GPUsMarket vs Thunder Compute

GPUsMarket 33

Read with the hosted lines. No status page found; listing health is shown per listing only (0). No incident history to read (5). Rate limits published, 60 requests a minute per rental and 10 sign-ups an hour per IP (15). 429 is documented, but no Retry-After, backoff or idempotency guidance (3). The terms give no availability guarantee and put host outages on hosts (0). No beta label on the API (10). 0+5+15+3+0+10 = 33.

Thunder Compute 65

Graded on the hosted lines for the REST API and the hosted MCP server. Thunder Compute's terms bar robots, scrapers and data-gathering tools on the Services, so its site, status page and API host weren't requested on 4 November and the readings below are per the 9 October check, not re-read on 4 November. Status page on incident.io at status.thundercompute.com with Website, API and Instances components and monthly history (20). No incidents listed for July to 9 October 2026. The rest of the window is unread and not credited, so the line keeps its recorded award (30). No rate limits with numbers were found in the docs or the OpenAPI document (0). No 429 or retry guidance in the docs. The CLI source reads a Retry-After header on errors, adding a duplicate SSH key is a no-op and port updates are atomic, but instance creation has no idempotency key (5 of 15, a partial value kept and flagged). No SLA found, and the terms say availability is not guaranteed (0). The API and MCP server carry no beta label (10). 20+30+0+5+0+10 = 65.

GPUsMarket 30

Account keys are all-powerful within the account, with no scopes, expiry or rotation documented, but each rental gets its own proxy token (15). The per-rental token limits inference access to one rental; no read-only key or confirmation for destructive calls (6). Peer rentals send prompts and outputs through individuals' machines, protected only by the terms, with no prompt-injection or untrusted-host guidance (2). Per-rental usage stats of requests, tokens and cost (5). No security.txt, disclosure policy, bug bounty or certification; a DPO address for breaches. The CLI and host packages are obfuscated, so they can't be audited (2). 15+6+2+5+2 = 30.

Thunder Compute 51

The MCP server uses OAuth 2.0 with discovery, refresh tokens and ten scopes that separate read from write for instances, snapshots and sandboxes. The REST API uses named API tokens that are created and revoked one at a time, with no scopes found. No secret travels in a URL (25 of 30). Read scopes exist, and the CLI requires --yes to delete without a prompt. No confirmation step for delete_instance or delete_snapshot was found in the MCP docs, and both are described as irreversible (8 of 20). Responses are infrastructure metadata, except run_command output and sandbox logs, with no guidance found on untrusted output (8 of 15). GET /tokens returns creation and last-used times and sandbox logs are listed by API. No audit log was found (4 of 15). No security.txt, disclosure policy or bug bounty was found. llms.txt states SOC 2 Type II and GDPR compliance with no report or trust page linked, and the DPA promises an audit summary on written request and incident notice within 72 hours (6 of 20). The site readings are per the 9 October check, not re-read on 4 November. 25+8+8+4+6 = 51.

GPUsMarket 52

API and MCP reading. No OpenAPI or other machine-readable contract was found, and the MCP tool schemas couldn't be read because the published package is obfuscated; the repository's history says 2.4.7 added output schemas to all 32 tools, which is the vendor's claim (8). llms.txt as a complete API reference (10). llms.txt says when to use peer or cloud rentals, the proxy or the relay, and which workload each listing type serves (12). Parameters are listed by name without types, enums or required markers, apart from instance and workload types (6). curl examples for each flow, an error code list and a sample deploy response (11). npm versions, but no public changelog (5). 8+10+12+6+11+5 = 52.

Thunder Compute 70

Public OpenAPI 3.1 document at api.thundercompute.com:8443/openapi.json with 41 operations and 72 schemas (25). llms.txt, llms-full.txt and a Markdown copy of every docs page (10). 28 of 41 operations have a description. Instance operations state side effects such as the private key being returned once, while most sandbox operations have a summary only (12 of 20). Required fields are marked, but the document has six enums, gpu_type and template are free strings and the instance list is a map keyed by ID (8 of 15). 12 examples and one error schema with code, error and message. Most operations document 400, 401 and 500, and none documents 429 (9 of 15). /v1 and /v2 paths, with legacy endpoints and the mode field marked as retained or deprecated. No API changelog was found. The CLI has a dated one (6 of 15). No published copy of the MCP tool definitions was found, so they were not read. All of this is per the 9 October check, not re-read on 4 November. 25+10+12+8+9+6 = 70.

