Beam vs GPUsMarket

Beam 65

Credential model 25 of 30. Workspace API tokens can be created, rotated and revoked but carry no scopes (20), while the remote MCP server now signs in by OAuth with named scopes (beam:read, beam:credentials), refreshes tokens and lists connected clients for disconnection (30); between the two. Least privilege 10 of 20. The MCP server takes ?readonly=true and says deletions and other destructive operations require confirmation, but REST tokens and the SDK have no read-only mode, and all workspace members have the same permissions. Runs your own code and returns its output, no third-party content (10). Task, log and event history per deployment in the dashboard and API; Beam's own staff access logs are internal (10 of 15). Programme 10. A disclosure policy on the security overview and in beta9's SECURITY.md (acknowledgement within 3 business days, safe harbour) and SOC 2 Type II by Advantage Partners with the report under NDA; no bug bounty and no security.txt (404). OSV lists one advisory for beta9, CVE-2025-69820 (Moderate 6.0, path traversal in joinCleanPath, a researcher's record published 22 January 2026). beta9 replaced joinCleanPath on 16 October 2026 in d76ba79 (gateway-0.1.820), a commit that names the CVE, so it is a fixed third-party Moderate and costs nothing. The token-in-logs report of 4 August 2026 is per the 1 October check, not re-read (GitHub pages answer 403). 25 + 10 + 10 + 10 + 10 = 65.

GPUsMarket 30

Account keys are all-powerful within the account, with no scopes, expiry or rotation documented, but each rental gets its own proxy token (15). The per-rental token limits inference access to one rental; no read-only key or confirmation for destructive calls (6). Peer rentals send prompts and outputs through individuals' machines, protected only by the terms, with no prompt-injection or untrusted-host guidance (2). Per-rental usage stats of requests, tokens and cost (5). No security.txt, disclosure policy, bug bounty or certification; a DPO address for breaches. The CLI and host packages are obfuscated, so they can't be audited (2). 15+6+2+5+2 = 30.

Beam 80

beta9, the engine the hosted Beam runs on, is AGPL-3.0 and self-hostable; the hosted extras and terms are closed (25). Privacy policy dated 14 September 2026 gives retention per category (account data 90 days after deletion, application logs 30 days or 1 year on Growth, platform logs 90 days, analytics 14 months, PostHog recordings 30 days) and the security page agrees (30 days to retrieve data after termination), with a DPA (26). No deprecation policy or dated notices found; the terms promise 30 days' notice of material changes to the terms, not to the API, and the changelog stops in June 2025 (0). Subprocessor list published (AWS, Google Cloud, Stripe, Sentry, PostHog and others) and data stays in the US unless a region or pool is chosen; PostHog session replay is disclosed (20). 25 + 26 + 0 + 20 = 71.

GPUsMarket 50

Closed, under Tyga.Cloud licences that are clear on use, but the docs call gpusmarket-host MIT open source while the package says otherwise (10). The privacy policy gives retention periods and names Stripe and MongoDB, while renter data on peer hosts falls outside its controls, which the terms disclaim (15). The terms promise 30 days' notice of material changes, with no deprecation policy or dated notices found (5). Processors partly named, with transfers under SCCs, and no host locations shown in the docs read (6). 10+15+5+6 = 36.

Beam 55

Atlassian Statuspage at status.beam.cloud with API, Dashboard and Platform components plus Stripe and AWS dependencies, and history (20). Its feed, read on 4 November 2026, has no incident since 17 June 2025, but four GitHub issues opened between 25 August and 1 September 2026 reported account creation and login failing, and none reached the status page, so the record is scored as minor incidents rather than clean (20, per the 1 October reading of the issues, not re-read). No request rate limits found; the plans publish concurrency caps of 30 vCPUs and 5 GPUs on Developer and 1,000 vCPUs and 50 GPUs on Team, with unlimited API requests (5 of 15). No 429 or backoff guidance found; the retries guide asks for task code safe to run more than once, which is about Beam's own task retries, not client retries (0). No SLA; the terms say any uptime commitment applies only if set out in an Order Form (0). Endpoints, task queues, sandboxes and VMs are GA (10). 20 + 20 + 5 + 0 + 0 + 10 = 55.

