GPUsMarket vs Massed Compute

GPUsMarket 30

Account keys are all-powerful within the account, with no scopes, expiry or rotation documented, but each rental gets its own proxy token (15). The per-rental token limits inference access to one rental; no read-only key or confirmation for destructive calls (6). Peer rentals send prompts and outputs through individuals' machines, protected only by the terms, with no prompt-injection or untrusted-host guidance (2). Per-rental usage stats of requests, tokens and cost (5). No security.txt, disclosure policy, bug bounty or certification; a DPO address for breaches. The CLI and host packages are obfuscated, so they can't be audited (2). 15+6+2+5+2 = 30.

Massed Compute 61

OAuth with discovery from a 401 challenge, or named API tokens shown once and revoked one at a time. Both come in two tiers, read-only and full access, with no finer scopes. Secrets travel only in a header (26 of 30). The read-only tier blocks launch, restart, terminate and SSH key changes. Destructive tool descriptions ask the model to confirm with the user, and a published skill adds a disclosure step. No server-side confirmation was found (13 of 20). The MCP server redacts VM passwords from tool results. Recipes are vendor-written Markdown that tools tell the model to follow step by step, and the docs give no guidance on untrusted content (9 of 15). Connected Apps lists OAuth grants. No audit log or per-call history was found (3 of 15). The wrapper's SECURITY.md gives a disclosure address, a two-business-day acknowledgement and a 30-day fix target, and its CI runs static analysis and dependency audits. The site claims SOC 2 Type II and HIPAA with no report or trust page, and there is no security.txt or bug bounty (10 of 20).

GPUsMarket 69

gpusmarket 2.5.1 on 16 October 2026, 21 days before this check (30). Releases 2.4.18 to 2.5.1 between 17 August and 16 October, and gpusmarket-host 1.5.3 and 1.6.0 (20). Support by chat widget; the repository, which holds only a README, server.json and a licence, has no open issues and one star (5). Published in the official MCP registry under the verified io.github.jyswee namespace, though the newest registry version, 2.4.16, trails npm (12). No dependencies, but an obfuscated build and no public CI (2). 30+20+5+12+2 = 69.

Massed Compute 51

The newest release of the MCP wrapper is v1.1.0 of 24 July 2026, 77 days before the check. The hosted server has changed since, with fields in the server card that the July definitions lack, but no dated API changelog records it (20 of 30). One release and one dated changelog entry in the last 90 days (0). A dated wrapper changelog and a Discord server named as the fastest support route. No API changelog, and the repository shows six open issues or pull requests whose answers we did not read (7 of 15). Listed in the official MCP registry as io.github.Massed-Compute/mcp at 1.1.0, published 31 July 2026, with current npm and PyPI packages (15). CI tests Node 20 and 22 and Python 3.10 to 3.13 on three operating systems, with Dependabot, static analysis and a nightly check of the hosted endpoint. The npm package has no runtime dependencies (9 of 10).

GPUsMarket 52

API and MCP reading. No OpenAPI or other machine-readable contract was found, and the MCP tool schemas couldn't be read because the published package is obfuscated; the repository's history says 2.4.7 added output schemas to all 32 tools, which is the vendor's claim (8). llms.txt as a complete API reference (10). llms.txt says when to use peer or cloud rentals, the proxy or the relay, and which workload each listing type serves (12). Parameters are listed by name without types, enums or required markers, apart from instance and workload types (6). curl examples for each flow, an error code list and a sample deploy response (11). npm versions, but no public changelog (5). 8+10+12+6+11+5 = 52.

Massed Compute 69

A public OpenAPI 3.0 file covers the 14 REST operations, and a public server card lists all 17 MCP tools with JSON Schema inputs (25). massedcompute.com has an llms.txt that indexes marketing pages, and the vendor publishes an agent catalogue, the server card and four Markdown skills files. The docs sites have no llms.txt or Markdown copies (6 of 10). Tool descriptions state the purpose, the cost of a launch, when to search recipes first and when to confirm with the user. REST descriptions are one line each (16 of 20). Required fields are marked and extra properties are refused, but there are no enums, productName and regionName are free strings, and the OpenAPI file's required lists name image_id and couponCode where the properties are imageId and coupon (8 of 15). Every REST operation has a response example. Only 200 and 202 are documented, and errors appear only in a troubleshooting table and a deployment errors page (7 of 15). The path is versioned as /api/v1 and the MCP wrapper has a dated changelog. No API changelog was found (7 of 15).

GPUsMarket 50

Closed, under Tyga.Cloud licences that are clear on use, but the docs call gpusmarket-host MIT open source while the package says otherwise (10). The privacy policy gives retention periods and names Stripe and MongoDB, while renter data on peer hosts falls outside its controls, which the terms disclaim (15). The terms promise 30 days' notice of material changes, with no deprecation policy or dated notices found (5). Processors partly named, with transfers under SCCs, and no host locations shown in the docs read (6). 10+15+5+6 = 36.

Massed Compute 64

Closed service. The End User Licence Agreement of 15 September 2026 is clear and applies Nevada law, and the wrapper is MIT. The Terms & Conditions, the principal agreement, are drawn by a script we could not read (13 of 30). The privacy policy of 22 July 2026, the DPA of 27 March 2026 and the EULA are published. The EULA says VM data is destroyed at termination and persistent storage is kept at most 60 days after non-payment. The privacy policy is a general template that names a mobile application and gives no retention periods (19 of 30). No deprecation policy was found. The wrapper's changelog documents what 1.1.0 removed, and the older docs site still documents api.massedcompute.com while the current docs say not to use it (4 of 20). The sub-processor list names 23 processors with locations, is dated 10 September 2026 and has an RSS feed. The DPA says primary processing is in the United States (17 of 20).

GPUsMarket 33

Read with the hosted lines. No status page found; listing health is shown per listing only (0). No incident history to read (5). Rate limits published, 60 requests a minute per rental and 10 sign-ups an hour per IP (15). 429 is documented, but no Retry-After, backoff or idempotency guidance (3). The terms give no availability guarantee and put host outages on hosts (0). No beta label on the API (10). 0+5+15+3+0+10 = 33.

Massed Compute 20

Graded on the hosted lines for the MCP server and the REST API. No status page was found on the site, the docs, the pricing page or the repository (0). No incident history to read (5). The troubleshooting page documents a 429 for request limits with no figures (0). The same page says to wait a minute and retry, and every tool carries an idempotentHint, but instances_launch has no idempotency key (5 of 15). The on-demand page says 99.999 per cent uptime is guaranteed. No SLA document was found, the End User Licence Agreement promises support only under an order form or SLA, and the Terms & Conditions could not be read (0). The API is /api/v1, the server card is version 1.0.0 and nothing is labelled beta (10).

GPUsMarket 30

No x402, MPP or L402 (0). Hourly prices for every listing and GPU type are public through the unauthenticated search and types endpoints, with a $0.50 minimum (20). No free tier; a card hold is placed on every rental (0). Sign-up and key issue are one API call with no browser, but renting needs a saved, verified card, which the docs don't show being added without a person (10). 0+20+0+10 = 30.

Massed Compute 20

No x402, MPP or L402 in the docs, the OpenAPI files, the server card or the pricing page. Crypto top-ups are made by the account owner in the console (0). Hourly prices for every on-demand configuration are public at vm.massedcompute.com/pricing without a login (20). No free tier or trial credit was found, and a first deposit is needed before a launch (0). Signup, email verification, billing setup and token creation all happen in a browser (0).