GPUsMarket vs Runpod

GPUsMarket 30

Account keys are all-powerful within the account, with no scopes, expiry or rotation documented, but each rental gets its own proxy token (15). The per-rental token limits inference access to one rental; no read-only key or confirmation for destructive calls (6). Peer rentals send prompts and outputs through individuals' machines, protected only by the terms, with no prompt-injection or untrusted-host guidance (2). Per-rental usage stats of requests, tokens and cost (5). No security.txt, disclosure policy, bug bounty or certification; a DPO address for breaches. The CLI and host packages are obfuscated, so they can't be audited (2). 15+6+2+5+2 = 30.

Runpod 67

API keys can be All, Read Only or Restricted per serverless endpoint, and can be disabled or deleted; the hosted MCP signs in with OAuth. The GraphQL docs still show the key as ?api_key= in the URL per 1 October, which costs 10 (20). Read-only keys and per-endpoint restrictions, and the REST v2 file names a read or write scope for each operation; no confirmation for destructive calls found (15). Runs your own containers and returns their output (10). REST v2 now lists GET /v2/audit-logs (scope audit:read), an account or organisation audit trail of who acted on which resource, with filters and a retention window; no per-call API request log (12). security.txt valid until 31 January 2027, and the trust centre lists SOC 2 Type 2, SOC 3, ISO 27001 and HIPAA, per 1 October; no bug bounty, and osv.dev lists no advisory for runpod (10). 20 + 15 + 10 + 12 + 10 = 67.

GPUsMarket 52

API and MCP reading. No OpenAPI or other machine-readable contract was found, and the MCP tool schemas couldn't be read because the published package is obfuscated; the repository's history says 2.4.7 added output schemas to all 32 tools, which is the vendor's claim (8). llms.txt as a complete API reference (10). llms.txt says when to use peer or cloud rentals, the proxy or the relay, and which workload each listing type serves (12). Parameters are listed by name without types, enums or required markers, apart from instance and workload types (6). curl examples for each flow, an error code list and a sample deploy response (11). npm versions, but no public changelog (5). 8+10+12+6+11+5 = 52.

Runpod 81

OpenAPI for REST v2 at api.runpod.io/v2/openapi.json, with v1 and GraphQL schemas also published (25). llms.txt with .md pages (10). Guides explain queue-based against load-balanced endpoints and sync against async calls, with result retention for each (14). Job statuses are a fixed set (IN_QUEUE, IN_PROGRESS, COMPLETED, FAILED) and payload limits are stated (20 MB sync, 10 MB async, 1 MB per stream chunk) (10). Examples throughout; no error responses documented for the serverless operations (7). Dated release notes and a versioned API (15).

GPUsMarket 33

Read with the hosted lines. No status page found; listing health is shown per listing only (0). No incident history to read (5). Rate limits published, 60 requests a minute per rental and 10 sign-ups an hour per IP (15). 429 is documented, but no Retry-After, backoff or idempotency guidance (3). The terms give no availability guarantee and put host outages on hosts (0). No beta label on the API (10). 0+5+15+3+0+10 = 33.

Runpod 57

Better Stack page at uptime.runpod.io with per-service and per-region history, per the 1 October check, not re-read on 4 November (Runpod's terms bar automated access to runpod.io and its subdomains) (20). Incident line kept at 0. The 1 October reading counted several majors, among them US-IL-1 without power for 6 hours 10 minutes on 14 and 15 August and serverless API errors for 1 hour 25 minutes on 6 September. The window since 1 October is unread, so the recorded award stands (0). The REST v2 OpenAPI file, in the copy Runpod keeps in its MCP repository (synced with production on 27 October), says limits are per user across every /v2 route, with minute, hour and day windows, and gives "minute";q=180;w=60, "hour";q=3600;w=3600, "day";q=43200;w=86400 as the policy header (15). The same file documents 429 with Retry-After and RateLimit headers, and the Python SDK's error guide (2.1.0, 3 November) honours Retry-After, backs off with jitter and does not retry other errors because a failed response can follow a successful mutation. Safe-retry guidance with no idempotency keys (12). No SLA found (0). Serverless and REST v2 are GA; batch jobs are beta (10). 20 + 0 + 15 + 12 + 0 + 10 = 57.

