Cloud Run GPUs vs Thunder Compute

Cloud Run GPUs 78

OAuth 2.0 tokens from service accounts under IAM. Google's APIs accept access_token as a query parameter, the 10-point deduction other Google API listings take (20). IAM roles separate viewing, deploying and invoking, and services can require IAM authentication for every call (16). The platform runs your own container and returns its output (10). Cloud Audit Logs record Admin API calls, and request logs go to Cloud Logging (15). Google's vulnerability reward programme, security.txt and certifications (17). 20+16+10+15+17 = 78.

Thunder Compute 51

The MCP server uses OAuth 2.0 with discovery, refresh tokens and ten scopes that separate read from write for instances, snapshots and sandboxes. The REST API uses named API tokens that are created and revoked one at a time, with no scopes found. No secret travels in a URL (25 of 30). Read scopes exist, and the CLI requires --yes to delete without a prompt. No confirmation step for delete_instance or delete_snapshot was found in the MCP docs, and both are described as irreversible (8 of 20). Responses are infrastructure metadata, except run_command output and sandbox logs, with no guidance found on untrusted output (8 of 15). GET /tokens returns creation and last-used times and sandbox logs are listed by API. No audit log was found (4 of 15). No security.txt, disclosure policy or bug bounty was found. llms.txt states SOC 2 Type II and GDPR compliance with no report or trust page linked, and the DPA promises an audit summary on written request and incident notice within 72 hours (6 of 20). The site readings are per the 9 October check, not re-read on 4 November. 25+8+8+4+6 = 51.

Cloud Run GPUs 66

Platform reading. One gcloud run deploy with --gpu and --gpu-type adds a GPU to a container, and responses carry the service object with fieldMask on updates (15). List calls page with pageSize and pageToken (15). Google's status codes and messages, with quota errors that name the limit (12). Revisions are immutable, traffic can be moved back, and etags guard updates, but no idempotency key on create (12). Client libraries in many languages and gcloud, though a GPU deploy needs instance-based billing, minimum CPU and memory and, past 3 GPUs, a quota request (12). 15+15+12+12+12 = 66.

Thunder Compute 48

No field selection, and GET /instances/list returns every instance in one map. The MCP server has 28 tools in one set, with no toolsets found (12 of 25). limit up to 100, page_token and a status filter on sandboxes and sandbox logs. No pagination on instances, snapshots or keys (8 of 20). Errors carry a numeric code, a string error such as invalid_request and a message, documented per operation (14 of 20). Duplicate SSH keys are a no-op and port changes are deduplicated in one transaction, but create calls have no idempotency key. MCP tool annotations were not read (7 of 20). A create call needs five fields. The official Python SDK covers sandboxes only, and the Go CLI covers instances (7 of 15). All of this is per the 9 October check, not re-read on 4 November. 12+8+14+7+7 = 48.

Cloud Run GPUs 84

Closed service under the Google Cloud terms, with Apache-2.0 client libraries (15). The Cloud Data Processing Addendum and the privacy notice cover customer data, per the Document AI listing's 1 November reading; no Cloud Run statement on GPU instance data after shutdown was found (22). The Cloud terms promise 12 months' notice before a backwards-incompatible API change, and driver versions are announced in the release notes (16). Regions per GPU type listed, with Google's subprocessor list and data-location terms (16). 15+22+16+16 = 69.

Thunder Compute 66

Closed service under Terms and Conditions dated 28 September 2026 and Delaware law. The CLI is MIT. The OpenAPI document names Apache 2.0 and a placeholder terms address (15 of 30). The privacy policy of 28 September 2026 says instance data is not used to train AI models, the terms say instance data may be deleted 60 days after the account was last active, and a DPA is published. The sub-processor list names Firebase for sign-in while the MCP docs name Stytch, and the FAQ says instances are EC2 while the list names Azure (18 of 30). No deprecation policy. The terms allow changes without notice, and the billing docs say rates can change without notice. Legacy endpoints are marked as retained for compatibility (6 of 20). Five sub-processors with locations are listed and the DPA sets 10 business days' notice of changes. The list is dated 27 August 2025 and omits Stytch and Sentry, which the MCP docs and the CLI source name (12 of 20). The site readings are per the 9 October check, not re-read on 4 November. 15+18+6+12 = 51.

Cloud Run GPUs 81

API reading. A public Discovery document for the Cloud Run Admin API v2 (25). No llms.txt; Google's docs answer Markdown only at an unlinked .md.txt address, read as half, as for the Document AI listing (5). The GPU page says when to turn zonal redundancy on or off and the best-practices page when to bake models into images or load them from Cloud Storage (16). The GPU type is a free string in a node selector, with CPU and memory minimums stated in prose (9). gcloud, YAML, Terraform and console steps on each page, and errors follow Google's status model with no Cloud Run GPU error list (11). Versioned API (v1 and v2) and dated release notes (15). 25+5+16+9+11+15 = 81.

Thunder Compute 70

Public OpenAPI 3.1 document at api.thundercompute.com:8443/openapi.json with 41 operations and 72 schemas (25). llms.txt, llms-full.txt and a Markdown copy of every docs page (10). 28 of 41 operations have a description. Instance operations state side effects such as the private key being returned once, while most sandbox operations have a summary only (12 of 20). Required fields are marked, but the document has six enums, gpu_type and template are free strings and the instance list is a map keyed by ID (8 of 15). 12 examples and one error schema with code, error and message. Most operations document 400, 401 and 500, and none documents 429 (9 of 15). /v1 and /v2 paths, with legacy endpoints and the mode field marked as retained or deprecated. No API changelog was found. The CLI has a dated one (6 of 15). No published copy of the MCP tool definitions was found, so they were not read. All of this is per the 9 October check, not re-read on 4 November. 25+10+12+8+9+6 = 70.

Cloud Run GPUs 70

Hosted reading. Google Cloud's status page with a JSON incident feed (20). In the 90 days from 8 August 2026 the feed names Cloud Run in three multi-product incidents, a service outage on 20 August (15:40 to 19:20 UTC, 27 products, global and us-west1), a network degradation in us-central1-b on 1 September and a europe-west2 disruption on 20 October. One major (10). Resource limits and GPU quota are published with numbers (3 GPUs a region by default), but no request rate for the Admin API was found on the quotas page (10). Google's client libraries retry with backoff and the Admin API takes etags, while no GPU-specific retry guidance was found (10). An SLA for GPU services, 99.95% with zonal redundancy and 99.5% without (10). GPU services generally available since 7 April 2025 (10). 20+10+10+10+10+10 = 70.

Thunder Compute 65

Graded on the hosted lines for the REST API and the hosted MCP server. Thunder Compute's terms bar robots, scrapers and data-gathering tools on the Services, so its site, status page and API host weren't requested on 4 November and the readings below are per the 9 October check, not re-read on 4 November. Status page on incident.io at status.thundercompute.com with Website, API and Instances components and monthly history (20). No incidents listed for July to 9 October 2026. The rest of the window is unread and not credited, so the line keeps its recorded award (30). No rate limits with numbers were found in the docs or the OpenAPI document (0). No 429 or retry guidance in the docs. The CLI source reads a Retry-After header on errors, adding a duplicate SSH key is a no-op and port updates are atomic, but instance creation has no idempotency key (5 of 15, a partial value kept and flagged). No SLA found, and the terms say availability is not guaranteed (0). The API and MCP server carry no beta label (10). 20+30+0+5+0+10 = 65.