GPUsMarket vs Hyperbolic

GPUsMarket 69

gpusmarket 2.5.1 on 16 October 2026, 21 days before this check (30). Releases 2.4.18 to 2.5.1 between 17 August and 16 October, and gpusmarket-host 1.5.3 and 1.6.0 (20). Support by chat widget; the repository, which holds only a README, server.json and a licence, has no open issues and one star (5). Published in the official MCP registry under the verified io.github.jyswee namespace, though the newest registry version, 2.4.16, trails npm (12). No dependencies, but an obfuscated build and no public CI (2). 30+20+5+12+2 = 69.

Hyperbolic 39

Readings are per the 8 October check, not re-read on 4 November 2026. The newest changelog entry is for the week of 5 October 2026, 30 days before today (30); it drops to 20 after 4 November unless a newer entry appears. It was the only dated entry on the changelog and its RSS feed, so the three-entry test is not met (0 of 20). A public changelog with RSS, in-app chat and email support with stated hours of Monday to Friday, 06:00 to 17:00 Pacific Time (9 of 15). No current official SDK for the v2 API. The vendor's MCP repository still ends at its 21 May 2025 commit (clone, 4 November) and targets legacy v1 paths (0 of 15). Package health 3 to 0. The partial rested on the spec served by the API, a struck reading, and there is no client package to assess. 30 + 0 + 9 + 0 + 0 = 39.

GPUsMarket 30

Account keys are all-powerful within the account, with no scopes, expiry or rotation documented, but each rental gets its own proxy token (15). The per-rental token limits inference access to one rental; no read-only key or confirmation for destructive calls (6). Peer rentals send prompts and outputs through individuals' machines, protected only by the terms, with no prompt-injection or untrusted-host guidance (2). Per-rental usage stats of requests, tokens and cost (5). No security.txt, disclosure policy, bug bounty or certification; a DPO address for breaches. The CLI and host packages are obfuscated, so they can't be audited (2). 15+6+2+5+2 = 30.

Hyperbolic 48

Readings are per the 8 October check, not re-read on 4 November 2026. Plain API keys sent as a Bearer header, shown once, revocable, any number per account, and attributed to their creator inside an Organisation. No scopes or expiry found, and no secret in a URL (20 of 30). No read-only key and no confirmation step. A key can rent and terminate machines and can call DELETE /v2/users/me. Organisation members cannot deposit funds or see billing history (4 of 20). Responses are infrastructure metadata (10). Key lists show each key's creator and revocation time, and rental and transaction histories exist. No audit log was found for self-serve accounts (4 of 15). Programme 9 to 10. The docs ask for vulnerability reports by email with a 48-hour acknowledgement and claim a completed SOC 2 Type I audit with Type II under way, reports under NDA. A disclosure route with a stated acknowledgement time is 10; no security.txt or bug bounty, and the trust centre is drawn by script. 20 + 4 + 10 + 4 + 10 = 48.

GPUsMarket 30

No x402, MPP or L402 (0). Hourly prices for every listing and GPU type are public through the unauthenticated search and types endpoints, with a $0.50 minimum (20). No free tier; a card hold is placed on every rental (0). Sign-up and key issue are one API call with no browser, but renting needs a saved, verified card, which the docs don't show being added without a person (10). 0+20+0+10 = 30.

Hyperbolic 15

Readings are per the 8 October check, not re-read on 4 November 2026. No x402, MPP or L402 on the GPU API. The vendor's archived x402 repository covered chat completions on another host (0). The marketplace page states a starting price of $3.19 a GPU-hour. There is no public price table and the docs point to the console. The 8 October reading of hourly prices from an open API endpoint is struck (a product endpoint), so the line rests on the marketplace figure and keeps its partial value (15 of 20). A free-tier account cannot rent anything. Renting needs a $5 deposit through Stripe, and the only free credit found is from event codes (0). Signup, email verification, the deposit and key creation happen in a browser (0). 0 + 15 + 0 + 0 = 15.

GPUsMarket 50

Closed, under Tyga.Cloud licences that are clear on use, but the docs call gpusmarket-host MIT open source while the package says otherwise (10). The privacy policy gives retention periods and names Stripe and MongoDB, while renter data on peer hosts falls outside its controls, which the terms disclaim (15). The terms promise 30 days' notice of material changes, with no deprecation policy or dated notices found (5). Processors partly named, with transfers under SCCs, and no host locations shown in the docs read (6). 10+15+5+6 = 36.

