HunkGuard

Idea

A GitHub CI check that catches what AI coding agents specifically get wrong in a pull request, before a human reviewer has to. HunkGuard cross-checks every diff hunk against the linked Jira or Linear ticket, flags newly imported packages that do not actually exist on npm or PyPI, and flags quality-regression patterns like broad exception swallowing. It posts one scored report per PR instead of a wall of generic line comments.

Market gap

AI coding agents (Copilot, Cursor, Claude Code, Windsurf) now author a large and fast-growing share of pull requests, and existing AI review tools (GitHub Copilot Code Review, CodeRabbit, Greptile, Qodo) are general-purpose bug and style checkers. They were not built to name and hunt for the failure modes that are specific to agents: hallucinated library calls, diff hunks that quietly go beyond what the ticket asked for, and defensive code that masks errors instead of fixing them. GitHub's own engineering blog now names "silent scope creep" as a top failure pattern in agent PRs and says "every hunk must trace back to the request." A handful of players (Bito, Atlassian Rovo Dev) already check diffs against linked tickets, but none brand or build around AI-agent failure signatures as a first-class, explainable category, they frame it as generic acceptance-criteria coverage. The timing is now: GitHub is publicly weighing platform-level rate limits on agent PRs because reviewer capacity cannot keep up, and independent data shows the code these agents produce is measurably getting harder to trust, not easier.

Total Addressable Market (TAM)

Bottom-up:

• GitHub Copilot Business/Enterprise: 50,000+ paying organizations (aggregator-reported figure, cross-check before external use).
• Cursor: an estimated 30,000 to 50,000 paying teams (midpoint 40,000, aggregator-reported).
• Assume 25 percent overlap between the two pools: 50,000 + 40,000 x 0.75 = 80,000 unique orgs paying for at least one AI coding tool at team tier.
• Assume 40 percent of those are the 5 to 50 developer SMB/mid-market shape this product targets (stated assumption, not independently sourced): 80,000 x 0.40 = 32,000 target orgs.
• Assume an average of 10 paid reviewer seats per org (not every developer, just PR authors/reviewers who need the check) at $25/seat/month, in line with CodeRabbit ($24/seat/mo) and Greptile ($30/seat/mo): ACV = 10 x $25 x 12 = $3,000.
• TAM = 32,000 x $3,000 = $96M.

SAM: orgs already primed to buy this category, i.e. already paying for a general AI PR review tool and therefore already budget-holders for this line item. Assume 30 percent of TAM orgs: 9,600 orgs x $3,000 = $28.8M.

SOM: a realistic 3-year capture for a small team, 1 percent of SAM: roughly 96 orgs at $3,000 ACV = $288K ARR, with a Year 1 target of 50 paying orgs ($150K ARR) as the on-ramp.

Sources for the developer/tool population figures: Evans Data 2025 professional developer estimate (https://evansdata.com/press/viewRelease.php?pressID=365), Greptile's competitor roundup for market context (https://www.greptile.com/content-library/best-ai-code-review-tools), CodeRabbit/Greptile pricing pages (cited in Competitors section).

Monetization strategy

Seat-based SaaS subscription, billed monthly or annually, sold to the engineering org (not the individual developer). The org connects its GitHub repos once; every developer whose PRs get scanned needs a seat. Retention comes from the product living inside the merge path: once a team's CI gate depends on the HunkGuard check, churn means re-opening a gap they already know they have.

Pricing strategy

• Starter: $29/seat/month, up to 10 seats, GitHub only, one ticket-tracker integration. Entry point for a single small team.
• Team: $39/seat/month (anchor plan), unlimited seats, multi-repo, Slack/Jira/Linear integrations, custom failure-signature thresholds.
• Enterprise: custom pricing, SSO, audit logs, VPC/self-hosted scanning, SLA.
• Annual billing at a 20 percent discount to push commitment past the trial period.