GPUsMarket 50

Closed, under Tyga.Cloud licences that are clear on use, but the docs call gpusmarket-host MIT open source while the package says otherwise (10). The privacy policy gives retention periods and names Stripe and MongoDB, while renter data on peer hosts falls outside its controls, which the terms disclaim (15). The terms promise 30 days' notice of material changes, with no deprecation policy or dated notices found (5). Processors partly named, with transfers under SCCs, and no host locations shown in the docs read (6). 10+15+5+6 = 36.

Thunder Compute 66

Closed service under Terms and Conditions dated 28 September 2026 and Delaware law. The CLI is MIT. The OpenAPI document names Apache 2.0 and a placeholder terms address (15 of 30). The privacy policy of 28 September 2026 says instance data is not used to train AI models, the terms say instance data may be deleted 60 days after the account was last active, and a DPA is published. The sub-processor list names Firebase for sign-in while the MCP docs name Stytch, and the FAQ says instances are EC2 while the list names Azure (18 of 30). No deprecation policy. The terms allow changes without notice, and the billing docs say rates can change without notice. Legacy endpoints are marked as retained for compatibility (6 of 20). Five sub-processors with locations are listed and the DPA sets 10 business days' notice of changes. The list is dated 27 August 2025 and omits Stytch and Sentry, which the MCP docs and the CLI source name (12 of 20). The site readings are per the 9 October check, not re-read on 4 November. 15+18+6+12 = 51.

GPUsMarket 30

No x402, MPP or L402 (0). Hourly prices for every listing and GPU type are public through the unauthenticated search and types endpoints, with a $0.50 minimum (20). No free tier; a card hold is placed on every rental (0). Sign-up and key issue are one API call with no browser, but renting needs a saved, verified card, which the docs don't show being added without a person (10). 0+20+0+10 = 30.

Thunder Compute 20

No x402, MPP or L402 in the docs, the OpenAPI document or the pricing page (0). Per-GPU-hour, per-vCPU-hour and storage prices are public on the pricing page (20). No general free tier or trial. A $20 credit is limited to students with a US university email, and the MCP quickstart asks for a payment method before connecting (0). Signup and the first OAuth consent happen in a browser. create_token issues API tokens only after that sign-in (0). Per the 9 October check, not re-read on 4 November. 0+20+0+0 = 20.

GPUsMarket 69

gpusmarket 2.5.1 on 16 October 2026, 21 days before this check (30). Releases 2.4.18 to 2.5.1 between 17 August and 16 October, and gpusmarket-host 1.5.3 and 1.6.0 (20). Support by chat widget; the repository, which holds only a README, server.json and a licence, has no open issues and one star (5). Published in the official MCP registry under the verified io.github.jyswee namespace, though the newest registry version, 2.4.16, trails npm (12). No dependencies, but an obfuscated build and no public CI (2). 30+20+5+12+2 = 69.

Thunder Compute 79

The newest CLI release is v2.2.0 of 27 October 2026, which adds tnr report and SSH and interface fixes (30). Three CLI releases in the 90 days from 6 August, v2.0.72 (15 September), v2.1.0 (16 September) and v2.2.0, each changing code (20). A dated CLI changelog, a support address and a Discord server the docs say the founders answer. No API changelog. GitHub issues weren't re-read (github.com refused), so 10 of 15 per the 9 October check. Listed in the official MCP registry as io.github.Thunder-Compute/thunder-compute per the 9 October check, and the CLI and the thunder-sandbox SDK are current (13 of 15). The CLI repository has tests, a lint configuration and release checksum verification, and still no CI workflow (.github holds only copilot-instructions.md) (6 of 10). 30+20+10+13+6 = 79.