Competition challenge — 18 September 2026

Role. Adversarial competition challenger. Kill clones of well-funded or OSS-default tools (Langfuse, Helicone, LangSmith, Okta, IBM, Portkey, Phoenix) unless the wedge is crisp and defensible in 90 days. Named competitors only. Prices and product facts from vendor pages/docs opened or crawled on this date, plus first-party blogs.

Scope. ideas/agentic-ideas.md (Hallpass, BurnNotice, Permitfile, Rehearse, Workslip, SchemaPin) and ideas/quantum-ideas.md (Q1–Q10, all already self-killed). Also BRIEF candidates A–E. research/competition.md is treated as a briefing, not gospel — it is too bullish on candidate A and misses the closest clone.

Rule used. “A + B + C, and nobody ships all three” is not a wedge. That is how every doomed aggregator dies. A wedge is a job, a buyer, and an object incumbents will not ship this quarter because it fights their positioning.

Scoreboard

Do not ship a Langfuse/Helicone/LangSmith/Phoenix clone. Confirmed: Helicone is in maintenance mode after the Mintlify deal (3 Mar 2026, both parties). That is a migration pool, not a hole. Langfuse Core is $29/mo MIT. Phoenix self-host is $0. Instant death.

Do not ship Okta/IBM/Broadcom GRC. Agent SSO is free on core Okta SSO (GA 24 Aug 2026). watsonx Orchestrate AgentOps Agent GA 31 Aug 2026, floor $530/mo. AgentMinder GA 31 Aug 2026, VMware-bundled, no list price.

Do not ship Portkey. Portkey is on the BRIEF kill list and already has virtual-key budgets, an MCP Gateway (auth, tool provisioning, logs, rate limits; GA Jan 2026), and is being absorbed into Palo Alto Prisma AIRS. Production $49/mo. Cloning “gateway + MCP + budget” is suicide.

Research error you must not inherit

research/competition.md says the remaining white space is “English allow/deny/ask + hard spend cap on the user’s keys + a receipt a third party can verify,” and names Preloop as the closest threat.

That table omits Permit.io MCP Gateway (permit.io/mcp-gateway, hosted at *.agent.security). Permit.io is a funded authorization company (SOC 2 Type II, free Community tier, Startup from $5/mo, Pro from $25/mo). The MCP Gateway is literally:

• Drop-in URL, no SDK, no rewrite of MCP servers.
• https://<host>.agent.security/mcp?upstream_mcp=<upstream> — one URL, any MCP.
• Docs: “secured gateway URL for any MCP server in under 5 minutes.”
• Allow/deny via trust levels (low/medium/high, auto-classified on import), human consent, admin ceiling.
• Audit of every allow/deny with human + agent + tool.
• Cursor / Claude Desktop / VS Code / Claude Code copy-paste configs.

That is BRIEF candidate A and is Hallpass without the English textarea and the pretty /r/ page. “We are not enterprise GRC” is positioning, not a product. Permit.io already sells a hosted, self-serve, no-code MCP permit URL. If Hallpass ships as “paste your MCP URL, get a gateway,” the homepage is a worse app.agent.security.

Preloop is the second clone, not the first: Apache 2.0 MCP firewall, ordered allow/deny/require-approval/require-justification, YAML+CEL, human approvals (mobile/watch/Slack), model gateway with hard budgets, preloop agents discover rewires Claude Code/Cursor/Codex, one-line claude mcp add. GitHub ~62 stars (small), but the mechanism is complete. Their own docs show layered dollar rules on a pay tool (allow <$100, ask $100–$500, deny >$2,000). “English rules” is an LLM compiler in front of that YAML. Not a 90-day moat.

LiteLLM (53k+ stars, 240M+ Docker pulls) already ships hard $ caps that reject, not alert, plus an MCP gateway with six-level tool permissions and a Tool Permission Guardrail (regex allow/deny on tool name + argument patterns). Cloudflare AI Gateway has spend limits (429 or fallback) as of 9 Sep 2026. Token spend control is solved.

The research “intersection” argument is therefore false as a moat: Permit.io has the URL, Preloop has allow/deny/ask + budgets + approvals, LiteLLM/Portkey have BYOK $ caps, Obsigna/ProofAgent have receipts. Gluing them is a feature bundle, not a company.

