CoreWeave vs GPUsMarket

CoreWeave 74

API access tokens are user-scoped, carry an expiry, are shown once and can be revoked in the console. They inherit the user's IAM roles and have no scopes of their own. OIDC workload identity federation is available for CKS workloads. Tokens travel in the Authorization header only (25). IAM has a Viewer and an Admin role per service, and the MCP write tools are off unless CoreWeave enables them for an organisation. There is no confirmation step, and the apply tool ignores dry_run (15). The MCP server returns log lines and documentation text, which are untrusted content, and no injection guidance was found (5). Kubernetes audit logs have a Grafana dashboard, Telemetry Relay forwards audit logs to HTTPS or S3, and support staff access is controlled and logged (15). Vulnerability disclosure policy with safe harbour, trust centre badges for SOC 2 Type II, ISO 27001, 27017 and 27018, and a security advisories page whose latest entry is July 2024. No security.txt and no bug bounty found (14).

GPUsMarket 30

Account keys are all-powerful within the account, with no scopes, expiry or rotation documented, but each rental gets its own proxy token (15). The per-rental token limits inference access to one rental; no read-only key or confirmation for destructive calls (6). Peer rentals send prompts and outputs through individuals' machines, protected only by the terms, with no prompt-injection or untrusted-host guidance (2). Per-rental usage stats of requests, tokens and cost (5). No security.txt, disclosure policy, bug bounty or certification; a DPO address for breaches. The CLI and host packages are obfuscated, so they can't be audited (2). 15+6+2+5+2 = 30.

CoreWeave 78

Closed service with published terms. They were last modified on 30 June 2022 and say they may be amended without notice (15). The terms commit to deleting customer data after account closure within a 30-day recovery period and at most 180 days, there is a data processing agreement, and the privacy policy of 24 February 2026 gives no fixed retention period for personal data (22). The changelog gives dated deprecations, for example Kubernetes v1.34 for new clusters from 16 September 2026 and operating system and driver versions from 29 July 2026, and the maintenance policy promises 24 hours' notice for critical work, though it can change without notice (14). Two sub-processors are named for CoreWeave Infrastructure with their country (Backblaze and Microsoft, both United States) and 30 days' notice of additions, and regions and availability zones are documented (20).

GPUsMarket 50

Closed, under Tyga.Cloud licences that are clear on use, but the docs call gpusmarket-host MIT open source while the package says otherwise (10). The privacy policy gives retention periods and names Stripe and MongoDB, while renter data on peer hosts falls outside its controls, which the terms disclaim (15). The terms promise 30 days' notice of material changes, with no deprecation policy or dated notices found (5). Processors partly named, with transfers under SCCs, and no host locations shown in the docs read (6). 10+15+5+6 = 36.

CoreWeave 79

OpenAPI 3.0 specs for the CKS, VPC, Object Storage, Dedicated Inference, Capacity Finder and Telemetry Relay APIs are embedded in the reference pages, and the same services are published as Protobuf on the Buf Schema Registry. The raw .yaml paths in llms.txt redirected our reader to a docs login (25). llms.txt at docs.coreweave.com and every page served as Markdown (10). Operations and MCP tools state their purpose and inputs, with few lines on when not to use them (12). Required fields are marked and the Node Pool reference lists enums, but the CKS spec has none and instance types and versions are plain strings (9). Each operation page has a curl example. Errors are one generic code, message, details shape with no per-operation codes (8). Versioned paths and a dated changelog of 168 entries since December 2024 (15).

GPUsMarket 52

API and MCP reading. No OpenAPI or other machine-readable contract was found, and the MCP tool schemas couldn't be read because the published package is obfuscated; the repository's history says 2.4.7 added output schemas to all 32 tools, which is the vendor's claim (8). llms.txt as a complete API reference (10). llms.txt says when to use peer or cloud rentals, the proxy or the relay, and which workload each listing type serves (12). Parameters are listed by name without types, enums or required markers, apart from instance and workload types (6). curl examples for each flow, an error code list and a sample deploy response (11). npm versions, but no public changelog (5). 8+10+12+6+11+5 = 52.

