New startup ideas · AI and software · Developer tools
startup idea
Sovern
Air-gapped coding agent infrastructure for defense and banks; the code graph never leaves.
Sovern is an on-premise runtime and API that lets a defense program office or a bank run coding agents against its entire repository history without a single token crossing the network boundary.
- Infrastructure and APIs
- Enterprise
- $10-100B market
- Creates a new category
- Global from day one
4/5
venture judge
41
similar startups, last 2 years (102 all-time)
95%
of 4 nearest real companies still alive
yes
8 matching federal grants and programs
Direction supported by government programs and grants
Test it before you build it
$1,600 · 6 weeks · 15 prospects
For under $1,700 and 6 weeks, prove that engineering leaders banned from hosted models will sign a dated design-partner LOI for a $25,000 read-only code intelligence pilot, before any appliance exists.
1Focus group: who and where
Director of Software Engineering, DevSecOps lead or Chief Engineer at a defense prime's software factory or a US bank above $50B in assets, operating under a written policy that bans sending source code to hosted models, while their developers watch peers at unregulated companies ship with coding agents.
where to find 15 · LinkedIn Sales Navigator (titles 'DevSecOps', 'Software Factory', 'Head of Developer Experience', 'Chief Engineer'; industries Defense and Space, Banking; US; 10,000+ employees), alumni of DoD software factories such as Platform One and Kessel Run findable by those org names on LinkedIn, NDIA and AFCEA local chapter meetings, and r/govcon.
2Sell first, build later
A 90-day on-site pilot: install the appliance inside one enclave against one named repository, deliver code graph queries and the full evidence record of every proposed and rejected change, strictly read-only, install starting within 60 days of vendor security approval.
the ask · $25,000 per 90-day pilot, invoiced on install and credited against a $150,000 first-year license
a real yes · A real yes is a signed LOI naming the repository, the pilot lead and a start month, with a purchase requisition entered into their procurement system. Not a yes: enthusiasm on calls, 'come back after your FedRAMP or ATO', unpaid demos, intros to the innovation office.
3Small experiments
The first one attacks the riskiest assumption; each ends with a number that says whether to run the next.
1. Policy and budget calls
$99 · 14 days
Founder books 15 thirty-minute calls via 200 Sales Navigator messages and two warm intro chains, using a 6-slide brief for a read-only code intelligence appliance that installs inside the enclave. Each call ends with two questions: does a written policy ban hosted models, and is there a named dev-tooling budget line this fiscal year.
keep going if · 10 of 15 confirm both the written ban and a named budget line
2. Auditor record prototype walkthrough
$100 · 10 days
Build a Figma clickable prototype of the two screens that matter: the resident code graph query view and the evidence record showing every proposed and rejected agent change. Walk it through on 10 second calls with the same prospects and ask who inside their organization would have to approve an install.
keep going if · 6 of 10 bring their security officer or compliance lead to the next call or request a written scoping document
3. Fake-door pilot scoping offer
$50 · 14 days
Send all engaged prospects a one-page PDF: 'Enclave Pilot: read-only code intelligence appliance, runs on your hardware, one named repository, 90-day evaluation, $25,000.' The only call to action is booking a 60-minute technical scoping session with their security architect present.
keep going if · 5 scoping sessions booked with security or compliance staff in the room
4. Design-partner LOI drive
$500 · 21 days
Bring a lawyer-reviewed one-page LOI to every scoping session naming the repository, the pilot lead, a start month and the $25,000 pilot fee payable on install. Founder asks for signature in the meeting, not by email afterward.
keep going if · 2 signed LOIs with a named repo and a dated start month
4Collect a deposit up front
Tesla took $1,000 refundable reservations for the Model 3 and $100 for the Cybertruck before building either: the deposit is the measurement, not the revenue.