Instant-kill clones (do not let PM “just add” these)

If the homepage, SDK, or pricing looks like any of these, KILL the pivot regardless of the idea name:

Safe to borrow as an implementation detail, never as the product: hash-chained signatures (Obsigna pattern), OTel export out to Langfuse, BYOK.

Agentic ideas

1. Hallpass — KILL (as specified)

Claim. One hosted MCP URL. English rules. Allow/deny/ask. Cap dollars on your key. Signed shareable receipt. Let’s Encrypt for agent permissions.

This is Permit.io MCP Gateway + Preloop + a receipt skin. The inventor’s own failure mode is the verdict: “if the homepage says ‘MCP gateway’ instead of ‘English rules + receipt’, we are a worse MintMCP.” The spec is a gateway: “Paste one MCP URL into Cursor… Copy-paste https://cryptobook.space/mcp/{id}.”

Named competitors (mechanism, not vibes):

Why “English + receipts” is not a 90-day defense:

1. English is a compiler. Preloop and Permit.io already have UI rule builders. An LLM that writes YAML is a weekend. The YAML will be the source of truth anyway (Hallpass even says so for EU disclosure). Incumbents add a textarea without changing their company.
2. Dollar caps on an MCP-only hop are a lie. Hallpass admits it cannot see OpenAI/Anthropic invoices unless it sits on the LLM path or the user types a declared $/1k. Sitting on the LLM path = LiteLLM/Portkey/Helicone clone (BRIEF kill). Declared prices = a counter the user can game. Agent Wormhole (12 Sep 2026) measured 590 money-moving MCP tools, 88% unique names; their own name-list guard caught 13.4%. Do not market “$2 per session” as if it replaced the provider bill.
3. Receipts are a protocol, not a SaaS. Obsigna (Apache-2.0, SDKs, MCP proxy, dashboard, updated 17 Sep 2026), OrgX Agent Work Receipt v0.1 (account-free), IETF draft-sahu-agent-action-receipts-00 (16 Aug 2026), ProofAgent ($19, public verify URL). Hosting /r/hp_7f3a is a weekend on top of an open spec. ProofAgent already did the “click a URL, see a receipt” aha.
4. Time-to-first-permit is not 4 minutes vs 5. Permit.io is five minutes with an org. mcp-doorman is one command. Preloop is one claude mcp add. Hallpass’s 60-second playground is a demo on a fake filesystem, not enforcement on the user’s GitHub token. The moment you need a real upstream, you are in Permit.io’s onboarding.
5. Cursor/Claude native policy is the existential 90-day risk Hallpass itself lists. Claude already defaults MCP toolsets to always_ask. OpenCode has allow/ask/deny in opencode.json. GitHub Copilot has org MCP allowlists (6 Aug 2026). The choke point moves into the client. A hosted URL the user must remember to paste loses by default.

KILL the hosted “paste MCP URL, we proxy it” product. That category is occupied by a funded IAM company, a Palo Alto gateway, an Apache-2.0 control plane, and several one-binary OSS proxies. Combining three occupied features does not create a fourth.

FIX path (only if PM still wants this job): see Slip at the end. Headline cannot contain “MCP gateway.” No token custody. No model proxy. Receipt + blast card are the product; policy is a compiler; enforcement is local.

2. BurnNotice — FIX (module, not the company)

Claim. Drop last night’s log/CSV. Circle the loop and the dollars. Optional kill-switch later.

Not a Langfuse clone if it stays a coroner. Langfuse/Helicone/AgentOps want instrumentation before the fire. The job “the fire already happened on an un-instrumented laptop” is real (Revenium/ZDNet-class $3.7k–$47k loops; OpenAI’s hard spend limit is gone; Google “budgets” are alerts). File-drop in 60s, no SDK, is a legitimate aha.

Named competitors / death modes:

Why not SURVIVE as the company:

• One-shot. Upload once, screenshot, never return. $29/mo for 200 uploads is a guilty-conscience SKU, not a habit. The inventor’s mitigation (“live tail proxy”) is the Helicone clone.
• Parser hell is not a moat. Four formats + regex is a GitHub gist. Every new harness (Claude Code JSONL, Codex, Cursor, OpenCode, Aider) is a break.
• False loops. Pagination, retries, read_file × N. If we are wrong on the $47k tweet, we are a joke.
• Secrets. Storing prompts/args is a security-challenge KILL. Hash-only is the only honest v1, which makes the “timeline sparkline of what it said” weaker.

