GPUsMarket vs Replicate Deployments

GPUsMarket 33

Read with the hosted lines. No status page found; listing health is shown per listing only (0). No incident history to read (5). Rate limits published, 60 requests a minute per rental and 10 sign-ups an hour per IP (15). 429 is documented, but no Retry-After, backoff or idempotency guidance (3). The terms give no availability guarantee and put host outages on hosts (0). No beta label on the API (10). 0+5+15+3+0+10 = 33.

Replicate Deployments 75

Replicate incidents post under a Replicate component on cloudflarestatus.com, and replicatestatus.com redirects to that page filtered to Replicate (20). The component's 90-day bars, read on 2 November, show 5 days with incidents, all in September 2026, and none since 28 September. Some third-party models couldn't scale out for 15 hours 41 minutes on 14 and 15 September, a Pruna-specific issue ran 20 hours on 17 September, backend services returned intermittent 500s for 1 hour 54 minutes on 24 September, and hot-swapped Flux models stuck for 17 minutes on 28 September. Each names a subset of models or intermittent errors, so each reads as partial, minor only (20). 600 prediction creates a minute, 3,000 a minute on other endpoints, and 6 a minute without a card, re-read on 2 November (15). A 429 body says when the limit resets ('resets in ~30s') and the error-code page gives retry advice per code, but there's no Retry-After header or idempotency guidance (10 of 15). No SLA found (0). Deployments are GA (10). 20 + 20 + 15 + 10 + 0 + 10 = 75.

GPUsMarket 52

API and MCP reading. No OpenAPI or other machine-readable contract was found, and the MCP tool schemas couldn't be read because the published package is obfuscated; the repository's history says 2.4.7 added output schemas to all 32 tools, which is the vendor's claim (8). llms.txt as a complete API reference (10). llms.txt says when to use peer or cloud rentals, the proxy or the relay, and which workload each listing type serves (12). Parameters are listed by name without types, enums or required markers, apart from instance and workload types (6). curl examples for each flow, an error code list and a sample deploy response (11). npm versions, but no public changelog (5). 8+10+12+6+11+5 = 52.

Replicate Deployments 85

Public OpenAPI 3.1.0 at api.replicate.com/openapi.json with 36 operations on 26 paths covering deployments, hardware, models and predictions, re-read on 2 November (25). llms.txt with Markdown pages (10). Operation descriptions in the spec explain purpose with curl examples; deployment docs say when to use a deployment rather than a model version (16). Deployment fields are bounded (min_instances 0 to 5, max_instances 0 to 20, a 64-character version, a hardware SKU from GET /v1/hardware) (13). Examples throughout and 8 coded errors (E1001 out of memory, E6716 start timeout and others) with fixes; the HTTP error body format isn't described (11). Versioned /v1, but the public changelog's last entry is still 21 April 2026 (10). 25 + 10 + 16 + 13 + 11 + 10 = 85.

GPUsMarket 50

Closed, under Tyga.Cloud licences that are clear on use, but the docs call gpusmarket-host MIT open source while the package says otherwise (10). The privacy policy gives retention periods and names Stripe and MongoDB, while renter data on peer hosts falls outside its controls, which the terms disclaim (15). The terms promise 30 days' notice of material changes, with no deprecation policy or dated notices found (5). Processors partly named, with transfers under SCCs, and no host locations shown in the docs read (6). 10+15+5+6 = 36.

Replicate Deployments 79

Closed service; Cog is Apache-2.0 (20). API prediction inputs, outputs, files and logs are deleted after one hour by default, web predictions are kept until deleted, and a subprocessor page is published, per the 1 October check, not re-read on 2 November (22). Dated deprecations in the changelog (streaming default in July 2024, spend limits in July 2025) but no written policy (12). Subprocessors listed; data locations not stated in what we read (15). 20 + 22 + 12 + 15 = 69.

