# Cloud Run GPUs vs Vast.ai (slim)

> Cloud Run GPUs scores 68.4 (B) to Vast.ai's 56.4 (C) for compute serverless. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/cloud-run-gpus-vs-vast-ai.md (~4,700 tokens) · this version ~2,480 tokens · JSON https://www.anchorterminal.com/compare/cloud-run-gpus-vs-vast-ai.json · canonical https://www.anchorterminal.com/compare/cloud-run-gpus-vs-vast-ai
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Cloud Run GPUs scores 68.4 (B) on agent readiness against Vast.ai's 56.4 (C), and leads in 5 of 7 scored categories. Both do compute serverless.

- Cloud Run GPUs: B 68.4, rank #288 of 1486 · https://www.anchorterminal.com/tools/cloud-run-gpus.min.md
- Vast.ai: C 56.4, rank #824 of 1486 · https://www.anchorterminal.com/tools/vast-ai.min.md
- Cloud Run GPUs, good for Serving small and mid-size open models, or batch jobs, from a container that should scale to zero. Ahead on Reliability, 70 against 50; Agent ergonomics, 66 against 57; Security & auth, 78 against 70; Transparency & trust, 84 against 64. Also No incidents deducted, where Vast.ai loses 3 points for them.
- Vast.ai, good for Cost-sensitive training, batch work and self-managed inference where the agent can search listings, set a price cap and tolerate host variance or interruption.

| Category | Cloud Run GPUs | Vast.ai |
| --- | --- | --- |
| Reliability (16%) | 70 | 50 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 81 | 78 |
| Agent ergonomics (13%) | 66 | 57 |
| Security & auth (14%) | 78 | 70 |
| Payments & pricing (10%) | 20 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 80 | 81 |
| Transparency & trust (7%) | 84 | 64 |

| Fact (where they differ) | Cloud Run GPUs | Vast.ai |
| --- | --- | --- |
| Kind | Platform | HTTP API |
| Vendor | Google Cloud | Vast.ai Inc. |
| Hosted endpoint | `https://run.googleapis.com` | `https://console.vast.ai/api/v0` |
| Transports |  | HTTP |
| Auth | OAuth | API key |
| Licence | Proprietary service under the Google Cloud Platform terms. Client libraries are Apache-2.0 | Proprietary service under Vast.ai's Terms of Use Agreement. The `vastai` CLI and Python SDK on GitHub are MIT |
| llms.txt | no | yes |
| Terms last updated | 2026-09-02 | 2026-09-01 |
| Privacy policy last updated | 2026-09-28 | 2025-06-18 |
| Terms restrict automated access | not found in the text | yes |
| Terms restrict benchmarking | not found in the text | yes |
| Terms or service can change without notice | not found in the text | yes |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | none | 223 stars, 33k PyPI/wk |
| Agent reviews | none | 3/5 (4) |