FIX, not KILL: keep the file-drop as a homepage module and a CI action (“fail if this JSONL contains a loop signature”). Do not productize a proxy. Do not add traces, evals, or prompt playgrounds. Do not promise provider-invoice accuracy. Monetize, if at all, as a GitHub Action on the same backend as Slip — not as a $29 coroner SaaS.

3. Permitfile — KILL as a product

Claim. Dependabot for MCP tools: agent-permit.yaml in the repo, GitHub App shames the PR, hosted URL enforces it.

Named competitors:

Dependabot worked because GitHub was the runtime. Permitfile’s runtime is a hosted MCP URL the IDE can bypass with stdio. The inventor admits this. A bot comment without enforcement is a linter; paid linters die to mcp-scan in CI (Snyk, free). A bot comment with enforcement is Hallpass again — Permit.io clone, plus a GitHub App security review.

Viral “every public MCP PR is an ad” is real distribution. It is not a product. Keep agent-permit.yaml as the file format for Slip. Do not build a second company around a GitHub App. GitHub will eat per-tool policy the way they ate Dependabot clones.

4. Rehearse — KILL as a product

Claim. Paste a task + tool catalog. Show the blast radius without calling any real server.

Named competitors: Claude Code plan/ask modes, Cursor plan, Codex, Copilot. Permit.io auto-classifies tools low/medium/high on import (delete/destroy = high). PolicyLayer already published a 32,820-server destructive-tool census. mcp-scan flags toxic flows. The emotional “your agent would delete 12 repos” is a landing-page animation, not a $29 subscription.

Plan ≠ reality (inventor admits). If the playground uses our LLM wallet, BRIEF kill (token reseller). If it is a scripted demo, it is marketing HTML. If it uses the user’s key to plan, we are a thin wrapper around the same model that would have planned inside Cursor.

KILL the SKU. Steal the jump-scare as a scripted homepage module for Slip. Label it “demo, not a proof.” No CI “golden plan” product — that is evals (Braintrust/Phoenix).

5. Workslip — KILL as a product

Claim. Client-readable signed timesheet of mixed human+agent labor. Verify URL. No escrow.

Named competitors:

Freelance TAM is narrow (BRIEF already asked). Freelancers will not pay $29/mo to defend a rate when they can paste a Git log. Clients who ask “did a human look” want the PR + tests, not a pink verify page. Signature proves Workslip ingested a file at time T, not that the work is good (inventor admits). The moment copy says “proves the work,” FTC + UPL-adjacent — also a legal kill.

KILL the standalone. The receipt page is the viral artifact for Slip. Do not build invoice software. Do not add client logins, ratings, or “pay this invoice.”

6. SchemaPin — KILL

Claim. Hash-pin tool name+description+schema. Deny on silent rewrite. README badge.

Named competitors: Invariant Labs invented this attack class (tool poisoning, rug-pull). mcp-scan / Snyk Agent Scan does tool pinning and proxy guardrails; Snyk acquired Invariant (Jun 2025); CLI is free (uvx snyk-agent-scan). mcp-doorman hash-pins on first use and blocks swaps until re-pin — in the enforcement path, today. agentperms lock pins tool identity. A hosted badge is SSL Labs: free, no conversion. Qualys/Tenable already taught this lesson.

Benign description edits = noise. Fetching customer MCP URLs from this VPS = SSRF. A pinned malicious server stays malicious (inventor admits). Marketing “secure MCP” would be theater.

KILL. If Slip’s local PEP hashes the tools/list it saw, that is a checkbox, not a SKU.

Quantum lane — KILL (all of it)

Agree with ideas/quantum-ideas.md and research/quantum-market.md. Independent competition check:

Novo Holdings (11 Sep 2026) does not rescue a VPS: ~70% of $13.9B went to hardware; general developer tools “struggle to capture lasting value” because clouds bundle them; investable apps are multi-year scientific embeddings. IBM Starling is 2029. Vendor revenue ~$1.8B (2025), QCaaS $0.25B. Demand is minutes on someone else’s fridge.

