MoatAudit: AI Startup Defensibility & API-Risk Diagnostic Tool for Investors

Does anyone else feel like 80% of the Y Combinator startups we see these days are just AI wrappers around API calls to frontier models?

I think the distinction is less about whether a startup uses an API and more about **where the actual value accumulates**. Almost every software company is built on someone else’s infrastructure. SaaS companies didn’t become worthless because they used AWS, Stripe or PostgreSQL. The question is whether the company is just exposing the underlying capability with a nicer UI, or whether it’s building something difficult around it. For an AI company, I’d look for things like proprietary workflow integration, unique data generated through usage, evaluation and reliability infrastructure, domain expertise, distribution, switching costs, or a feedback loop that makes the product materially better over time. If the entire product can genuinely be recreated in a weekend by calling the same model with a good system prompt, then yes, I’d struggle to see the moat. But some of today’s “wrappers” may look deceptively simple from the outside. The API call might be 5% of the system. Making the output reliable enough to replace an expensive human workflow, integrating it into how a business actually operates, and acquiring customers can be the other 95%. I suspect investors aren’t really betting on the API call. They’re betting that a small number of these companies will own the workflow that sits above the models. The interesting question is what happens when GPT, Claude or Gemini eventually ships that workflow natively. If the startup has no answer to that, then the criticism becomes much harder to dismiss.