Hyperbolic 64

Readings are per the 8 October check, not re-read on 4 November 2026, apart from the Terms of Service, re-read and unchanged (24 March 2025). Closed service under California law. The terms describe a marketplace in which the contract for compute is between buyer and supplier, which does not match the docs' description of a GPU cloud with an SLA (13 of 30). The Privacy Policy is effective 3 June 2024, gives no retention periods and names Babylon three times in one clause. The terms say user content is not used to train generative models. The docs promise data wiping on termination, a 30-day grace period for volumes and a DPA on request, and no published DPA was found (12 of 30). No written deprecation policy, but legacy paths carry a Sunset header with an end date of 1 March 2027 and each deprecated operation names its replacement (14 of 20). Stripe is named as payment processor. The suppliers that host the machines are not named, and the trust centre's sub-processor list, if any, was unreadable (6 of 20). 13 + 12 + 14 + 6 = 45.

GPUsMarket 33

Read with the hosted lines. No status page found; listing health is shown per listing only (0). No incident history to read (5). Rate limits published, 60 requests a minute per rental and 10 sign-ups an hour per IP (15). 429 is documented, but no Retry-After, backoff or idempotency guidance (3). The terms give no availability guarantee and put host outages on hosts (0). No beta label on the API (10). 0+5+15+3+0+10 = 33.

Hyperbolic 25

Graded on the hosted lines for the REST API. Hyperbolic's Terms of Service (24 March 2025) bar spiders, robots and scrapers from downloading data from any web page in the Services, which cover the website, so hyperbolic.ai pages and the status page keep their 8 October readings, not re-read on 4 November 2026. Status page at status.hyperbolic.ai on UptimeRobot. The page draws its monitors and history by script from /api/, a path its robots.txt closes, so no component was ever read, and a status-page line with no readable component scores 0, as for fonoa, n8n and windmill (was 20). The incident record was never read either (5, unreadable history). Rate limits appear as numbers only on the plan cards in the docs, 60 requests a minute on the free tier and 600 on the pro tier, and the terms let Hyperbolic change limits without notice (10 of 15). No 429 response, Retry-After or backoff guidance in the docs, and no idempotency key on rental creation (0). SLA 7 to 0. The docs state a 99.5 per cent uptime figure for On-Demand and Reserved with credits reviewed case by case, and the Terms of Service disclaim uptime and any duty to give credits. A figure with discretionary credits and no SLA document isn't an SLA (manatal). The v2 API is not marked beta (10). 0 + 5 + 10 + 0 + 0 + 10 = 25.

GPUsMarket 50

API and MCP reading. The README counts 32 MCP tools, and the decoded package includes 16 operator admin tools besides the renter tools, with no toolsets (5). Marketplace search takes limit, offset, sort and filters for GPU, price, VRAM, model, instance and workload type (20). Status codes with a one-line meaning each, no error bodies documented (10). No idempotency key on rent or deploy; stop and destroy return a cost summary (5). Only a Node CLI, though every proxy speaks the Ollama and OpenAI formats so existing SDKs work (10). 5+20+10+5+10 = 50.

Hyperbolic 55

Readings are per the 8 October check, not re-read on 4 November 2026. No field selection. Lists page at 25 by default and 100 at most, and GET /v2/on-demand/active-rental-summary returns counts and hourly cost without the rental bodies (13 of 25). page and pageSize on active rentals, a cursor on history, and filters for GPU type, region and term type. Storage volumes and SSH keys return whole arrays (15 of 20). Errors carry code, message and issues, with named cases such as INVALID_INPUT_FOR_RENTAL_TYPE and REBOOT_ALREADY_IN_PROGRESS (14 of 20). No idempotency key on create calls. A duplicate SSH key is rejected and terminating an ended rental returns RENTAL_NOT_FOUND (5 of 20). A rental needs only rentalType and gpuCount, with defaults for region, GPU type and SSH key. No official SDK or CLI for the v2 API was found (8 of 15). 13 + 15 + 14 + 5 + 8 = 55.