Thunder Compute vs Together GPU Clusters

Thunder Compute 65

Graded on the hosted lines for the REST API and the hosted MCP server. Thunder Compute's terms bar robots, scrapers and data-gathering tools on the Services, so its site, status page and API host weren't requested on 4 November and the readings below are per the 9 October check, not re-read on 4 November. Status page on incident.io at status.thundercompute.com with Website, API and Instances components and monthly history (20). No incidents listed for July to 9 October 2026. The rest of the window is unread and not credited, so the line keeps its recorded award (30). No rate limits with numbers were found in the docs or the OpenAPI document (0). No 429 or retry guidance in the docs. The CLI source reads a Retry-After header on errors, adding a duplicate SSH key is a no-op and port updates are atomic, but instance creation has no idempotency key (5 of 15, a partial value kept and flagged). No SLA found, and the terms say availability is not guaranteed (0). The API and MCP server carry no beta label (10). 20+30+0+5+0+10 = 65.

Together GPU Clusters 38

Read with the hosted lines. status.together.ai lists the website, the playground and serverless models with no component for GPU clusters, and a vendor page with no component for the product takes 15 in this run, as for Together's Code Sandbox and fine-tuning listings (15). No incident history for clusters can be read (5). No rate limits for the clusters API found (0). Together's docs give 429 and 503 backoff guidance for its APIs, per the inference listing's 1 November check, and the CLI has --non-interactive and --json for scripted retries, but creation has no idempotency key (8). No SLA for clusters found; the published 99% commitment covers provisioned inference throughput only (0). Generally available since 9 September 2025 and out of the CLI's beta paths since 22 October 2026, with preemptible nodes in preview (10). 15+5+0+8+0+10 = 38.

Thunder Compute 70

Public OpenAPI 3.1 document at api.thundercompute.com:8443/openapi.json with 41 operations and 72 schemas (25). llms.txt, llms-full.txt and a Markdown copy of every docs page (10). 28 of 41 operations have a description. Instance operations state side effects such as the private key being returned once, while most sandbox operations have a summary only (12 of 20). Required fields are marked, but the document has six enums, gpu_type and template are free strings and the instance list is a map keyed by ID (8 of 15). 12 examples and one error schema with code, error and message. Most operations document 400, 401 and 500, and none documents 429 (9 of 15). /v1 and /v2 paths, with legacy endpoints and the mode field marked as retained or deprecated. No API changelog was found. The CLI has a dated one (6 of 15). No published copy of the MCP tool definitions was found, so they were not read. All of this is per the 9 October check, not re-read on 4 November. 25+10+12+8+9+6 = 70.

Together GPU Clusters 92

Public OpenAPI 3.1 for /v1/compute/clusters and shared volumes, MIT, embedded in every reference page (25). llms.txt and a Markdown twin of every page (10). The docs say when to choose Kubernetes or Slurm and each capacity type, and the management page carries instructions for agents on reporting live availability and prices (18). Enums for cluster type, billing type, GPU type and status, required fields marked (13). CLI, Python, TypeScript and console steps on each task, with 402 and 403 cases documented, though no error catalogue for the clusters API (11). Versioned SDKs and a dated changelog with cluster entries (15). 25+10+18+13+11+15 = 92.

Thunder Compute 51

The MCP server uses OAuth 2.0 with discovery, refresh tokens and ten scopes that separate read from write for instances, snapshots and sandboxes. The REST API uses named API tokens that are created and revoked one at a time, with no scopes found. No secret travels in a URL (25 of 30). Read scopes exist, and the CLI requires --yes to delete without a prompt. No confirmation step for delete_instance or delete_snapshot was found in the MCP docs, and both are described as irreversible (8 of 20). Responses are infrastructure metadata, except run_command output and sandbox logs, with no guidance found on untrusted output (8 of 15). GET /tokens returns creation and last-used times and sandbox logs are listed by API. No audit log was found (4 of 15). No security.txt, disclosure policy or bug bounty was found. llms.txt states SOC 2 Type II and GDPR compliance with no report or trust page linked, and the DPA promises an audit summary on written request and incident notice within 72 hours (6 of 20). The site readings are per the 9 October check, not re-read on 4 November. 25+8+8+4+6 = 51.

Together GPU Clusters 68

Project-scoped API keys, revocable with optional expiry, read as Together's other listings read the same key model (30). Admin and editor roles with no read-only role. Only admins get the admin kubeconfig, which has cluster-admin rights, and OIDC lets editors use kubectl under RBAC. Deletes run without confirmation when --non-interactive is passed (8). The API returns cluster state, not third-party content (10). Invoices itemise reserved, on-demand and storage charges, and no audit log for cluster operations was found (5). security.txt with a HackerOne route, per the 1 November check of the inference listing (15). 30+8+10+5+15 = 68.

Thunder Compute 48

No field selection, and GET /instances/list returns every instance in one map. The MCP server has 28 tools in one set, with no toolsets found (12 of 25). limit up to 100, page_token and a status filter on sandboxes and sandbox logs. No pagination on instances, snapshots or keys (8 of 20). Errors carry a numeric code, a string error such as invalid_request and a message, documented per operation (14 of 20). Duplicate SSH keys are a no-op and port changes are deduplicated in one transaction, but create calls have no idempotency key. MCP tool annotations were not read (7 of 20). A create call needs five fields. The official Python SDK covers sandboxes only, and the Go CLI covers instances (7 of 15). All of this is per the 9 October check, not re-read on 4 November. 12+8+14+7+7 = 48.

Together GPU Clusters 55

Cluster objects are compact, and --json gives machine-readable output, but list calls take no field selection (15). No pagination or filters on the clusters list (8). 402 and 403 with readable messages such as "Insufficient credits for cluster creation", and troubleshooting for common failures (12). Status polling until Ready is documented and deletes run non-interactively, but there is no idempotency key on creation and a duplicate create bills a second cluster (8). Official Python and TypeScript SDKs and a CLI, though a create takes GPU type, region, driver and CUDA versions, cluster type and billing type (12). 15+8+12+8+12 = 55.