Baseten vs GPUsMarket

Baseten 90

Atlassian Statuspage at status.baseten.co with incident history (20). Its history pages list 27 incidents from 3 August to 1 November 2026, 7 of them labelled major, plus three scheduled database upgrades. Every one is scoped to one Model API model, one cluster or region, or a subset of models, the longest labelled major being the Kimi K3 Model API for 54 minutes on 20 September, so all read as partial and minor (20). The management API rate-limits page gives per-endpoint numbers (20 a minute for activate and deactivate, 10 a minute for retry, 30 a second for logs) and the async limit stays at 12,000 a minute per the 1 October check (15). 429 returns retry_after with an instruction to back off on it, and 529 honours Retry-After (15). A public Service Level Agreement, part of the Terms and dated 15 September 2026 in its body (15 September 2025 in the page header), commits to 99.9 per cent monthly availability for Dedicated Inference and Model APIs on Baseten-managed infrastructure, with service credits up to 40 per cent on request within 24 hours; the 1 October check missed it (10). Dedicated deployments are GA (10). 20 + 20 + 15 + 15 + 10 + 10 = 90.

GPUsMarket 33

Read with the hosted lines. No status page found; listing health is shown per listing only (0). No incident history to read (5). Rate limits published, 60 requests a minute per rental and 10 sign-ups an hour per IP (15). 429 is documented, but no Retry-After, backoff or idempotency guidance (3). The terms give no availability guarantee and put host outages on hosts (0). No beta label on the API (10). 0+5+15+3+0+10 = 33.

Baseten 82

Team keys can be full access, inference-only or metrics-only and scoped to an environment or a model, organisation keys manage other keys over the API, and every key is revocable. Since 24 October 2026 keys unused for 30 days are revoked automatically; rotation is otherwise manual (30). Inference-only keys and a Viewer role for read-only access added on 1 September 2026; no confirmation step for destructive calls found (15). Returns your own model's output, no third-party content (10). Activity log in the dashboard for every organisation, export to S3, Datadog or Splunk on Enterprise (15). Coordinated disclosure to security@baseten.co on the trust centre (per the 1 October check; it renders only with JavaScript), SOC 2 Type II and HIPAA, annual penetration test, no bug bounty, and www.baseten.co/.well-known/security.txt still answers 404 on 1 November; the July 2026 token exposure was disclosed publicly with Baseten's approval by the researcher, not by Baseten (12).

GPUsMarket 30

Account keys are all-powerful within the account, with no scopes, expiry or rotation documented, but each rental gets its own proxy token (15). The per-rental token limits inference access to one rental; no read-only key or confirmation for destructive calls (6). Peer rentals send prompts and outputs through individuals' machines, protected only by the terms, with no prompt-injection or untrusted-host guidance (2). Per-rental usage stats of requests, tokens and cost (5). No security.txt, disclosure policy, bug bounty or certification; a DPO address for breaches. The CLI and host packages are obfuscated, so they can't be audited (2). 15+6+2+5+2 = 30.

Baseten 84

A public OpenAPI 3.0 spec for the management API at api.baseten.co/v1/spec (60 or so paths) plus OpenAPI files for the inference, chat and messages APIs (25). llms.txt with a .md twin for every page (10). Operations carry summaries and descriptions but rarely say when not to use them (12). Request bodies are typed with required fields; enums are sparse (10). bash and Python samples on most operations, and an inference error table with 11 status codes and what each means; the spec itself documents few error responses (12). Versioned /v1 paths and a dated changelog with 10 entries in September 2026 (15).

GPUsMarket 52

API and MCP reading. No OpenAPI or other machine-readable contract was found, and the MCP tool schemas couldn't be read because the published package is obfuscated; the repository's history says 2.4.7 added output schemas to all 32 tools, which is the vendor's claim (8). llms.txt as a complete API reference (10). llms.txt says when to use peer or cloud rentals, the proxy or the relay, and which workload each listing type serves (12). Parameters are listed by name without types, enums or required markers, apart from instance and workload types (6). curl examples for each flow, an error code list and a sample deploy response (11). npm versions, but no public changelog (5). 8+10+12+6+11+5 = 52.

Baseten 90

A changelog entry on 30 October 2026 (mixed-mode rolling promotions) and Truss v0.18.37 tagged on 29 October (30). In the 90 days from 3 August, 13 stable Truss tags (v0.18.25 on 3 August to v0.18.37) and 31 dated changelog entries from 14 August to 30 October (20). Truss had 9 open issues, the recent ones answered within days, but a 24 August request for a private security contact had one reply and two January 2026 deployment issues sat unanswered, per the 1 October check; GitHub's pages weren't readable on 1 November (18). Truss, the Baseten CLI (v1.4.1 on 22 October) and a JavaScript client are current (15). Release workflow runs in GitHub Actions and Truss supports Python 3.9 to 3.14, but an open issue reports the npm performance client shipping without its platform dependencies since 0.0.10, per the 1 October check (7). 30 + 20 + 18 + 15 + 7 = 90.

GPUsMarket 69

gpusmarket 2.5.1 on 16 October 2026, 21 days before this check (30). Releases 2.4.18 to 2.5.1 between 17 August and 16 October, and gpusmarket-host 1.5.3 and 1.6.0 (20). Support by chat widget; the repository, which holds only a README, server.json and a licence, has no open issues and one star (5). Published in the official MCP registry under the verified io.github.jyswee namespace, though the newest registry version, 2.4.16, trails npm (12). No dependencies, but an obfuscated build and no public CI (2). 30+20+5+12+2 = 69.

Baseten 67

Hosted service is closed under clear California terms; Truss, the packaging tool, is MIT (20). The docs say inputs, outputs and weights aren't stored by default, async inputs are kept only while processing, and the privacy policy hands customer content to a published DPA; retention periods are given as 'as long as necessary' and audit-log retention is 'contact support' (22). Model API deprecations carry dates, and a published policy promises 30 days' notice, but recent notices fell short of it (8 July for 24 July, 16 days; 13 September for 25 September, 12 days). No deprecation policy for dedicated deployments found (8). Regions can be listed over the API and EU transfers use SCCs, but no subprocessor list found (8).

GPUsMarket 50

Closed, under Tyga.Cloud licences that are clear on use, but the docs call gpusmarket-host MIT open source while the package says otherwise (10). The privacy policy gives retention periods and names Stripe and MongoDB, while renter data on peer hosts falls outside its controls, which the terms disclaim (15). The terms promise 30 days' notice of material changes, with no deprecation policy or dated notices found (5). Processors partly named, with transfers under SCCs, and no host locations shown in the docs read (6). 10+15+5+6 = 36.

Baseten 40

No machine payment protocol (0). Per-minute GPU prices from $0.01052 (T4) to $0.16633 (B200) published without a login (20). New workspaces get credits and no payment method is needed until they run out, at which point models are deactivated (20). Signup is a browser flow (0).

GPUsMarket 30

No x402, MPP or L402 (0). Hourly prices for every listing and GPU type are public through the unauthenticated search and types endpoints, with a $0.50 minimum (20). No free tier; a card hold is placed on every rental (0). Sign-up and key issue are one API call with no browser, but renting needs a saved, verified card, which the docs don't show being added without a person (10). 0+20+0+10 = 30.