Review layer for AI-written code gluts

What to build

A GitHub App / CI check that scans AI-generated pull requests (from Copilot, Cursor, Claude Code, etc.) and produces a risk score flagging duplicated logic, hallucinated or non-existent API calls, and security issues before merge — built for solo founders and small dev teams shipping fast without time for manual review.

AI coding agents are flooding repos with more code than teams can manually vet, creating room for a lightweight, automated pre-merge risk-scoring layer purpose-built for AI-generated diffs rather than generic static analysis.

Demand

Solo founders and small teams who've adopted Copilot/Cursor/Claude Code to ship fast are the buyers — they've traded review rigor for speed and now need a cheap automated backstop instead of hiring a reviewer or slowing down.

• Hacker News / Ars TechnicaNews

  "AI coding agents generate more code, but not more software" drew 314 points and 275 comments on Hacker News, indicating high engagement with the underlying problem among developers.

• Industry commentary on AI coding agent adoptionNews

  Reports suggest AI coding agents have sharply increased raw code output per developer without a proportional rise in shipped, functioning software.

• Developer tooling market observationNews

  Anecdotal reports of AI-generated PRs containing duplicated logic, hallucinated API calls, and inconsistent patterns that currently require manual catch before merge.

• Existing AI code review startups (CodeRabbit, Greptile, Qodo)Other

  Multiple funded startups already sell AI-focused PR review as a product, indicating teams are willing to pay for this category even though none specifically positions itself as an AI-agent-output risk scorer.

Stack

• GitHub Apps API / Webhooks
• Claude API or OpenAI API for diff analysis
• tree-sitter for AST-based duplication detection
• GitHub Actions for CI integration
• Postgres/Supabase for scan history and scoring
• Probot or similar GitHub App framework

Solo + AI difficulty

The GitHub App scaffolding, webhook handling, and LLM-based diff review are all very doable solo with AI assistance in 2-4 weeks for an MVP; the hard part is tuning the risk score to avoid high false-positive rates (which kills trust fast) and reliably detecting hallucinated APIs without just re-running existing linters.

Entry threshold

Buildable solo as a GitHub Action or App wrapping an LLM for PR analysis within a few weeks; the real barrier is distribution and standing out against several already-funded AI code review startups.

Window

6-12 months

Where to find first users

• GitHub Marketplace listing
• r/ExperiencedDevs and r/webdev
• Product Hunt launch
• Indie Hackers and solo-founder Discord/Slack communities
• Twitter/X AI-coding community (Cursor, Claude Code user bases)

Competitors

• CodeRabbit
• Greptile
• Qodo

Counter-signals & risks

• Existing static analysis, linting, and code review tools (SonarQube, CodeQL, GitHub Advanced Security) already cover much of the duplication/security detection surface, raising competitive barriers for a new entrant.

• AI coding agent vendors themselves (GitHub, Cursor, Anthropic) may build native review/risk-scoring features directly into their products, disintermediating a standalone third-party layer.

• Measuring 'software produced' vs 'code generated' is inherently fuzzy and hard to quantify, weakening the empirical basis of the core claim and making the problem harder to market concretely.