GPUsMarket 33

Read with the hosted lines. No status page found; listing health is shown per listing only (0). No incident history to read (5). Rate limits published, 60 requests a minute per rental and 10 sign-ups an hour per IP (15). 429 is documented, but no Retry-After, backoff or idempotency guidance (3). The terms give no availability guarantee and put host outages on hosts (0). No beta label on the API (10). 0+5+15+3+0+10 = 33.

Beam 85

Newest dated release is the TypeScript SDK tag js/v1.1.6 on 16 October 2026, with beam-client's Python version bumped to 0.2.233 the same day in beam-cloud/beam-client (30). Tags in the 90 days from 6 August are js/v1.0.20 (15 September), cli-0.2.212 (29 September), js/v1.1.5 and js/v1.1.6 (16 October), four (20). Python versions aren't tagged and PyPI couldn't be read, so they aren't counted on their own. Responsiveness per the 1 October check, not re-read, where the sign-up reports got a staff reply but the token-in-logs issue had sat open for two months (15). Python and TypeScript SDKs are current (15). Both repositories run CI with tests on every push, results unread, and the client still declares Python 3.8, which is past end of life (5). 30 + 20 + 15 + 15 + 5 = 85.

GPUsMarket 69

gpusmarket 2.5.1 on 16 October 2026, 21 days before this check (30). Releases 2.4.18 to 2.5.1 between 17 August and 16 October, and gpusmarket-host 1.5.3 and 1.6.0 (20). Support by chat widget; the repository, which holds only a README, server.json and a licence, has no open issues and one star (5). Published in the official MCP registry under the verified io.github.jyswee namespace, though the newest registry version, 2.4.16, trails npm (12). No dependencies, but an obfuscated build and no public CI (2). 30+20+5+12+2 = 69.

Beam 20

No machine payment protocol (0). Per-second serverless GPU, CPU and sandbox prices and hourly on-demand prices published without a login (20). No free tier, as the Developer plan is now $20 a month with $20 of credits, Team $89 a month plus usage (0). Signup is a browser flow (0). 0 + 20 + 0 + 0 = 20.

GPUsMarket 30

No x402, MPP or L402 (0). Hourly prices for every listing and GPU type are public through the unauthenticated search and types endpoints, with a $0.50 minimum (20). No free tier; a card hold is placed on every rental (0). Sign-up and key issue are one API call with no browser, but renting needs a saved, verified card, which the docs don't show being added without a person (10). 0+20+0+10 = 30.

Beam 58

List endpoints for deployments and tasks take filters and a limit; objects are small (15). Filtering and limits documented, cursor behaviour isn't ('List responses may be paginated') (15). HTTP statuses on the workspace API, but the gateway's 200-with-ok: false means an agent has to read the body to spot a failure (8). No idempotency keys; functions and task queues retry 3 times by default, up to 5, with retry_for on task queues (5). Defaults are sensible (keep_warm_seconds 180 for endpoints, 10 for queues) and there are Python and TypeScript SDKs plus an official MCP server (15). 15 + 15 + 8 + 5 + 15 = 58.

GPUsMarket 50

API and MCP reading. The README counts 32 MCP tools, and the decoded package includes 16 operator admin tools besides the renter tools, with no toolsets (5). Marketplace search takes limit, offset, sort and filters for GPU, price, VRAM, model, instance and workload type (20). Status codes with a one-line meaning each, no error bodies documented (10). No idempotency key on rent or deploy; stop and destroy return a cost summary (5). Only a Node CLI, though every proxy speaks the Ollama and OpenAI formats so existing SDKs work (10). 5+20+10+5+10 = 50.