GPUsMarket vs Vast.ai

GPUsMarket 30

Account keys are all-powerful within the account, with no scopes, expiry or rotation documented, but each rental gets its own proxy token (15). The per-rental token limits inference access to one rental; no read-only key or confirmation for destructive calls (6). Peer rentals send prompts and outputs through individuals' machines, protected only by the terms, with no prompt-injection or untrusted-host guidance (2). Per-rental usage stats of requests, tokens and cost (5). No security.txt, disclosure policy, bug bounty or certification; a DPO address for breaches. The CLI and host packages are obfuscated, so they can't be audited (2). 15+6+2+5+2 = 30.

Vast.ai 70

Keys can be scoped to 11 permission categories and narrowed by constraints to resource IDs, are shown once, and can be reset or deleted with immediate effect (30). The rate-limit page, re-read on 2 November, names an api_key query parameter as part of a caller's identity while the authentication page shows only the Bearer header. We took 5 of the checklist's 10 points for a key that can travel in a URL, a judgement call because the option is acknowledged but not taught (25 of 30). Read-only categories and per-instance constraints exist. The CLI confirms a destroy, and Vast.ai's auth.md asks agents to confirm paid or destructive actions, but nothing on the server enforces approval and default keys have full access (15 of 20). The service runs the customer's own containers and returns their logs (10). vastai show audit-logs returns account action history. Its retention and fields were not reviewed (10 of 15). A vulnerability disclosure policy dated 23 July 2025, re-read on 2 November, has safe harbour, triage within 5 business days and security@vast.ai. Its bounty is discretionary, which this checklist doesn't count. The compliance page states SOC 2 Type 2 and makes a SOC 3 report available on request. There is no security.txt (404 on 2 November) and no advisories for vastai in OSV, and the security FAQ says individual hosts may have less formal security. A reporting route and SOC 2 with no counted bounty take 10, as Sinch's messaging listing (10 of 20). 25 + 15 + 10 + 10 + 10 = 70.

GPUsMarket 52

API and MCP reading. No OpenAPI or other machine-readable contract was found, and the MCP tool schemas couldn't be read because the published package is obfuscated; the repository's history says 2.4.7 added output schemas to all 32 tools, which is the vendor's claim (8). llms.txt as a complete API reference (10). llms.txt says when to use peer or cloud rentals, the proxy or the relay, and which workload each listing type serves (12). Parameters are listed by name without types, enums or required markers, apart from instance and workload types (6). curl examples for each flow, an error code list and a sample deploy response (11). npm versions, but no public changelog (5). 8+10+12+6+11+5 = 52.

Vast.ai 78

Public OpenAPI 3.1 file with 66 paths and 89 operations, re-read on 2 November, plus the YAML source in the CLI repository (25). llms.txt on both vast.ai and docs.vast.ai, with every docs page served as Markdown (10). Operation descriptions give the matching CLI command and rules such as template precedence, and the SKILL.md files list quirks and common errors, though the API introduction steers most users to the CLI (15 of 20). Request bodies are typed, with 37 enums and required fields marked. Search filters are operator objects and several routes are not REST-shaped, such as PUT /asks/{id}/ to create an instance (10 of 15). Examples on most operations and 400, 401 and 429 responses on most, but the docs say the error body varies by endpoint (11 of 15). Routes are versioned v0 and v1 and the CLI has tagged releases. No API changelog was found in the docs index (7 of 15). 25 + 10 + 15 + 10 + 11 + 7 = 78.

GPUsMarket 33

Read with the hosted lines. No status page found; listing health is shown per listing only (0). No incident history to read (5). Rate limits published, 60 requests a minute per rental and 10 sign-ups an hour per IP (15). 429 is documented, but no Retry-After, backoff or idempotency guidance (3). The terms give no availability guarantee and put host outages on hosts (0). No beta label on the API (10). 0+5+15+3+0+10 = 33.