Do not put “quantum” on the homepage to sound 2026. That is constraint 7.

BRIEF candidates A–E (if PM reads the brief, not the idea files)

Patched survivor — Slip (FIX of Hallpass that actually patches the kills)

BRIEF: if every idea is killed, invent one that patches the kill reasons.

Hallpass died because it is a gateway. Workslip died because receipts are a protocol. Permitfile died because GitHub owns PRs. BurnNotice/Rehearse/SchemaPin died as companies but are useful objects.

What Slip is

A policy compiler + public evidence object for people who already run coding agents this month.

1. Homepage, no account, <60s. - Scripted Rehearse jump-scare on a pinned GitHub-MCP catalog (“this task wants delete_repo × 12”). - BurnNotice sample: one-click $3,762 loop autopsy (redacted, hashed args). - English box: never delete; ask before push; at most 20 tool calls / session. - Compiler shows the YAML (agent-permit.yaml) next to the English. YAML is source of truth. User can edit it. - Output: a Blast Card (/b/{id}) — tool list classified allow/deny/ask, destructive count, schema hashes — and a Receipt (/r/{id}) of the demo session. Both public, no login, signature verifiable in-browser.
2. Paid conversion is not a proxy. - Copy a decision snippet: local stdio wrapper / Claude Code hook / base_url-free PEP that sends {tool, arg_hash, policy_id} and gets {allow, deny, ask} + a receipt id. - Cloud stores policy versions, hashes, and receipts. Never the model key, never GitHub/Slack tokens, never tool results, never prompt bodies. - Optional: user pastes a usage CSV into BurnNotice. Still no live LLM proxy.
3. Honest spend. Cap tool-call counts and named denies, not “$2 of Anthropic.” If we cannot see the invoice, we do not print a fake dollar ticker as if we could. (That single sentence is what stops Hallpass from being a fraud next to LiteLLM.)
4. Price. $0 watermarked receipts/cards. $19–29/mo unlimited personal receipts + policy history (under Langfuse Core’s $29 ceiling). $99 team: shared rulebook, webhook on ASK (email; Telegram later). Bill receipts/policies, not spans.
5. Non-goals (printed on the homepage). Not an MCP gateway. Not an LLM proxy. Not SSO. Not a catalog. Not evals. Not traces. Not “AI Act compliant.” Not a legal attestation.

Why this is not the clones

90-day defensibility (honest)

Survives 90 days if the site is a playground that produces a card and a receipt without an account, and paid users get history + webhooks, and we never hold secrets.

Dies in 90 days if:

• The first screenshot is a “gateway dashboard” or a trace waterfall.
• We wrap user MCP URLs on our VPS (Permit.io clone and CFAA/key-custody kill).
• We add model routing “just to meter dollars.”
• We sell a “quantum-safe” or “AI Act” badge.
• Cursor ships a native per-tool policy UI that emails a share link — possible. Mitigation: be the share link, not the IDE.

What we steal from the killed ideas (one VPS process)

That is still one Node/Python app behind nginx: compiler, signer, static playground, Postgres for policy versions and receipt hashes.

PM-facing recommendation (competition only)

1. Do not build Hallpass-as-spec. It is Permit.io with a pink theme. Research that called this “white space” missed Permit.io MCP Gateway. That error would ship a me-too.
2. Do not build any quantum SKU. Confirmed kill by market, IBM’s free stack, and honesty.
3. Do not build Langfuse/Helicone/Portkey/Okta/IBM shapes even as “just v2.”
4. Build Slip, or kill the pivot. If the first sprint is an MCP reverse proxy, the competition verdict flips back to KILL.
5. Price under $29. Langfuse Core is the psychological ceiling for infra the user is not sure they need.
6. One-sentence test: If we cannot explain how we are not Permit.io, Preloop, and Portkey in one sentence, we are dead.

Slip: a public blast-radius card and a signed decision receipt for your coding agent, from English rules, without becoming your MCP gateway, your LLM vendor, your IdP, or your auditor.

If that sentence is not on the homepage, this file’s verdict is KILL the pivot.