$0
no cash yet: take a signed commitment
how · These buyers cannot move money before vendor security review and procurement, so collect instead: a signed design-partner LOI naming the repository, the pilot lead, a start month and the $25,000 pilot fee, plus a calendar-blocked scoping session with their security architect and a purchase requisition opened in their system.
what it reserves · One of 3 design-partner slots in the first install cohort, a locked $150,000 year-one license price, and their compliance scheme's evidence format built first.
refund · No money changes hands; the LOI expires automatically if the pilot has not started within 6 months of signature.
target · 2 signed LOIs with dated start months from 15 conversations within 6 weeks
Go: build it if
2 signed LOIs with named repos and start months, plus 10 of 15 prospects confirming both the written hosted-model ban and a current budget line.
Kill: stop if
0 LOIs after 15 conversations and 5 scoping attempts, or fewer than 5 of 15 prospects having both the ban and any budget authority.
Would you run this test?
One tap. The yes-share feeds the Demand pillar of this idea's score; nobody sees who answered.
Budgets are out-of-pocket estimates for a team of one to three, US market. Size the deposit to the deal, and check the terms before taking money in a regulated line.
Scorecard
One score that balances how trendy the idea is, the demand for it and its potential for 100x, with competition measured relative to every other idea in the catalog. Recent startup trends first, government priorities second.
60
Idea Score, 0-100 · raw 36.3 x 1.64
Crowded
competition: more crowded than 96% of ideas · headwind x0.52
+3.8
government priorities, secondary (39 matching grants)
Trend
45
Is the wave forming now? 2025-26 entrants vs 2023-24, rounds since 2025, the sector's live-batch direction, the 2026 trend analyst.
- Entrants 2025-26 vs 2023-24 (similar companies)56
- Rounds announced 2025+ in the sector25
- Sector direction (live batch)50
- 2026 trend analyst50
Demand
68
Does anyone want it? YC's current RFS, companies already paid for something similar, the operator judge, founders' yes-rate in decks, readers who would run the test.
- YC asks for it (current RFS: idea / sector)30
- Someone already pays (similar companies, recent / all-time)100
- Operator judge: real pain75
100x potential
79
Can it return a fund? The venture judge (double weight), market-size and moat axes, neighbours still alive, the technologist judge.
- Venture judge75
- Market size axis67
- Moat axis100
- Neighbours still alive59
- Technologist judge100
Score = 100 x cbrt(Trend x Demand x 100x) x (1 - 0.5 x crowding) + government bonus (max 5), calibrated so the 95th-percentile idea scores 90 (order never changes). A geometric mean: a weak pillar cannot be papered over. Percentiles are among the 272 ideas in the catalog; the terms matched were air-gapped, coding, infrastructure, defense, banks, code, graph, on-premise.
The idea in full
- What
- Sovern is an on-premise runtime and API that lets a defense program office or a bank run coding agents against its entire repository history without a single token crossing the network boundary. It builds a resident code and dependency graph inside the enclave, distills a small model against that graph, and exposes the same endpoints an agent harness expects, plus a full record of every proposed and rejected change for the auditor. Deployment involves engineers on site inside accredited facilities, which is why the sales motion is founder-led and the install takes months.
- Why now
- Two companies in the yc S26 batch alone attack the pieces separately: Graphify Labs with an on-device knowledge graph engine for enterprises and Hoplite with deploying cloud software factories; meanwhile only 85% of the 798 tracked companies in this cluster are still alive and average AI-visibility sits at 47/100, so the buyers with the strictest data rules have the fewest credible vendors.
- Wedge: first customer and entry point
- One software factory at a single prime contractor that is banned from sending source to a hosted model, sold as a read-only code intelligence appliance before any write access is granted.
- Path to 100x
- Enterprise development tooling plus regulated and defense IT is a $10-100B market where the strictest buyers currently cannot use agents at all, so the category being created is the sovereign coding substrate rather than another assistant. Every rejected and accepted change inside every enclave feeds a cross-customer model of what regulated reviewers refuse, a data moat that hosted vendors structurally cannot assemble because they never see inside the boundary.