GPUsMarket 50

API and MCP reading. The README counts 32 MCP tools, and the decoded package includes 16 operator admin tools besides the renter tools, with no toolsets (5). Marketplace search takes limit, offset, sort and filters for GPU, price, VRAM, model, instance and workload type (20). Status codes with a one-line meaning each, no error bodies documented (10). No idempotency key on rent or deploy; stop and destroy return a cost summary (5). Only a Node CLI, though every proxy speaks the Ollama and OpenAI formats so existing SDKs work (10). 5+20+10+5+10 = 50.

Replicate Deployments 73

The MCP server exposes one tool per HTTP operation and has an experimental code mode that collapses them into two tools (search the SDK docs, run TypeScript) (20). List responses page with next and previous cursor URLs, the predictions list filters by created_after, created_before and source, and the models list sorts, but there is no page size or field selection (15 of 20; was 10, pagination not verified on 1 October). Coded errors with suggested fixes, detail messages on HTTP errors (15). No idempotency keys; Prefer: wait, a Cancel-After header, webhooks and cancel cut polling, and a failed run still bills its active time (8). Sensible defaults (min_instances 0 allowed) and official Python and JavaScript clients plus Cog (15). 20 + 15 + 15 + 8 + 15 = 73.

GPUsMarket 30

Account keys are all-powerful within the account, with no scopes, expiry or rotation documented, but each rental gets its own proxy token (15). The per-rental token limits inference access to one rental; no read-only key or confirmation for destructive calls (6). Peer rentals send prompts and outputs through individuals' machines, protected only by the terms, with no prompt-injection or untrusted-host guidance (2). Per-rental usage stats of requests, tokens and cost (5). No security.txt, disclosure policy, bug bounty or certification; a DPO address for breaches. The CLI and host packages are obfuscated, so they can't be audited (2). 15+6+2+5+2 = 30.

Replicate Deployments 40

Bearer tokens starting r8_, several per account, each can be disabled; no scopes or expiry, re-read on 2 November (20). No read-only or per-model token; every token can create, update and delete deployments (0). Returns your own model's output (10). No audit log or per-token usage view found; predictions are listed per account (5). Replicate scans public GitHub for leaked tokens, disables them and emails the owner. replicate.com/.well-known/security.txt answers 404, and no bug bounty or certification was found in the docs we read. OSV lists no advisory for the replicate packages, replicate-mcp or Cog (5). 20 + 0 + 10 + 5 + 5 = 40.

GPUsMarket 69

gpusmarket 2.5.1 on 16 October 2026, 21 days before this check (30). Releases 2.4.18 to 2.5.1 between 17 August and 16 October, and gpusmarket-host 1.5.3 and 1.6.0 (20). Support by chat widget; the repository, which holds only a README, server.json and a licence, has no open issues and one star (5). Published in the official MCP registry under the verified io.github.jyswee namespace, though the newest registry version, 2.4.16, trails npm (12). No dependencies, but an obfuscated build and no public CI (2). 30+20+5+12+2 = 69.

Replicate Deployments 78

Cog, the listing's repository, tagged v0.23.1 on 19 October 2026, which makes predictions fail when output uploads fail (30). Cog tagged v0.22.0 on 13 August, v0.23.0 on 22 September and v0.23.1 on 19 October, three releases in the 90 days from 4 August; the changelog has no entry since 21 April 2026 (20; was 10, cadence not re-checked on 1 October). Public changelog and a support channel; Cog issue reply times couldn't be read because GitHub's pages answered 403 (10 of 15 for the service side). Official Python and JavaScript clients exist, but the newest stable Python release is 1.0.7 (27 May 2025) with 2.0 betas to 18 December 2025, and the JavaScript client's newest tag is 1.4.0 (17 November 2025). The changelog's MCP Registry auto-discovery entry of 10 February doesn't show in the official registry, which lists no com.replicate server on 2 November (10 of 15; was 15). Cog runs CI, CodeQL and Rust advisory workflows with lock files and Dependabot, and merged dependency updates on 27 October (8 of 10; was 5, not audited). 30 + 20 + 10 + 10 + 8 = 78.