GPUsMarket 50

Closed, under Tyga.Cloud licences that are clear on use, but the docs call gpusmarket-host MIT open source while the package says otherwise (10). The privacy policy gives retention periods and names Stripe and MongoDB, while renter data on peer hosts falls outside its controls, which the terms disclaim (15). The terms promise 30 days' notice of material changes, with no deprecation policy or dated notices found (5). Processors partly named, with transfers under SCCs, and no host locations shown in the docs read (6). 10+15+5+6 = 36.

Runpod 64

Per the 1 October check, not re-read on 4 November (terms bar automated access to runpod.io). Closed service under Delaware terms; the Python SDK is MIT (20). Sync results are kept 1 minute and async 30 minutes, and the docs claim GDPR compliance for EU regions, but no retention periods for pod disks or volumes after deletion and the DPA sits behind trust-centre access (15). Dated notices, REST v1 retiring on 15 November 2026 (announced 18 August) and GraphQL in early 2027; one model endpoint got two weeks' notice (15). 31 regions named with data-centre codes; subprocessor list not found (10).

GPUsMarket 69

gpusmarket 2.5.1 on 16 October 2026, 21 days before this check (30). Releases 2.4.18 to 2.5.1 between 17 August and 16 October, and gpusmarket-host 1.5.3 and 1.6.0 (20). Support by chat widget; the repository, which holds only a README, server.json and a licence, has no open issues and one star (5). Published in the official MCP registry under the verified io.github.jyswee namespace, though the newest registry version, 2.4.16, trails npm (12). No dependencies, but an obfuscated build and no public CI (2). 30+20+5+12+2 = 69.

Runpod 82

Latest release runpod 2.1.0 on 3 November 2026, and @runpod/mcp-server 4.9.1 on 2 November (30). In the window from 6 August, runpod-python tagged v1.12.0, v2.0.0 and v2.1.0, runpod-mcp thirteen releases from v3.3.0 (17 August) to 4.9.1, and flash v1.20.0 to v1.21.1, besides release candidates (20). Closed service with dated release notes and support; GitHub issue response times weren't readable (github.com refuses us) (12 of 25). Python and JavaScript SDKs, the Flash SDK and the MCP server are official; the standalone runpod-flash package was deprecated in October in favour of runpod (15). Package health not checked (5). 30 + 20 + 12 + 15 + 5 = 82.

GPUsMarket 50

API and MCP reading. The README counts 32 MCP tools, and the decoded package includes 16 operator admin tools besides the renter tools, with no toolsets (5). Marketplace search takes limit, offset, sort and filters for GPU, price, VRAM, model, instance and workload type (20). Status codes with a one-line meaning each, no error bodies documented (10). No idempotency key on rent or deploy; stop and destroy return a cost summary (5). Only a Node CLI, though every proxy speaks the Ollama and OpenAI formats so existing SDKs work (10). 5+20+10+5+10 = 50.

Runpod 62

Results can be streamed in chunks of up to 1 MB and polled by job ID, and include sizes some REST v2 responses (12). REST v2 list calls take an opaque cursor with limit (1 to 1,000, 100 for builds, 200 for audit logs) and filters such as actor, action and time on audit logs, per the OpenAPI file in Runpod's MCP repository (20). No error codes or messages documented for serverless operations, per 1 October (5). /retry, /cancel and /purge-queue give safe recovery for jobs, and the MCP server marks destructive tools. No idempotency keys (10). FlashBoot on by default, Python and JavaScript SDKs, the Flash SDK and an official MCP server (15). 12 + 20 + 5 + 10 + 15 = 62.