GPUsMarket vs Verda

GPUsMarket 30

Account keys are all-powerful within the account, with no scopes, expiry or rotation documented, but each rental gets its own proxy token (15). The per-rental token limits inference access to one rental; no read-only key or confirmation for destructive calls (6). Peer rentals send prompts and outputs through individuals' machines, protected only by the terms, with no prompt-injection or untrusted-host guidance (2). Per-rental usage stats of requests, tokens and cost (5). No security.txt, disclosure policy, bug bounty or certification; a DPO address for breaches. The CLI and host packages are obfuscated, so they can't be audited (2). 15+6+2+5+2 = 30.

Verda 68

OAuth 2.0 client credentials. Access tokens expire after 3,600 seconds, credentials are deleted when their creator leaves the project, and every token carries the single scope cloud-api-v1. No secret travels in a URL (20 of 30). Credentials follow their creator's role of owner, admin or developer, and no read-only credential was found. The MCP server and the CLI's --agent mode require explicit confirmation for billed and destructive actions, and deleted volumes sit in trash for 96 hours (10 of 20). Responses are infrastructure metadata, apart from container logs (10). Audit log in the console and at GET /v1/audit/log, 90 days in CloudEvents format with IP address and origin, marked beta (14 of 15). security.txt is valid until 31 December 2026 and names a disclosure policy at vdp.verda.com. The home page states SOC 2 Type II and ISO 27001, 27017, 27018 and 27701. The trust centre and the policy page are drawn by script and we couldn't read them, and no bug bounty was found (14 of 20).

GPUsMarket 33

Read with the hosted lines. No status page found; listing health is shown per listing only (0). No incident history to read (5). Rate limits published, 60 requests a minute per rental and 10 sign-ups an hour per IP (15). 429 is documented, but no Retry-After, backoff or idempotency guidance (3). The terms give no availability guarantee and put host outages on hosts (0). No beta label on the API (10). 0+5+15+3+0+10 = 33.

Verda 60

Graded on the hosted lines for the REST API. BetterStack page at status.verda.com with 21 components, 180-day bars and an RSS feed (20). The feed lists eight incidents from 4 August to 2 November 2026, none posted against the API component and each limited to one product, one location or some customers. Serverless Containers were slow or unavailable for about 9.5 hours on 13 August, the container gateway returned intermittent 500s on 4 September, container uploads failed for about 2 hours on 20 September, a small number of instances, volumes and billing records were affected on 25 September, Serverless Containers degraded during a security update on 9 October, FIN03 services and Google SSO sign-in failed during maintenance on 11 October, the container registry vccr.io was down on 19 October, and FIN-02 lost network connectivity on 23 October. This run reads all of them as partial, minor only (20). api.verda.com, which hosts the API reference with the rate limits, answered robots.txt with 401 on 2 November 2026, so the 8 October readings from its OpenAPI document are struck. The docs' changelog says rate limits apply since 11 March 2026 and points to that reference, with no numbers on a page we can read (0). The official Go SDK's retry middleware backs off on 429 and 5xx, instance actions already in the requested state answer 204 and volume deletion is idempotent per the docs' changelog, and serverless job request IDs answer 409 on a repeat, but instance creation has no idempotency key and Retry-After is documented only on the refused host (10 of 15). No SLA found, and the terms give no warranty of uninterrupted availability (0). The REST API is generally available, while the CLI's MCP server is marked beta (10).

GPUsMarket 50

Closed, under Tyga.Cloud licences that are clear on use, but the docs call gpusmarket-host MIT open source while the package says otherwise (10). The privacy policy gives retention periods and names Stripe and MongoDB, while renter data on peer hosts falls outside its controls, which the terms disclaim (15). The terms promise 30 days' notice of material changes, with no deprecation policy or dated notices found (5). Processors partly named, with transfers under SCCs, and no host locations shown in the docs read (6). 10+15+5+6 = 36.

Verda 76

Closed service under Terms of Service dated 30 September 2025 and Finnish law. The CLI and SDKs are Apache-2.0 (15 of 30). The terms include data processing terms, and the privacy policy has a retention table. Deleted customer data is removed within 96 hours per the privacy policy and clause 10.9.2, while Schedule 3 of the same terms says 72 hours. The privacy policy shows no readable date (20 of 30). No deprecation policy with a notice period. HDD volumes were announced as deprecated in April 2026 before creation was blocked on 21 September (10 of 20). The docs name three data centres in Helsinki, the terms promise 15 days' notice of a new sub-processor, and the privacy policy names Front and Stripe. The sub-processor list is drawn by script and we couldn't read it (12 of 20).

