Compliance scanner for banned foreign AI models

What to build

A command-line and SaaS scanner that audits codebases, IaC/cloud configs, and SaaS integrations for direct and indirect DeepSeek usage (model names, API keys, wrapper SDKs, proxied endpoints, fine-tuned derivatives), then generates a compliance report for federal contractors who must attest to removal.

A US order forcing every civilian agency to strip out DeepSeek, including anything built on top of it, creates urgent, hard-to-satisfy demand for an automated way to find and prove removal across code and infrastructure.

Demand

Federal contractors, GRC teams, and agency IT compliance officers now need to audit sprawling codebases and SaaS stacks for DeepSeek dependencies they may not even know exist, and they need to do it fast to stay compliant.

• Hacker NewsSignal

  65 points, 38 comments on HN for the story 'The US orders every civilian agency to rip out DeepSeek, even tools built on it' — high engagement indicating strong interest in the scope and compliance burden of the order.

• Regulatory signal reportNews

  The directive explicitly extends beyond direct DeepSeek usage to tools built on top of it, meaning agencies and contractors cannot rely on a simple vendor checklist and need actual code/infra-level detection to attest compliance.

Stack

• Semgrep (custom rules for DeepSeek SDK/API signatures)
• Syft/Grype (SBOM and dependency scanning)
• GitHub/GitLab API (repo scanning integration)
• Supabase (scan results, auth, multi-tenant storage)
• Next.js (compliance dashboard and report generation)
• Stripe (billing for contractor/GRC customers)

Solo + AI difficulty

Detecting direct usage (import statements, API endpoints, model identifiers like 'deepseek-*') is straightforward with Semgrep/grep-based rules and doable in days; reliably catching indirect usage (proxied APIs, white-labeled wrappers, fine-tuned derivatives) is genuinely hard and will require heuristics plus manual review, so expect a 1-2 week MVP for direct detection and ongoing iteration for indirect coverage.

Entry threshold

The scanning logic itself is a straightforward static-analysis and dependency-graph tool buildable solo in one to two weeks with AI help, but reaching government contractors and compliance buyers requires credibility and outreach rather than pure self-serve signup.

Window

3-6 months

Where to find first users

• r/govcon
• FedRAMP and GRC consultant LinkedIn groups
• Federal contractor Slack/Discord communities
• Cold outreach to compliance officers and SBOM/SSDF-focused consultancies

Competitors

• Vanta
• Snyk

Counter-signals & risks

• No historical precedent match was found for this signal, suggesting it may be a novel or unverified regulatory action that could be overstated, reversed, or narrower in scope than reported.

• Detecting indirect/wrapper usage of DeepSeek across codebases and SaaS stacks is technically difficult (proxied APIs, fine-tuned derivatives, white-labeled integrations), which may limit the feasibility and accuracy of a compliance scanner.

• The order may apply narrowly to civilian federal agencies only, limiting the addressable market mainly to federal contractors rather than the broader private sector.