GPUsMarket vs Nebius AI Cloud

GPUsMarket 30

Account keys are all-powerful within the account, with no scopes, expiry or rotation documented, but each rental gets its own proxy token (15). The per-rental token limits inference access to one rental; no read-only key or confirmation for destructive calls (6). Peer rentals send prompts and outputs through individuals' machines, protected only by the terms, with no prompt-injection or untrusted-host guidance (2). Per-rental usage stats of requests, tokens and cost (5). No security.txt, disclosure policy, bug bounty or certification; a DPO address for breaches. The CLI and host packages are obfuscated, so they can't be audited (2). 15+6+2+5+2 = 30.

Nebius AI Cloud 81

User tokens last 12 hours. Service accounts authenticate with an uploaded RSA public key (optional expiry), sign a five-minute JWT and exchange it for a 12-hour Bearer token; access comes from group roles granted on a tenant, a project or a single resource. No secret travels in a URL (28). auditor and viewer roles, narrow roles such as compute.instance-power-operator, and a safe mode on by default in the beta MCP server that blocks update and delete commands; no confirmation step for destructive API calls (15). Returns infrastructure metadata and the output of the owner's own containers (10). Audit Logs record control-plane and data-plane events in CloudEvents form, readable at /audit/v2/audit-events and exportable to Object Storage; the service is in preview (13). security.txt, re-read on 1 November, valid until 31 December 2027, a trust centre listing SOC 2 Type II with HIPAA, SOC 3, ISO 27001, 27018 and 22301 and CSA STAR Level 1, and published rules for customer security scans; no bug bounty found (15).

GPUsMarket 33

Read with the hosted lines. No status page found; listing health is shown per listing only (0). No incident history to read (5). Rate limits published, 60 requests a minute per rental and 10 sign-ups an hour per IP (15). 429 is documented, but no Retry-After, backoff or idempotency guidance (3). The terms give no availability guarantee and put host outages on hosts (0). No beta label on the API (10). 0+5+15+3+0+10 = 33.

Nebius AI Cloud 77

Graded as a hosted service on the REST API. Statuspage at status.nebius.com with component history (20). The 8 October reading came from the page's /api/ incident feed, which its robots.txt disallows, so it is struck. The history pages and history.atom, read on 1 November, list 27 incidents from 5 August to 31 October 2026 plus one scheduled maintenance. Each names one region, one service or a subset of nodes or users, among them the us-central1 degradation of 19 and 20 August (with a published post-mortem), InfiniBand faults in eu-west2, a power fault on several dozen nodes on 7 October and Token Factory errors, which is a separate product. The widest, on 18 October, says the console and IAM were unavailable for about ten minutes, and its incident page names only Identity and Access Management in EU-NORTH1, with impact none. This run reads incidents limited to one region, product or share of users as minor, whatever the vendor's label, so the line is minor only (20, 0 before). Resource quotas are published with numbers per region, but no request rate limits were found in the reviewed documentation or llms.txt on 1 November (5 of 15). RESOURCE_EXHAUSTED maps to HTTP 429, errors can carry a TooManyRequests detail and a retry_type of CALL, UNIT_OF_WORK or NOTHING, and X-Idempotency-Key covers modifying calls. No Retry-After or backoff intervals found (12 of 15). SLA of 99.5 per cent a month per virtual machine with credits of 10 to 30 per cent. Serverless AI is not on the list of services with a service level (10). Compute and Serverless AI are generally available. Audit Logs, Monitoring and Logging are in preview (10). 20 + 20 + 5 + 12 + 10 + 10 = 77.

GPUsMarket 50

API and MCP reading. The README counts 32 MCP tools, and the decoded package includes 16 operator admin tools besides the renter tools, with no toolsets (5). Marketplace search takes limit, offset, sort and filters for GPU, price, VRAM, model, instance and workload type (20). Status codes with a one-line meaning each, no error bodies documented (10). No idempotency key on rent or deploy; stop and destroy return a cost summary (5). Only a Node CLI, though every proxy speaks the Ollama and OpenAI formats so existing SDKs work (10). 5+20+10+5+10 = 50.

