GPUsMarket vs Modal

GPUsMarket 30

Account keys are all-powerful within the account, with no scopes, expiry or rotation documented, but each rental gets its own proxy token (15). The per-rental token limits inference access to one rental; no read-only key or confirmation for destructive calls (6). Peer rentals send prompts and outputs through individuals' machines, protected only by the terms, with no prompt-injection or untrusted-host guidance (2). Per-rental usage stats of requests, tokens and cost (5). No security.txt, disclosure policy, bug bounty or certification; a DPO address for breaches. The CLI and host packages are obfuscated, so they can't be audited (2). 15+6+2+5+2 = 30.

Modal 68

Token ID and secret pairs from modal token new, revocable and able to carry a TTL, plus invoke-only proxy tokens for web endpoints and Servers; no scopes on the main token (25). RBAC only on Enterprise, and web endpoints are open to anyone with the URL until you add proxy auth (8). Runs your own code and returns its output (10). Audit logs only on Enterprise (10). Disclosure to security@modal.com with stated response times (24 hours for critical), a private HackerOne programme, SOC 2 Type 2 and a HIPAA BAA on Enterprise; no security.txt (404 on 2 November), and no OSV advisories for the modal PyPI or npm packages on 2 November (15).

GPUsMarket 33

Read with the hosted lines. No status page found; listing health is shown per listing only (0). No incident history to read (5). Rate limits published, 60 requests a minute per rental and 10 sign-ups an hour per IP (15). 429 is documented, but no Retry-After, backoff or idempotency guidance (3). The terms give no availability guarantee and put host outages on hosts (0). No beta label on the API (10). 0+5+15+3+0+10 = 33.

Modal 70

Status page at status.modal.com (Better Stack) with per-component history and RSS (20). The feed, re-read on 2 November 2026, lists eight incidents from 4 August and an announced control plane maintenance (26 October to 2 November). Slow .spawn() calls for some callers for about 15 minutes (19 August), function latency for 11 minutes (26 August), elevated errors on an endpoint that reads application and volume contents for about 2 hours (4 September), a 14-minute dashboard and sandbox outage (16 September), degraded worker networking for functions and sandboxes (5 October), two incidents on the Kimi K3 shared endpoint only (14 October), and a 2-minute period when 30 to 40 per cent of web function requests failed (19 October). Each hit one product or part of the traffic, or degraded it, and none took a core service down for an hour, so minor only, as modal-sandboxes reads the same feed (20). Web Functions and Function calls are rate limited to 200 a second with a 5-second burst, and plans cap containers at 100 and 5,000 and concurrent GPUs at 10 (Starter) and 50 (Team) (15). Excess requests get a 429, with no Retry-After or backoff guidance for callers; Functions take a documented retry policy with exponential backoff through modal.Retries (5). No SLA on the pricing page (0). Functions, web endpoints and Servers are GA (10). 20+20+15+5+0+10 = 70.

GPUsMarket 50

Closed, under Tyga.Cloud licences that are clear on use, but the docs call gpusmarket-host MIT open source while the package says otherwise (10). The privacy policy gives retention periods and names Stripe and MongoDB, while renter data on peer hosts falls outside its controls, which the terms disclaim (15). The terms promise 30 days' notice of material changes, with no deprecation policy or dated notices found (5). Processors partly named, with transfers under SCCs, and no host locations shown in the docs read (6). 10+15+5+6 = 36.

Modal 71

Closed service; the Python client is Apache-2.0 (20). Retention is spelled out per product on the security page. Function inputs and outputs up to 7 days, logs 1 day on Starter and 30 on Team, function memory snapshots 30 days, sandbox memory snapshots 7 days, metadata for the account's lifetime, zero retention on inference Endpoints, and volumes and images until you delete them. A DPA sits in the trust centre (25). The 1.1.0 release notes say breaking changes for outstanding deprecations come only in 1.Y.0 releases, and releases give deprecation warnings first (1.6.2 deprecates .update_autoscaler()), with no stated notice period (15). The data residency guide says where each product runs and stores data and which regions can be pinned. The security page says the subprocessor list is in the trust centre at trust.modal.com, which didn't render for us (10). 20+25+15+10 = 70.

GPUsMarket 52

API and MCP reading. No OpenAPI or other machine-readable contract was found, and the MCP tool schemas couldn't be read because the published package is obfuscated; the repository's history says 2.4.7 added output schemas to all 32 tools, which is the vendor's claim (8). llms.txt as a complete API reference (10). llms.txt says when to use peer or cloud rentals, the proxy or the relay, and which workload each listing type serves (12). Parameters are listed by name without types, enums or required markers, apart from instance and workload types (6). curl examples for each flow, an error code list and a sample deploy response (11). npm versions, but no public changelog (5). 8+10+12+6+11+5 = 52.

Modal 70

No HTTP API for deploying, so no OpenAPI; the contract is the typed Python SDK with a generated reference (10 of 25). llms.txt at modal.com/llms.txt (10). Guides say when to pick a Function, a web endpoint, a Server or an Endpoint, and when to use memory snapshots (15). Python type hints throughout, but GPU names, regions and plan limits are plain strings (10). Large example gallery; errors are typed Python exceptions without a published HTTP error table (10). Dated SDK release notes (15). 10+10+15+10+10+15 = 70.

GPUsMarket 69

gpusmarket 2.5.1 on 16 October 2026, 21 days before this check (30). Releases 2.4.18 to 2.5.1 between 17 August and 16 October, and gpusmarket-host 1.5.3 and 1.6.0 (20). Support by chat widget; the repository, which holds only a README, server.json and a licence, has no open issues and one star (5). Published in the official MCP registry under the verified io.github.jyswee namespace, though the newest registry version, 2.4.16, trails npm (12). No dependencies, but an obfuscated build and no public CI (2). 30+20+5+12+2 = 69.

Modal 85

Python SDK 1.6.3 on 27 October 2026 per the release notes (30). Six dated Python SDK releases from 4 August (1.5.4 on 12 August, 1.5.5 on 28 August, 1.6.0 on 28 September, 1.6.1 on 3 October, 1.6.2 on 15 October and 1.6.3 on 27 October) (20). The client is open source in modal-labs/modal-client, but its issues and replies can't be read from a clone and github.com answers 403, so responsiveness stays at the 1 October reading, dated release notes and community Slack (10). Python is current, and the JavaScript and Go SDKs (tagged 0.11.1, beta) are in the same repository (15). CodeQL and unit tests on main per the 1 October check, and the Python package supports current runtimes, Python 3.15 since 1.6.2 (10). 30+20+10+15+10 = 85.

GPUsMarket 30

No x402, MPP or L402 (0). Hourly prices for every listing and GPU type are public through the unauthenticated search and types endpoints, with a $0.50 minimum (20). No free tier; a card hold is placed on every rental (0). Sign-up and key issue are one API call with no browser, but renting needs a saved, verified card, which the docs don't show being added without a person (10). 0+20+0+10 = 30.

Modal 20

No machine payment protocol (0). Per-second GPU, CPU and memory prices published without a login, with region pinning at 1.15 to 1.75 times base (20). Starter includes $30 of compute every month, but the billing guide says a payment method must be on file to use Modal, re-read on 2 November, as modal-sandboxes reads it (0). Signup is a browser flow (0). 0+20+0+0 = 20.