- Ceiling
- Air-gapped deals are few, slow and lumpy; if the customer count stalls in the low hundreds the business looks like a high-margin government contractor rather than infrastructure.
- Closest real companies, as the generator saw them
- Graphify Labs sells an on-device knowledge graph but not an agent runtime, Hoplite deploys software factories in the cloud, Jcode builds the harness and Mentlio measures token spend; none of them holds the accreditation-facing evidence record that lets a regulated program approve agent-written commits.
- Main risk
- Frontier model vendors ship a certified air-gapped deployment and Sovern degrades into an integration layer on top of it.
Five judges
Each judge scores every idea in the catalog with a named rubric; the venture judge decides whether a card is shown at all (4-5 is venture-grade).
Venture investor
4/5
Sovereign coding substrate for banks and defense in a $10-100B market with an inside-the-enclave data moat hosted vendors cannot replicate.
Bootstrapper
2/5
Defense enclave installs take months with engineers on site, so revenue is lumpy six-figure deals gated by accreditation calendars.
Operator
4/5
A prime contractor banned from sending source to a hosted model has a hard blocker, and read-only code intelligence lands before any trust is needed.
Technologist
5/5
A resident code graph plus a model distilled inside the enclave is hard engineering, and the rejected-change corpus is data hosted vendors structurally cannot see.
Risk
3/5
On-premise enclaves and an auditor-facing evidence record fit regulated buyers, but revenue rests on a few lumpy prime contractor deals in the low hundreds.
trends
3/5
Working coding agents are a real 2025 shift and defense fits the RFS, but frontier vendors shipping certified air-gapped deployments is already closing this window.
Similar startups in the directory
Companies whose pitch matches most of the idea's terms (air-gapped, coding, infrastructure, defense, banks, code, graph, on-premise): 102 all-time, 41 from the last two years. Same matching as Idea Check.
On-device knowledge graph engine for enterprises
Frontier AI Defenses for Social Engineering Attacks
Financial infrastructure for the agent economy
Dynamic access controls for all data and databases
Prevent Fraud and Onboard Users Faster
WeWeb is a no-code front-end builder that connects with any back-end.
Secure Collaboration for Technical Teams
Use Radiant's control plane to easily deploy, manage, and scale generative AI features for critical workflows
The translation layer between AI agents and the web
Nervous System for AI Agents
Hosting platform for software you don't want to have hacked
Supply chain compliance and cost savings
The generator's reference companies
Real companies the model named as closest when it wrote the card, with their fate. A check mark is a company the radar could verify in its directory.
Public money in this direction
US federal grants, SBIR/STTR awards and open opportunities from the radar's public-money feed, matched to the idea's terms; the sector totals give the context.
8
grants and programs matching the idea
117
startup-relevant grants in Developer tools
$67M
awarded in the sector, tracked
1
opportunities open now in the sector
- CAREER: Towards Automated Vulnerability Management: Vulnerability Discovery, Localization, and Continuous Monitoringawardhigh relevance
National Science Foundation · Secure &Trustworthy Cyberspace · $625K · posted 2026-03-26
- In vivo CAR therapies for lupus treatment using selectively expressed genetic payloads in immune-cell-biased lipid nanoparticlesawardhigh relevance
NIH / NIAID · SBIR phase I · $307K · posted 2026-08-14
- SBIR Phase I: AI-Driven Cloud Application Programming Interface for Quantum-Accurate Materials Simulationawardhigh relevance
National Science Foundation · SBIR Phase I · $305K · posted 2026-08-11
- Collaborative Research: SaTC 2.0: RES: AIGIS: Securing the Deep Learning Model Supply Chainawardmedium relevance
National Science Foundation · Secure &Trustworthy Cyberspace · $400K · posted 2026-05-19
- Collaborative Research: SaTC 2.0: RES: AIGIS: Securing the Deep Learning Model Supply Chainawardmedium relevance
National Science Foundation · Secure &Trustworthy Cyberspace · $410K · posted 2026-05-19
- Collaborative Research: SaTC 2.0: RES: AIGIS: Securing the Deep Learning Model Supply Chainawardmedium relevance
National Science Foundation · Secure &Trustworthy Cyberspace · $410K · posted 2026-05-19
National Science Foundation · Research on Research Security · $300K · posted 2026-08-07
- Collaborative Research: GEER - Collecting and Archiving AI-ready Perishable Data for Geotechnical Engineering Natural Hazards Researchawardmedium relevance
National Science Foundation · ECI-Engineering for Civil Infr, Special Initiatives · $2M · posted 2026-08-20
Market signal
What the radar sees in Developer tools: new companies by cohort year, the forming YC batch, and outcomes since the February snapshot.
