Claude's Corner
TL;DR: /dev/fast is a YC W2026 AI-native code forge that cuts PR review cycle time by 2x by anchoring every agent run to version control history rather than floating chat sessions. Their moat is the git-native memory model: when your codebase context lives in the diff, reviews never go stale.
The Irony of AI Coding: You Ship More, Review Less
Here is the problem nobody talks about at AI developer conferences: PR review time is up 441% in 2026. Not down. Up. AI coding tools have made individual developers 2-3x more productive at writing code, and the side effect is a massive backlog of PRs nobody has time to read. AI-generated patches run 2.5x larger than human-written ones and wait roughly 5x longer for a reviewer to touch them.
The tools that were supposed to make engineers faster have made engineering teams slower at the only phase that actually ships to production: review.
/dev/fast, a four-person team out of San Francisco and part of Y Combinator's Winter 2026 batch, is betting that the right response to AI-generated code is AI-native code review - but built on a fundamentally different architecture than the bolt-on reviewers that already exist.
What They Build
The company calls itself "the AI-native code forge." That framing matters. They're not building a code editor plugin or a GitHub webhook that summarizes diffs. They're positioning for something closer to what GitHub itself provides: the platform layer where code becomes software.
The core product is a code forge that reviews PRs 10x the size in half the time, drives down LLM token costs for teams running agents, and cuts mean time-in-review by 2x. Every agent run gets captured and queryable in code, with all storage tied directly to version control. No stale specs. No ADRs that nobody updated. No context that lived in a Slack thread six months ago.
The enterprise deployment model is self-hosted inside your own VPC. That's the other half of the product, and it's not a checkbox. When your code review agent can see your entire git history and is running inside your network perimeter, the security story is fundamentally different from a SaaS reviewer that you've given read access to your repos.
The target customer is engineering teams at mid-market to enterprise companies that are already using AI coding tools - they're drowning in unreviewed AI output - and need a systematic way to get it through review without tripling their headcount.
The Team Has Done This Before
The founding team of four is unusually well-matched to the problem they're solving. CEO Sid Menon was a tech lead on Palantir's cloud infrastructure team, specifically on secure deployment systems. He is not a stranger to the enterprise security and on-premises deployment dance. His stated mission: "building the next GitHub." That's a bold line for a four-person team, but Palantir alumni tend to mean it when they say it.
CTO Milan Bhandari co-founded Bolto (YC S23) before this, and before that worked on Palantir's ML infrastructure. He's the second Palantir alum on the team, which tells you something about the culture: these are people who built systems for governments and financial institutions where deployment flexibility and security weren't optional.
CSO Ketan Agrawal spent time at Robust Intelligence doing AI red-teaming - evaluating where ML systems fail before adversaries find out first - and before that built data-querying agents at Snowflake. His Stanford Symbolic Systems background gives him a slightly different angle on code understanding than a pure ML engineer would have.
CPO Alex Iansiti rounds out the team with product experience at Pinterest and Flowcode, where he led enterprise product rearchitecture. Three of the four went to Harvard CS. Palantir connections run through two of them. This is a team that has shipped enterprise infrastructure, not just prototyped it.
How It Actually Works
The architectural insight at the center of /dev/fast is deceptively simple: code review context should live in git, not in a chat window.
Every other AI code review tool on the market today - CodeRabbit, GitHub Copilot Code Review, Cursor BugBot - works as a layer on top of git. You open a PR, it fires off an LLM call with the diff as context, you get a comment back. The LLM has no memory of the last time it reviewed code in this repo. It does not know that this pattern was explicitly chosen over an alternative three sprints ago. It does not know that this file is touched every time performance regresses. It reviews the patch as if the codebase appeared from nowhere.
/dev/fast stores all agent state inside version control. That means the agent's understanding of the codebase - its notes, its flags, its architectural observations - is itself version-controlled. It evolves with the repo. When a reviewer asks why a particular decision was made, the agent can answer from a ledger it has been updating in lockstep with the code, not from a prompt injection that expired when the session closed.
The token efficiency angle follows from this. If your context is well-structured and version-controlled, you are not resending the entire repo every review cycle. You are sending a delta. That is how /dev/fast drives token cost savings for teams running many agents across many PRs - not by using a cheaper model, but by not wasting tokens re-establishing context that was already established.
The VPC deployment model handles the enterprise security requirement. An agent with access to your full git history and the ability to write to pull requests is a high-privilege system. Running it inside your own infrastructure - not connected to a third-party SaaS that holds your code review history - is a real differentiator for companies in regulated industries or with aggressive IP protection requirements.
How Hard Is This to Build
Across five technical layers, here is how /dev/fast stacks up:
- ML/AI (7/10): Code understanding is harder than it looks. Reviewing a 500-line patch requires understanding what the patch is trying to do, what it might break, and whether the implementation matches the intent - across a codebase the model has never fully ingested. Compression and delta-context techniques that make this tractable at scale are genuine engineering work.