Vast.ai 50

Graded as a hosted service. status.vast.ai is Vast.ai's own page with three components (vast, console, serverless) and 30-day bars built from roughly hourly checks, with no incident write-ups (20). The page draws its bars by script from check-log files on the same host. The 8 October count came from those files, the page's own data, which this run doesn't read (as the Docusign and SeaTable listings read their status pages' data feeds), so it's struck, and the window from 4 August to 2 November is unread (5). The page covers Vast.ai's control plane and not the independent hosts' machines. Rate limits are described as a minimum interval per endpoint and identity, re-read on 2 November, but thresholds are unpublished apart from an x-rateLimit value on 2 of 89 operations in the OpenAPI file (5 of 15). 429 is documented with backoff advice and the CLI retries it, but the docs say the API sets no Retry-After header, and there is no idempotency key for instance creation (10 of 15). No SLA found, and the terms say availability is not guaranteed (0). Instances, serverless and the REST API carry no beta label (10). 20 + 5 + 5 + 10 + 0 + 10 = 50.

GPUsMarket 50

Closed, under Tyga.Cloud licences that are clear on use, but the docs call gpusmarket-host MIT open source while the package says otherwise (10). The privacy policy gives retention periods and names Stripe and MongoDB, while renter data on peer hosts falls outside its controls, which the terms disclaim (15). The terms promise 30 days' notice of material changes, with no deprecation policy or dated notices found (5). Processors partly named, with transfers under SCCs, and no host locations shown in the docs read (6). 10+15+5+6 = 36.

Vast.ai 64

A closed service with an MIT CLI and SDK. The Terms of Use Agreement of 1 September 2026, re-read on 2 November, prohibits scripts and automated access to the services without a separate written agreement, which conflicts with the public API and agent tooling (17 of 30). The compliance page says data is destroyed when an instance is deleted, and the DPA allows return or deletion on written notice within 30 days of termination. The privacy policy of 18 June 2025 is written for website users, gives no retention periods, allows targeted advertising and contains an unfilled [INSERT HYPERLINK] placeholder (15 of 30). No deprecation policy was found, and the terms allow changes or discontinuation without notice. v0 and v1 routes coexist (3 of 20). The DPA names five sub-processors without locations and gives new ones only on request. Host location is shown per listing and can be filtered (10 of 20). 17 + 15 + 3 + 10 = 45.

GPUsMarket 69

gpusmarket 2.5.1 on 16 October 2026, 21 days before this check (30). Releases 2.4.18 to 2.5.1 between 17 August and 16 October, and gpusmarket-host 1.5.3 and 1.6.0 (20). Support by chat widget; the repository, which holds only a README, server.json and a licence, has no open issues and one star (5). Published in the official MCP registry under the verified io.github.jyswee namespace, though the newest registry version, 2.4.16, trails npm (12). No dependencies, but an obfuscated build and no public CI (2). 30+20+5+12+2 = 69.

Vast.ai 81

vastai v1.10.0 was tagged on 30 October 2026 by the repository's publish workflow (30). Thirteen tagged releases between 4 August and 2 November 2026, from v1.5.3 (10 August) to v1.10.0 (30 October) (20). Per the 8 October check, not re-read on 2 November (GitHub's API refuses this session), the repository had 54 open issues and pull requests, 22 of the 30 most recently opened without comments. Vast.ai lists 24/7 chat support and Discord, which we did not test (10 of 25). The CLI and Python SDK are current and ship together. The Claude Code, Codex and Cursor plugins were last changed in June 2026 (15). Three CI workflows cover the installer, publishing and SDK tests. An open issue of 6 September 2026 reports hard-pinned dependencies, and we did not check whether CI passes (6 of 10). 30 + 20 + 10 + 15 + 6 = 81.

GPUsMarket 30

No x402, MPP or L402 (0). Hourly prices for every listing and GPU type are public through the unauthenticated search and types endpoints, with a $0.50 minimum (20). No free tier; a card hold is placed on every rental (0). Sign-up and key issue are one API call with no browser, but renting needs a saved, verified card, which the docs don't show being added without a person (10). 0+20+0+10 = 30.

Vast.ai 20

No x402, MPP or L402 found (0). Live per-GPU rates are public without a login at vast.ai/pricing, and billing units (per second for GPU and storage, per byte for bandwidth) are documented. Rates are set per listing by hosts, so there is no fixed list (20). No free tier or trial found. Credit is prepaid with a $5 minimum deposit (0). Signup is a browser flow with email verification. Further keys can be created through the API once an account and key exist (0). 0 + 20 + 0 + 0 = 20.