GPUsMarket vs Lambda Cloud

GPUsMarket 69

gpusmarket 2.5.1 on 16 October 2026, 21 days before this check (30). Releases 2.4.18 to 2.5.1 between 17 August and 16 October, and gpusmarket-host 1.5.3 and 1.6.0 (20). Support by chat widget; the repository, which holds only a README, server.json and a licence, has no open issues and one star (5). Published in the official MCP registry under the verified io.github.jyswee namespace, though the newest registry version, 2.4.16, trails npm (12). No dependencies, but an obfuscated build and no public CI (2). 30+20+5+12+2 = 69.

Lambda Cloud 5

No changelog or release notes found, and the docs pages carry no dates, so we couldn't date the last API change. The spec still reads 1.10.0 although it gained identity, group, role and workspace paths since 1 October (0). No dated changes in the last 90 days found (0). Closed service with a status page that posts updates and a support-ticket API, but no changelog (5 of 15). No official SDK (0). No packages to assess (0). 0 + 0 + 5 + 0 + 0 = 5.

GPUsMarket 30

Account keys are all-powerful within the account, with no scopes, expiry or rotation documented, but each rental gets its own proxy token (15). The per-rental token limits inference access to one rental; no read-only key or confirmation for destructive calls (6). Peer rentals send prompts and outputs through individuals' machines, protected only by the terms, with no prompt-injection or untrusted-host guidance (2). Per-rental usage stats of requests, tokens and cost (5). No security.txt, disclosure policy, bug bounty or certification; a DPO address for breaches. The CLI and host packages are obfuscated, so they can't be audited (2). 15+6+2+5+2 = 30.

Lambda Cloud 70

Plain API keys, revocable, sent as Bearer or, as a legacy option, HTTP Basic in the header. Keys now belong to user or service identities whose permissions come from role assignments, but no rotation or expiry is documented (20). Role-based access control with predefined account and workspace roles, including a read-only Instance Reader and a terminate-only role, and service identities for automation; no confirmation step for destructive calls (15). Returns infrastructure metadata, no third-party content (10). An audit events endpoint lists API key and resource changes with time and type filters (15). Trust portal lists SOC 2 Type 2, ISO 27001, 27017, 27701 and 22301 and a pentest report; security.txt names security@lambda.ai but expired on 1 June 2026; no bug bounty found (10). 20 + 15 + 10 + 15 + 10 = 70.

GPUsMarket 33

Read with the hosted lines. No status page found; listing health is shown per listing only (0). No incident history to read (5). Rate limits published, 60 requests a minute per rental and 10 sign-ups an hour per IP (15). 429 is documented, but no Retry-After, backoff or idempotency guidance (3). The terms give no availability guarantee and put host outages on hosts (0). No beta label on the API (10). 0+5+15+3+0+10 = 33.

Lambda Cloud 55

incident.io page at status.lambda.ai with components (Cloud API, Network, Virtual Machines, Storage and others) and an RSS feed (20). The feed holds only its ten latest items, back to updates of 17 August 2026, and the page lists only incidents linked to components, so 6 to 17 August is partly unread. What is readable since 6 August touches one region or one function each, so partial and minor by this run's reading: us-south-2 instances unreachable 15 to 17 August, us-midwest-2 networking and performance (opened 3 August, resolved 25 August), API key viewing and creation 10 September, us-south-3 resources 23 September, us-west-1 launches 12 October and us-east-3 launches for 1 hour 10 minutes on 28 October; the 31 October DNS fault hit the lambda.ai website, not the API. The 27 July and 29 to 30 July majors have left the window, but a partly unread window gives no credit, so the line keeps its recorded 0. Rate limits published, one request a second and one launch every 12 seconds (15). The spec's global/rate-limited error says to wait for the Retry-After interval and retry, with no idempotency key or safe-retry guidance for launch (10). No SLA found (0). The Cloud API is GA (10). 20 + 0 + 15 + 10 + 0 + 10 = 55.

GPUsMarket 52

API and MCP reading. No OpenAPI or other machine-readable contract was found, and the MCP tool schemas couldn't be read because the published package is obfuscated; the repository's history says 2.4.7 added output schemas to all 32 tools, which is the vendor's claim (8). llms.txt as a complete API reference (10). llms.txt says when to use peer or cloud rentals, the proxy or the relay, and which workload each listing type serves (12). Parameters are listed by name without types, enums or required markers, apart from instance and workload types (6). curl examples for each flow, an error code list and a sample deploy response (11). npm versions, but no public changelog (5). 8+10+12+6+11+5 = 52.

Lambda Cloud 69

OpenAPI 3.1 spec, version 1.10.0, linked from the API reference as a download, now 48 paths including identities, groups, roles and workspaces (25). No llms.txt (docs.lambda.com/llms.txt returns 404) and no Markdown twins (0). Operations are described with preconditions, for example a filesystem must be unmounted before deletion, but few say when not to call them (14). Required fields are marked; instance type names and statuses are plain strings rather than enums (10). Examples on requests and responses, and 400, 401, 403, 404, 409, 429 and 503 documented with a code, message and suggestion (15). The spec is versioned and flags /file-systems as deprecated, but there's no public changelog or release notes, and the identity and role paths arrived without a version change (5). 25 + 0 + 14 + 10 + 15 + 5 = 69.

GPUsMarket 50

API and MCP reading. The README counts 32 MCP tools, and the decoded package includes 16 operator admin tools besides the renter tools, with no toolsets (5). Marketplace search takes limit, offset, sort and filters for GPU, price, VRAM, model, instance and workload type (20). Status codes with a one-line meaning each, no error bodies documented (10). No idempotency key on rent or deploy; stop and destroy return a cost summary (5). Only a Node CLI, though every proxy speaks the Ollama and OpenAI formats so existing SDKs work (10). 5+20+10+5+10 = 50.

Lambda Cloud 63

Responses wrap a data payload and lists use page_token; no field selection (15). Cursor pagination, and audit events filter by start, end and resource type (18). Errors carry a stable code, a suggestion and a request_id, and the docs tell clients to branch on code (20). No idempotency keys and nothing on safe retries for launch; 409 signals conflicts (5). Launch needs region, instance type and SSH key names, and there's no official SDK (5). 15 + 18 + 20 + 5 + 5 = 63.

GPUsMarket 30

No x402, MPP or L402 (0). Hourly prices for every listing and GPU type are public through the unauthenticated search and types endpoints, with a $0.50 minimum (20). No free tier; a card hold is placed on every rental (0). Sign-up and key issue are one API call with no browser, but renting needs a saved, verified card, which the docs don't show being added without a person (10). 0+20+0+10 = 30.

Lambda Cloud 20

No machine payment protocol (0). Per-GPU hourly prices published without a login (20). No free tier or trial (0). Signup is a browser flow with billing details (0). 0 + 20 + 0 + 0 = 20.