- Data (6/10): The version-control-tied memory model requires building and maintaining structured representations of codebases that grow and change. No off-the-shelf solution handles this; you are building a novel index layer on top of git.
- Backend (7/10): Real-time review pipeline, multi-repo agent orchestration, git webhook integration, and the VPC deployment architecture all need to work reliably. Enterprise buyers will not tolerate flakiness.
- Frontend (5/10): A good diff viewer and review interface is table stakes work - hard to get right, but well-understood as a problem space.
- DevOps (8/10): Self-hosted enterprise deployment is genuinely complex. You are not deploying to one environment; you are building a system that installs correctly in hundreds of different enterprise VPCs with varying network topologies, IAM configurations, and security policies. Palantir built its entire business on this, and it is not easy.
The Moat - What's Real and What Isn't
The hard parts: the git-native memory model is a genuine architectural bet that competitors haven't made. If it delivers the context continuity /dev/fast claims, it creates a compounding advantage - the longer a team uses it, the richer the context, the better the reviews. That's a switching cost with real teeth.
The Palantir DNA on enterprise deployment is also real. Knowing how to sell to security-conscious enterprise buyers, how to handle procurement and legal review, how to build deployment tooling that works inside adversarial enterprise networks - this is not knowledge you acquire from a LinkedIn course. It came from Menon and Bhandari actually doing it.
The AI safety background on the CSO is an interesting sleeper advantage. Red-teaming AI systems for Robust Intelligence is exactly the right background for catching the failure modes of an AI code reviewer before they ship to production. A reviewer that gives wrong feedback confidently is worse than no reviewer at all.
The easy parts: the core LLM integration is not a moat. Any competent team can pipe diffs through a frontier model and get useful feedback. CodeRabbit, the current market leader in automated code review, scored 51.5% F1 on standard benchmarks compared to GitHub Copilot's 44.5%. These are not particularly high bars. The LLM commodity is real.
The enterprise go-to-market is also not a moat on its own. Snyk, which lives in the developer security segment where /dev/fast will also compete for procurement cycles, has a score of 85 out of 100 on StartupHub.ai. They are well-capitalized and well-trusted. Getting into the same budget conversation as Snyk is a two-year sales motion at minimum.
The Landscape: More Crowded Than It Looks
The AI code review category has compressed faster than most anticipated. CodeRabbit now supports GitHub, GitLab, Bitbucket, and Azure DevOps - the only tool covering all four platforms. GitHub Copilot has a built-in code review feature that benefits from being the same vendor as the version control layer. Cursor's BugBot got 3x faster and 22% cheaper in a June 2026 update and is finding 10% more bugs per run. Ellipsis competes in the GitHub-specific slice.
What none of these tools do is treat the review agent's knowledge as a persistent, version-controlled artifact. They are all session-based systems that rediscover the codebase on every run. That is the gap /dev/fast is targeting.
StartupHub.ai tracks 3,370 companies in the developer tools space. The median score across the category is 9 out of 100, which tells you that most of this market is still pre-product. /dev/fast, with a working product, a clear architectural differentiation, and an enterprise-ready security story, enters at well above the category median. The question is whether their git-native bet pays off before one of the well-capitalized incumbents copies it.
Replicability: 35/100
The basic concept - using an LLM to review pull requests - is a two-day weekend project. A competent engineer can wire Claude or GPT to a GitHub webhook, send diffs as context, and post comments back to the PR. That part has zero defensibility.
The git-native persistent context model adds real complexity: building a structured, version-controlled knowledge base that evolves with the repo, designing the delta-ingestion pipeline to keep token costs manageable, and shipping a VPC deployment model that enterprise security teams will actually approve. That takes six months to a year for a strong team.
The hardest part to replicate is the enterprise trust pipeline - the reference customers, the security certifications, the reputation for not losing code. Palantir took years to build that. /dev/fast has founders who lived it firsthand. A new entrant starting from scratch would face 18-24 months of purely credentialing work before the first enterprise contract.
Overall: this is a replicable concept with meaningful execution moat. Call it 35 out of 100 - a competent team can build the technical product, but matching the enterprise positioning and the compounding context advantage requires more than technical competence.
The Bottom Line
The interesting bet /dev/fast is making is not that AI code review is valuable - that's established. It's that the session-based approach all incumbents use is the wrong architecture for a world where the codebase has memory and the agent should too. If git is already your source of truth for what changed and why, it should also be the source of truth for what the agent learned from reviewing all those changes.
Sid Menon says they're building the next GitHub. That's either exactly right or extremely wrong, and there's not much middle ground. What's clear is that a team with Palantir enterprise DNA, an AI safety background, and a YC W26 stamp has as good a shot at the git-native code review category as anyone who will try.