Why the edge:
- Reliability, Cloud Run GPUs +20: Cloud Run GPUs 70 (Hosted reading. Google Cloud's status page with a JSON incident feed (20). In the 90 days from 8 August 2026 the feed names Cloud Run in three multi-product incidents, a service outage on 20 August (15:40 to 19:20 UTC, 27 products, global and us-west1), a network degradation in us-central1-b on 1 September and a europe-west2 disruption on 20 October. One major (10). Resource limits and GPU quota are published with numbers (3 GPUs a region by default), but no request rate for the Admin API was found on the quotas page (10). Google's client libraries retry with backoff and the Admin API takes etags, while no GPU-specific retry guidance was found (10). An SLA for GPU services, 99.95% with zonal redundancy and 99.5% without (10). GPU services generally available since 7 April 2025 (10). 20+10+10+10+10+10 = 70.); Vast.ai 50 (Graded as a hosted service. status.vast.ai is Vast.ai's own page with three components (vast, console, serverless) and 30-day bars built from roughly hourly checks, with no incident write-ups (20). The page draws its bars by script from check-log files on the same host. The 8 October count came from those files, the page's own data, which this run doesn't read (as the Docusign and SeaTable listings read their status pages' data feeds), so it's struck, and the window from 4 August to 2 November is unread (5). The page covers Vast.ai's control plane and not the independent hosts' machines. Rate limits are described as a minimum interval per endpoint and identity, re-read on 2 November, but thresholds are unpublished apart from an `x-rateLimit` value on 2 of 89 operations in the OpenAPI file (5 of 15). 429 is documented with backoff advice and the CLI retries it, but the docs say the API sets no `Retry-After` header, and there is no idempotency key for instance creation (10 of 15). No SLA found, and the terms say availability is not guaranteed (0). Instances, serverless and the REST API carry no beta label (10). 20 + 5 + 5 + 10 + 0 + 10 = 50.)
- Transparency & trust, Cloud Run GPUs +20: Cloud Run GPUs 84 (Closed service under the Google Cloud terms, with Apache-2.0 client libraries (15). The Cloud Data Processing Addendum and the privacy notice cover customer data, per the Document AI listing's 1 November reading; no Cloud Run statement on GPU instance data after shutdown was found (22). The Cloud terms promise 12 months' notice before a backwards-incompatible API change, and driver versions are announced in the release notes (16). Regions per GPU type listed, with Google's subprocessor list and data-location terms (16). 15+22+16+16 = 69.); Vast.ai 64 (A closed service with an MIT CLI and SDK. The Terms of Use Agreement of 1 September 2026, re-read on 2 November, prohibits scripts and automated access to the services without a separate written agreement, which conflicts with the public API and agent tooling (17 of 30). The compliance page says data is destroyed when an instance is deleted, and the DPA allows return or deletion on written notice within 30 days of termination. The privacy policy of 18 June 2025 is written for website users, gives no retention periods, allows targeted advertising and contains an unfilled `[INSERT HYPERLINK]` placeholder (15 of 30). No deprecation policy was found, and the terms allow changes or discontinuation without notice. v0 and v1 routes coexist (3 of 20). The DPA names five sub-processors without locations and gives new ones only on request. Host location is shown per listing and can be filtered (10 of 20). 17 + 15 + 3 + 10 = 45.)
- Agent ergonomics, Cloud Run GPUs +9: Cloud Run GPUs 66 (Platform reading. One `gcloud run deploy` with `--gpu` and `--gpu-type` adds a GPU to a container, and responses carry the service object with `fieldMask` on updates (15). List calls page with `pageSize` and `pageToken` (15). Google's status codes and messages, with quota errors that name the limit (12). Revisions are immutable, traffic can be moved back, and etags guard updates, but no idempotency key on create (12). Client libraries in many languages and gcloud, though a GPU deploy needs instance-based billing, minimum CPU and memory and, past 3 GPUs, a quota request (12). 15+15+12+12+12 = 66.); Vast.ai 57 (No MCP server for account actions. The CLI skill file is about 19 KB, `--raw` returns JSON on every command, and the v1 instances route supports column selection (18 of 25). Search takes filter operators, sort fields and a price cap, and v1 instances use keyset pagination with at most 25 a page (16 of 20). The usual error body has `success`, `error` and `msg`, but some endpoints omit fields and 429 is often plain text (10 of 20). No idempotency keys were found in the OpenAPI file. The CLI retries only 429, and `vastai destroy instance` asks for confirmation unless `-y` is passed (5 of 20). Templates supply launch defaults. The only official SDK is Python, and the docs send other languages to raw REST (8 of 15). 18 + 16 + 10 + 5 + 8 = 57.)
- Security & auth, Cloud Run GPUs +8: Cloud Run GPUs 78 (OAuth 2.0 tokens from service accounts under IAM. Google's APIs accept `access_token` as a query parameter, the 10-point deduction other Google API listings take (20). IAM roles separate viewing, deploying and invoking, and services can require IAM authentication for every call (16). The platform runs your own container and returns its output (10). Cloud Audit Logs record Admin API calls, and request logs go to Cloud Logging (15). Google's vulnerability reward programme, security.txt and certifications (17). 20+16+10+15+17 = 78.); Vast.ai 70 (Keys can be scoped to 11 permission categories and narrowed by constraints to resource IDs, are shown once, and can be reset or deleted with immediate effect (30). The rate-limit page, re-read on 2 November, names an `api_key` query parameter as part of a caller's identity while the authentication page shows only the Bearer header. We took 5 of the checklist's 10 points for a key that can travel in a URL, a judgement call because the option is acknowledged but not taught (25 of 30). Read-only categories and per-instance constraints exist. The CLI confirms a destroy, and Vast.ai's auth.md asks agents to confirm paid or destructive actions, but nothing on the server enforces approval and default keys have full access (15 of 20). The service runs the customer's own containers and returns their logs (10). `vastai show audit-logs` returns account action history. Its retention and fields were not reviewed (10 of 15). A vulnerability disclosure policy dated 23 July 2025, re-read on 2 November, has safe harbour, triage within 5 business days and security@vast.ai. Its bounty is discretionary, which this checklist doesn't count. The compliance page states SOC 2 Type 2 and makes a SOC 3 report available on request. There is no security.txt (404 on 2 November) and no advisories for `vastai` in OSV, and the security FAQ says individual hosts may have less formal security. A reporting route and SOC 2 with no counted bounty take 10, as Sinch's messaging listing (10 of 20). 25 + 15 + 10 + 10 + 10 = 70.)