Lead magnet

A free, no-signup "AI Diff Risk Score" web tool: paste a public GitHub PR URL and get an instant one-time scan showing hallucinated-import risk and an unmapped-scope percentage, capped at 5 scans a day per IP. It demonstrates the exact detection mechanism the paid product runs continuously in CI.

Social proof that the problem exists

• OpenAI Codex GitHub issue #8644, a filed bug report of a Codex agent making a destructive, out-of-scope revert mid-PR: https://github.com/openai/codex/issues/8644 (direct first-party evidence of the scope-creep failure mode).
• GitHub's own engineering blog names "silent scope creep" as a top failure pattern in agent-authored PRs and states every hunk must trace back to the request: https://github.blog/ai-and-ml/generative-ai/agent-pull-requests-are-everywhere-heres-how-to-review-them/
• InfoWorld reports GitHub is considering platform-level PR rate limits because AI-agent PR volume is overwhelming maintainer review capacity: https://www.infoworld.com/article/4127156/github-eyes-restrictions-on-pull-requests-to-rein-in-ai-based-code-deluge-on-maintainers.html
• Hacker News thread "There is an AI code review bubble," where commenters describe current AI review tools as producing "20 highly speculative reasons" alongside the one real error, with no understanding of business or architectural constraints: https://news.ycombinator.com/item?id=46766961
• USENIX Security 2025 research on LLM package hallucination, summarized by Snyk: across 2.23M generated code samples, 19.7 percent contained at least one hallucinated package: https://snyk.io/articles/slopsquatting-mitigation-strategies/
• GitClear's "The Maintainability Gap" report, analyzing 623M code changes from 2023 to 2026: broad error-masking constructs (try/catch, etc.) up 47 percent, code duplication up 81 percent, refactoring activity down from 21 percent to 3.8 percent of commits: https://www.gitclear.com/the_ai_code_quality_maintainability_gap

Competitors

• GitHub Copilot Code Review: agentic, repo-context-aware, 60M+ reviews processed, now billed via GitHub Actions minutes. General bug/security/perf review, no ticket cross-check, quality drops on large diffs.
• Cursor Bugbot: reviews for "real bugs" only inside the Cursor editor workflow, priced around $20 to $40/seat/month. Tied to Cursor usage, no intent verification.
• Greptile: full-codebase context (not just the diff), benchmarked to catch more bugs than CodeRabbit, $30/seat/month. Bug-detection focused, not spec/ticket matching.
• CodeRabbit: diff annotation and PR walkthroughs across GitHub/GitLab/Bitbucket/Azure DevOps, $24/seat/month. General review and summarization.
• Qodo (formerly CodiumAI): multi-agent review (bugs, quality, security, test coverage) plus a custom rules engine for team standards. Rules-based, not per-PR ticket diffing.
• Bito and Atlassian Rovo Dev: both already check PR diffs against linked Jira tickets for acceptance-criteria coverage. Closest direct competitors, but they frame the feature as spec compliance, not as AI-agent-specific failure detection (hallucinated dependencies, error-masking patterns).

What competitors offer now

Every major player ships either general bug/style/security review (Copilot, CodeRabbit, Greptile, Qodo, DeepSource) or acceptance-criteria matching against a ticket (Bito, Rovo Dev). None combine registry-verified hallucinated-dependency detection, hunk-level scope mapping, and quantified quality-regression pattern checks into one scored, explainable report built specifically around how AI agents fail. Reviewers on Hacker News describe the existing tools as noisy: many speculative flags surrounding the one real issue.

What can be done differently to attract customers

Lead with the free public "AI Diff Risk Score" tool so any developer can see their own team's or a competitor's public repo scored in seconds, no signup. Distribute through the exact threads where this pain is already being discussed (r/ExperiencedDevs, the Hacker News "AI code review bubble" thread, GitHub agent-PR discussions) with the free tool as the reply, not a pitch. Position explicitly against "another AI reviewer" fatigue: one scored report, three named failure categories, not twenty speculative comments.