CoreWeave 45

Graded as a hosted service on the CKS and platform APIs. Status.io page at status.coreweave.com with components per data centre and email, webhook, Teams, Slack and RSS subscriptions (20). The page's robots.txt now disallows /pages/*, where the history, incident pages and the RSS feed sit, so the 8 October reading of the feed (25 September to 8 October) is struck and the 90-day window is unread. The root page, which is allowed, shows one open incident, a facility power loss in US-EAST-15A from 22 October 2026 marked Partial Service Disruption, still in monitoring on 26 October. The same page counts 5 incidents in the last 30 days without listing them. That is one zone of about 40 and reads as partial, but the rest of the window can't be read, so it isn't credited (5). No request rate limits found for api.coreweave.com, only gateway size limits of about 50 KB and 100 MB, and quotas are set per customer through support (0). No 429 or backoff guidance and no idempotency keys found. Kubernetes resources are declarative, so re-applying a manifest is safe (5 of 15). The terms set an objective of 99.9 per cent across multiple regions and 99 per cent in one, with financial credits (10). CKS is sold as a general service but its cluster API is still v1beta1 and the Node Pool resource v1alpha1 (5 of 10). 20 + 5 + 0 + 5 + 10 + 5 = 45.

GPUsMarket 33

Read with the hosted lines. No status page found; listing health is shown per listing only (0). No incident history to read (5). Rate limits published, 60 requests a minute per rental and 10 sign-ups an hour per IP (15). 429 is documented, but no Retry-After, backoff or idempotency guidance (3). The terms give no availability guarantee and put host outages on hosts (0). No beta label on the API (10). 0+5+15+3+0+10 = 33.

CoreWeave 80

The changelog's latest entry is 29 October 2026, Kata Containers runtime selection on CKS in private preview (30). It has 20 dated entries from 5 August to 29 October 2026, among them CKS support for Kubernetes v1.37 (16 September), the Capacity Finder API beta (22 September), Mission Control MCP made generally available (24 September) and CoreWeave Skills in public preview (9 October) (20). Closed service with a dated changelog, a support centre and status updates by email. No public issue tracker for the platform (10 of 15). Generated clients on the Buf Schema Registry and a Terraform provider tagged v0.24.0 on 11 September 2026 per the 8 October check. The MCP server isn't in the official MCP registry (12). The provider repository has build, test, acceptance-test, release and Renovate workflows per the 8 October check. We didn't check that they pass (8).

GPUsMarket 69

gpusmarket 2.5.1 on 16 October 2026, 21 days before this check (30). Releases 2.4.18 to 2.5.1 between 17 August and 16 October, and gpusmarket-host 1.5.3 and 1.6.0 (20). Support by chat widget; the repository, which holds only a README, server.json and a licence, has no open issues and one star (5). Published in the official MCP registry under the verified io.github.jyswee namespace, though the newest registry version, 2.4.16, trails npm (12). No dependencies, but an obfuscated build and no public CI (2). 30+20+5+12+2 = 69.

CoreWeave 20

No machine payment protocol (0). Per instance-hour prices for GPUs, CPUs, storage and networking are published without a login, with some models quoted by sales (20). No free tier or self-serve trial found. Trials run through the sales-led ARENA programme (0). An organisation has to be approved by the sales team and a person creates the token in the console (0).

GPUsMarket 30

No x402, MPP or L402 (0). Hourly prices for every listing and GPU type are public through the unauthenticated search and types endpoints, with a $0.50 minimum (20). No free tier; a card hold is placed on every rental (0). Sign-up and key issue are one API call with no browser, but renting needs a saved, verified card, which the docs don't show being added without a person (10). 0+20+0+10 = 30.