hermetic is free, and it has no hosted service to pay for. Everything it builds lives in your AWS account and bills there at AWS's own prices. The fixed part of a fleet stays close to zero, so the bill follows the agents you run and the size you give each one.
us-east-1 on-demand list prices, rounded. hermetic makes no Cost Explorer call; your bill is whatever AWS says it is.
Six lines, and only some of them grow with the fleet. All of them except hermetic land on your AWS invoice, or with a model provider you pick.
MIT licensed. The app and the CLI run on your laptop and talk to AWS directly, so there is no subscription and no per-agent fee.
One CloudFormation stack per fleet. Its tables bill per request, its bucket holds a few builds, and S3 and DynamoDB traffic goes through gateway endpoints. In the default network mode nothing in it runs all the time.
One EC2 instance per agent, on Arm (Graviton). It bills by the hour while it runs, from $7 to $2,752 a month on CPU sizes, and nothing for compute while it is stopped.
Per GiB-month of gp3: a 20 GiB root volume and a 100 GiB data volume by default, both sizeable per agent. The data volume holds the agent's memory and bills whether the machine runs or not. Seven daily snapshots are kept.
Per running agent in the default public mode: AWS bills each public IPv4 address, and a stopped agent gives its address back. A fleet in nat mode pays for one small NAT instance and one Elastic IP instead.
The default provider is Amazon Bedrock, reached through the fleet's own role and billed on your AWS invoice. A provider profile can point agents at Anthropic, OpenRouter or another provider instead, billed by them.
A running agent pays for its machine, its disks and its address. Stop it and only the disks keep billing, with its memory intact for the next start. The smallest agent here also takes the smallest data volume hermetic will create, 8 GiB. Model usage comes on top and depends on what you ask the agent to do.
| Per month | Running | Stopped |
|---|---|---|
| t4g.2xlarge instance | $196 | $0 |
| 20 GiB root volume | $1.60 | $1.60 |
| 100 GiB data volume (memory) | $8 | $8 |
| Public IPv4 address | $3.65 | $0 |
| Total, before model usage | $209 | $9.60 |
| Per month | Running | Stopped |
|---|---|---|
| t4g.micro instance | $7 | $0 |
| 20 GiB root volume | $1.60 | $1.60 |
| 8 GiB data volume (memory) | $0.64 | $0.64 |
| Public IPv4 address | $3.65 | $0 |
| Total, before model usage | $12.89 | $2.24 |
Every agent in a fleet picks its own size, so a light chat agent and a GPU agent can sit side by side. Set the fleet's default with hermetic settings set --size. Change one agent with hermetic agent set --size and a recreate, which keeps its memory. --instance-type takes any other Arm instance type.
| Size | Instance | vCPU | RAM | ≈ / month | Fits |
|---|---|---|---|---|---|
| micro | t4g.micro | 2 | 1 GiB | $7 | Tiny tasks and lightweight API workers |
| xxsmall | t4g.small | 2 | 2 GiB | $14 | Lightweight CLI and automation tasks |
| xsmall | t4g.medium | 2 | 4 GiB | $28 | Small, burstable browser-free agents |
| small | r8g.large | 2 | 16 GiB | $86 | No-browser agents: chat, API, tool-calling |
| medium | t4g.2xlarge | 8 | 32 GiB | $196 | The default. Hermes, a headed browser and a virtual display, with headroom |
| large | r8g.2xlarge | 8 | 64 GiB | $344 | Large contexts, multiple browser profiles, heavy local tooling |
| xlarge | r8g.4xlarge | 16 | 128 GiB | $688 | Parallel browser sessions and memory-heavy tooling |
| xxlarge | r8g.8xlarge | 32 | 256 GiB | $1,376 | Large concurrent workloads and local data processing |
| 3xlarge | r8g.16xlarge | 64 | 512 GiB | $2,752 | Fleet-scale processing and very large contexts |
| Size | Instance | GPU | vCPU | RAM | ≈ / month |
|---|---|---|---|---|---|
| gpu-xsmall | g5g.xlarge | 1 × NVIDIA T4G, 16 GiB | 4 | 8 GiB | $307 |
| gpu-small | g5g.2xlarge | 1 × NVIDIA T4G, 16 GiB | 8 | 16 GiB | $406 |
| gpu-medium | g5g.4xlarge | 1 × NVIDIA T4G, 16 GiB | 16 | 32 GiB | $604 |
| gpu-large | g5g.8xlarge | 1 × NVIDIA T4G, 16 GiB | 32 | 64 GiB | $1,002 |
| gpu-xlarge | g5g.16xlarge | 2 × NVIDIA T4G, 32 GiB | 64 | 128 GiB | $2,003 |
Running all month, compute only. Disks and the public address add about $13.25 at the defaults.
Running agents is the part you choose to pay for. The design keeps the rest small, in dollars and in the time it takes to look after a fleet.
In the default network mode there is no NAT gateway and no server left running, and the tables bill per request. A fleet with every agent stopped costs little more than its disks.
hermetic agent stop ends the machine and address charges and keeps the memory. start brings the same agent back.
Destroying an agent keeps its memory on purpose. hermetic volume ls lists every volume nothing is reading and what it costs, and agent ps mentions them too.
Old builds are pruned to three versions, foundation archives keep one previous version, and backups stop at seven days.
One upgrade moves the whole fleet to a new hermeticd, and each box installs it itself. Configuration changes roll out with a plan, without rebuilding anything.
When a fleet goes, hermetic records what it removed and what it kept, such as volumes or an Elastic IP, and which flag would have removed each one, where one exists.
The defaults suit a small fleet. Each of these can change later.
Public mode gives each agent its own address and direct tailnet connections, and is cheaper below about two agents. nat mode puts agents behind one small NAT instance with a fixed egress IP. Switch with plan network.
The default t4g size is burstable, with a 40% CPU baseline and credits billed above it. An agent that runs hot all day is cheaper on r8g.xlarge: the same 32 GiB, about $172 a month.
Root and data volumes are set per agent or as a fleet default with --root-gib and --volume-gib. Disks are the one line that bills while an agent is stopped.
Bedrock needs no key and keeps model spend on the AWS invoice. A provider profile uses your own account with another provider, so you can match model and price per agent.