GPUsMarket 52

API and MCP reading. No OpenAPI or other machine-readable contract was found, and the MCP tool schemas couldn't be read because the published package is obfuscated; the repository's history says 2.4.7 added output schemas to all 32 tools, which is the vendor's claim (8). llms.txt as a complete API reference (10). llms.txt says when to use peer or cloud rentals, the proxy or the relay, and which workload each listing type serves (12). Parameters are listed by name without types, enums or required markers, apart from instance and workload types (6). curl examples for each flow, an error code list and a sample deploy response (11). npm versions, but no public changelog (5). 8+10+12+6+11+5 = 52.

Verda 72

api.verda.com's robots.txt answered 401 on 2 November 2026, so the OpenAPI document and the API reference there weren't read and the 8 October counts taken from them (112 operations, 156 schemas, 104 enums, 756 examples) are struck. The docs' changelog names the OpenAPI specification and its schemas (oneOf for UUID-or-array fields, the 19 March 2026 auth fix), and the Go and Python SDKs carry typed models, but no per-operation reference is readable on an allowed host (20 of 25). llms.txt on verda.com and docs.verda.com, every docs page as Markdown and the corpus in llms-full.txt (10). Docs guides and changelog entries describe what endpoints do and their billing effects, for example that shutdown keeps charging, while the reference descriptions are unread (10 of 20). Required fields and enums are visible only through the SDKs' typed models and validation, such as the Go SDK's limits added in v1.7.0, and the docs ask clients to treat enums as open (8 of 15). The docs corpus carries 62 curl examples and the Python SDK lists seven error codes, while per-operation error responses sit in the unread reference (9 of 15). Versioned in the path, with a dated changelog of 24 entries in 2026, the newest on 7 October (15).

GPUsMarket 69

gpusmarket 2.5.1 on 16 October 2026, 21 days before this check (30). Releases 2.4.18 to 2.5.1 between 17 August and 16 October, and gpusmarket-host 1.5.3 and 1.6.0 (20). Support by chat widget; the repository, which holds only a README, server.json and a licence, has no open issues and one star (5). Published in the official MCP registry under the verified io.github.jyswee namespace, though the newest registry version, 2.4.16, trails npm (12). No dependencies, but an obfuscated build and no public CI (2). 30+20+5+12+2 = 69.

Verda 83

Dated sources counted on 2 November. Go SDK verdacloud-sdk-go v1.7.0 on 28 October 2026, Python SDK verda 1.25.0 on 23 October, CLI v1.9.0 on 22 October, and the newest API changelog entry on 7 October (30). 11 dated API entries from 11 September to 7 October 2026, plus Go SDK v1.4.3, v1.5.0, v1.6.0, v1.6.1, v1.6.2 and v1.7.0, Python SDK 1.24.1 and 1.25.0 and CLI v1.8.1, v1.8.2 and v1.9.0 in the 90 days (20). A public changelog, monthly release notes, email and chat support and a forum. GitHub issues were not read (10 of 15). Current official clients for Python and Go, a Terraform provider and a CLI (15). The CLI repository runs lint, test and security workflows, and the Go SDK added a go fix check on 27 October 2026 (8 of 10).

GPUsMarket 50

API and MCP reading. The README counts 32 MCP tools, and the decoded package includes 16 operator admin tools besides the renter tools, with no toolsets (5). Marketplace search takes limit, offset, sort and filters for GPU, price, VRAM, model, instance and workload type (20). Status codes with a one-line meaning each, no error bodies documented (10). No idempotency key on rent or deploy; stop and destroy return a cost summary (5). Only a Node CLI, though every proxy speaks the Ollama and OpenAI formats so existing SDKs work (10). 5+20+10+5+10 = 50.

Verda 63

Read from the docs' changelog and the SDKs on 2 November, since the API reference host refuses our reader. No field selection, and instance and volume lists return whole arrays (12 of 25). page and pageSize with totals in X-Total-Count on scripts and journals, a cursor on the audit log, and status, tag and location filters on other lists, but no pagination on instances or volumes (12 of 20). Errors carry a stable code and a message, and bulk actions return per-item results with 207 (16). Actions that are already in the requested state return 204 and volume deletion is idempotent, but create calls have no idempotency key. The MCP tools require confirm: true for billed and destructive calls and carry no read-only or destructive annotations (10 of 20). Official SDKs for Python and Go, a Terraform provider and a CLI. A launch needs an instance type, image, hostname, SSH key and location (13 of 15).