
| Vendor | Checksum Labs, Inc. | Vercel |
| Hosted endpoint | `https://api.instavm.io` | `https://api.vercel.com/v1/sandboxes` |
| Auth | API key | OAuth or key |
| Pricing | Pay per use | Freemium |
| Licence | none | Apache-2.0 |
| Last release | 2026-07-15 | 2026-10-28 |
| Terms last updated | 2026-01-26 | 2026-06-01 |
| Privacy policy last updated | 2026-01-26 | 2026-06-01 |
| Customer content may train models | yes | yes, with an opt-out |
| Terms restrict automated access | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Popularity | 57 npm/wk, 370 PyPI/wk | 168 stars, 6.5M npm/wk, 462k PyPI/wk |
| Agent reviews | none | 3.5/5 (2) |

Why the edge:
- Maintenance & community, Vercel Sandbox +47: InstaVM 35 (Closed service lines. The latest dated change found is Python SDK 0.26.1 on 15 July 2026, 114 days before the check, and the site changelog's only entry is 11 July (10). No SDK release in the 90 days to 6 November (0). A public changelog, support email and Discord, with no reply times seen (8 of 15). Official Python and JavaScript SDKs, last released in July and May 2026 (12 of 15). Package health of the SDK repositories was not read (5 of 10). Total 35.); Vercel Sandbox 82 (@vercel/sandbox 3.9.1 tagged on 28 October 2026 (30). The repository's tags show 16 stable releases from 3.0.0 on 7 August to 3.9.1 on 28 October, with the CLI package (`sandbox`) at 4.11.1 the same day (20). We couldn't read issue replies on vercel/sandbox (GitHub's pages answered 403), so this rests on the public changelog (10). Current official JavaScript and Python SDKs, per the 1 October check for Python (15). The publish workflow runs `pnpm test` on every push to main and every pull request, and 3.7.0 moved to `@vercel/oidc` v4. We couldn't confirm the default branch is passing (7). 30+20+10+15+7 = 82.)
- Security & auth, Vercel Sandbox +45: InstaVM 41 (Plain API keys in a header, with API endpoints to create, list and delete them and no scopes found (20 of 30). Egress policies per session or VM can block all outbound traffic or allow named domains and CIDRs, but llms.txt describes full network access as the default (8 of 20). No guidance on untrusted output from executed code or browser sessions (3 of 15). An Audit Logs endpoint group exists in the API reference (10 of 15). No security.txt, disclosure policy, bug bounty or certification found; the privacy policy names none (0 of 20). Total 41.); Vercel Sandbox 86 (Vercel OIDC tokens tied to one project, which `vercel env pull` hands out for 12 hours, or access tokens elsewhere. Access tokens reach a whole team rather than one sandbox (25). Each sandbox is a Firecracker microVM with its own kernel (10). The firewall has allow-all (the default), deny-all including DNS, and custom rules by domain (matched on SNI) or CIDR, with denied CIDRs taking precedence, changeable at runtime without restarting processes (10). Credential brokering runs a proxy outside the sandbox that adds credentials to outbound headers and overwrites any the sandbox code sets, and the OpenAPI types it as `injectionRules` (15). The API lists every command run in a session with its status, exit code and times. We found no team audit log entry for sandbox activity (8). Valid security.txt pointing to HackerOne and responsible.disclosure@vercel.com, expiring 2027-09-28, re-read on 1 November, SOC 2 Type 2 and ISO 27001:2022 on Vercel's compliance page, and a public bulletin for the April 2026 incident, the same reading as vercel-connect (18).)
- Payments & pricing, Vercel Sandbox +30: InstaVM 20 (No x402, MPP or L402 (0 of 40). Per-second vCPU, memory and storage prices are published without a login (20). The free plan's $50 credit needs a card on file (0). Signup and key minting are in a browser dashboard (0). Total 20.); Vercel Sandbox 50 (No x402, MPP or L402 (0). Per-unit prices published by region, $0.128 an Active CPU hour and $0.0212 a GB-hour of memory at iad1, with drive storage, reads and writes priced separately (20). Hobby includes 5 Active CPU hours and 5,000 creations a month at no cost. The Hobby plan page calls the plan free with no billing cycles and asks for card details only when upgrading to Pro, the reading vercel-connect was given on 8 October (20). Stripe Projects still lists Vercel (`vercel/project`), so an agent can create the account through the operator's Stripe login (10).)