Developer tools · 61 → 102 → 121 → 88 → 44 new companies 2022 → 2026 · 88% aliveYC S26: 8 in this cluster, 3% of the batch (was 5% in X26) (F26 is still forming: 21 listed)Since February, of 475 YC companies here: 5 acquired, 5 shut down, 47 rewrote their pitch
Design attributes
The card is one cell of a designed set: every axis below was chosen before the text was written, and the text had to realize it.
- Buyer
- Enterprise
- Business model
- Infrastructure and APIs
- Path to 100x
- Creates a new category
- Market size
- $10-100B market
- Capital intensity
- Capital-medium (ops, field teams)
- Speed to revenue
- Revenue in 1-3 years
- Technical depth
- Deep tech: ML, hardware, bio
- Go-to-market
- Founder-led sales
- Moat
- Data moat
- Geography
- Global from day one
- Regulation
- Heavily regulated
- Vibe
- Boring business
Listed under
An idea sits in its own sector and in any sector its text clearly touches.
More ideas like this
AI and software · Developer tools
Faultline
An incident agent that learns every production failure across its customers, then fixes yours.
Faultline runs as an on-call agent inside a large company's production environment: it reads traces, logs and deploys, reproduces the failure in a sandbox, and proposes or applies the fix.
AI and software · Developer tools
Reglet
Regulatory intelligence APIs that tell coding agents what the law requires.
Reglet is an API layer that maps code changes to regulatory obligations - HIPAA, PCI-DSS, GDPR, banking rules - in real time, so a bank's or hospital's coding agents and CI pipelines know when a diff touches regulated data flows and exactly what evidence to attach.
AI and software · Developer tools
Patchwright
An upgrade agent that keeps small software companies current, with a recipe store others fill.
Patchwright is a hosted agent that watches a small software vendor's repositories and does the maintenance work nobody staffs: dependency and framework upgrades, breaking API migrations, deprecation fixes, and the evidence trail for SOC 2, GDPR and accessibility questionnaires that their own customers demand.
AI and software · Developer tools
Appcroft
The operating layer that keeps small businesses' AI-built apps running.
Appcroft hosts, patches, monitors and integrates the AI-generated apps that small businesses now get built by freelancers and dev shops using tools like Lovable.
AI and software · Developer tools
Miniplex
The cloud built for a billion small apps.
Miniplex is purpose-built cloud infrastructure for agent-generated software: sub-second cold-start microVMs, per-app metering in fractions of a cent, and a deploy API that coding agents and app builders call directly.
AI and software · Developer tools
Portway
A machine-readable catalogue of every internal enterprise app, so agents can use them.
Portway is a subscription platform where a large company describes its internal applications once, in a no-code editor, as capability manifests: what each app does, which actions it exposes, who may call them, and what the fields mean.
Fictional company written 2026-08-22 from MarkosWeb data; the companies, grants and numbers around it are real and tracked. Treat the idea as a research prompt, not a plan.