Nebius AI Cloud 77

Lists take pageSize and pageToken, gets take a view and there are get-by-name calls; no field selection (15 of 25). Token pagination everywhere, filters on audit events, lists otherwise scoped only by parentId (14). Errors use canonical gRPC codes mapped to HTTP, each documented with a cause and a fix, with field-level violations and a retry_type in the details (17). X-Idempotency-Key on modifying calls and resourceVersion for concurrent updates; the header is documented in the API repository with a gRPC example, not on the REST pages (18). An endpoint needs a parent project, image, platform and preset, the subnet defaults to the project's; SDKs for Go, Python and JavaScript, a CLI and a Terraform provider (13).

GPUsMarket 50

Closed, under Tyga.Cloud licences that are clear on use, but the docs call gpusmarket-host MIT open source while the package says otherwise (10). The privacy policy gives retention periods and names Stripe and MongoDB, while renter data on peer hosts falls outside its controls, which the terms disclaim (15). The terms promise 30 days' notice of material changes, with no deprecation policy or dated notices found (5). Processors partly named, with transfers under SCCs, and no host locations shown in the docs read (6). 10+15+5+6 = 36.

Nebius AI Cloud 77

Closed service under a Services Agreement published 15 September 2026 and effective 28 September, with nine earlier versions archived; the API definitions, SDKs and MCP server are MIT (15). Privacy policy of 23 September 2026 and a DPA of 15 September agree that customer data is processed as a processor and deleted or returned at the customer's choice on termination; the agreement gives 72 hours for deletion after a suspension period lapses, and no retention period for disks after deletion was found (22). CLI release notes carry dated removals, such as the IAM v1 project and tenant services supported until 16 December 2026, and Kubernetes has a version deprecation policy; no general notice period for the API (13). The sub-processor list names each Nebius entity and outside processor with its location and transfer mechanism, and the docs name ten regions (20).

GPUsMarket 52

API and MCP reading. No OpenAPI or other machine-readable contract was found, and the MCP tool schemas couldn't be read because the published package is obfuscated; the repository's history says 2.4.7 added output schemas to all 32 tools, which is the vendor's claim (8). llms.txt as a complete API reference (10). llms.txt says when to use peer or cloud rentals, the proxy or the relay, and which workload each listing type serves (12). Parameters are listed by name without types, enums or required markers, apart from instance and workload types (6). curl examples for each flow, an error code list and a sample deploy response (11). npm versions, but no public changelog (5). 8+10+12+6+11+5 = 52.

Nebius AI Cloud 78

OpenAPI 3.0.3 at api.nebius.cloud/openapi.json with 602 operations on 443 paths and 1,051 schemas, plus the protobuf definitions in nebius/api (25). llms.txt, llms-full.txt, every docs page as Markdown and a docs MCP server (10). Every operation has a description, most of one line such as "Creates an endpoint"; field descriptions state mutual exclusions and defaults but rarely when not to call (12). 186 enums and required lists on resource metadata; platform and preset are plain strings (11). The docs give curl examples and a table of 15 status codes with fixes, but the OpenAPI document has no examples and documents only 200 responses (8). Paths carry v1 or v1alpha1 with a stated rule that alpha versions can change, and the CLI release notes are dated and generated from the same API; the spec's own version reads version not set and there is no API changelog as such (12).

GPUsMarket 69

gpusmarket 2.5.1 on 16 October 2026, 21 days before this check (30). Releases 2.4.18 to 2.5.1 between 17 August and 16 October, and gpusmarket-host 1.5.3 and 1.6.0 (20). Support by chat widget; the repository, which holds only a README, server.json and a licence, has no open issues and one star (5). Published in the official MCP registry under the verified io.github.jyswee namespace, though the newest registry version, 2.4.16, trails npm (12). No dependencies, but an obfuscated build and no public CI (2). 30+20+5+12+2 = 69.

Nebius AI Cloud 82

CLI 0.12.298 on 27 October 2026, and 0.12.293 (19 October) and 0.12.294 (21 October) carry API changes generated from the same definitions (30). CLI releases most working days, 0.12.278 to 0.12.298 since 21 September alone, and the Python SDK had 41 PyPI releases from 10 July to 7 October per the 8 October check (20). Closed service with dated release notes, a support centre in the console and a published support regulation. We did not read GitHub issue response times (10 of 15). Current official SDKs for Go, Python and JavaScript (15). Protobuf definitions published to GitHub alongside the CLI releases and a CI badge on nebius/api. We did not check the CI results (7). 30 + 20 + 10 + 15 + 7 = 82.