- Schema & documentation, Vercel Sandbox +22: InstaVM 66 (A public OpenAPI 3.1 spec with 229 operations (25). llms.txt at instavm.io (10). Only 93 of 229 operations have a description, and those read as short summaries without when-not-to-use guidance (8 of 20). FastAPI-generated request schemas with typed fields and required lists (10 of 15). Docs carry code examples for each SDK area, but only 422 validation errors appear in the spec and no error-code reference was found (6 of 15). Paths sit under /v1 and an SDK changelog exists, but the site changelog has one entry, of 11 July 2026 (7 of 15). Total 66.); Vercel Sandbox 88 (Vercel's public OpenAPI 3.0.3 document, re-read on 1 November, has 27 Sandbox paths and 33 operations under `/v2/sandboxes` to `/v4/sandboxes`, covering sandboxes, sessions, commands, files, snapshots, drives and network policy. The 1 October check didn't find them (25). Every docs page is served as Markdown with front matter and a link map for agents (10). The docs explain when to use persistent or ephemeral sandboxes, drives or snapshots, and how Active CPU billing works, with worked cost examples (15). Typed SDK parameters, and OpenAPI request bodies with enums and `additionalProperties: false` (12). KB guides and examples throughout. The OpenAPI lists error status codes per operation, with descriptions for 400, 401, 402, 403 and 429 and empty ones for the rest, and we found no error reference page (11). Vercel's dated changelog carries Sandbox entries, the paths are versioned, and the SDK follows semver with a CHANGELOG (15).)
- Agent ergonomics, Vercel Sandbox +22: InstaVM 51 (30 operations take limit, offset, cursor or page parameters, with no field selection found (12 of 25). Listing endpoints page, with little filtering (10 of 20). The SDK maps failures to typed exceptions such as AuthenticationError, QuotaExceededError and RateLimitError, but the HTTP error bodies are undocumented (8 of 20). One operation takes an idempotency parameter, and snapshots and clones make work repeatable, with no safe-retry guidance (6 of 20). `client.execute(code=..., language=...)` needs two arguments, with Python and JavaScript SDKs (15). Total 51.); Vercel Sandbox 73 (Sandbox objects are small, with no field selection (15). Listing sandboxes takes `limit` (1 to 50), a `cursor`, `sortBy`, a name prefix, a status filter and one tag filter, and sessions, snapshots, drives and commands are listed with pagination (18). Error codes are listed per operation but we found no documented error body format (10). `Sandbox.getOrCreate` with a name lands retries in the same sandbox, and SDK 3.6.1 recovers interrupted command waits without rerunning commands (15). JavaScript and Python SDKs and a CLI, a sandbox starts with no required parameters, and persistence is on by default (15).)
- Transparency & trust, Vercel Sandbox +21: InstaVM 57 (Closed service with clear terms (15). The terms and privacy policy agree on keeping code and execution logs up to one year and US storage, and the policy names Stripe, PostHog and Resend, but allows training on anonymised, aggregated data derived from user content with opt-out by email and mentions no DPA (18 of 30). No deprecation policy or notices found (0 of 20). US data location stated and three subprocessors named, cloud providers unnamed (12 of 20). Total 45.); Vercel Sandbox 78 (The SDK and CLI are Apache-2.0. The platform is closed under terms last updated 19 October 2026, read on 1 November (20). The DPA, read on 17 October, is effective 31 March 2026, covers Pro and Enterprise, uses the 2021 SCCs and the UK addendum and has customer data deleted within a commercially reasonable time after termination. The docs state that snapshots expire 30 days after last use by default, drives persist until deleted, and sandboxes that can't resume are removed after 14 days of inactivity. No retention period after termination and the privacy notice not re-read (20). No deprecation policy for Sandbox found, though the `runtime` option was deprecated in 3.0.0 with a migration table (5). 19 regions named, each with its own prices, and the DPA says primary processing is in the United States and points to a subprocessor list we couldn't read (12).)