Hyrum

What the company appears to be: Hyrum is a tool designed to detect undocumented API behavior that consumers rely on, before changes are merged into an API. The system captures API sessions, identifies consumer dependencies, and replays changes to flag potential breakage.

What changed: The project was built as part of the OpenAI 2026 hackathon. It is a self-contained prototype with no evidence of production use or commercial traction.

Single most important open question: Does Hyrum’s approach to detecting undocumented API behavior offer practical utility for API teams, or does it suffer from over-engineering and false positives?

Analysis basis: This report is based entirely on the author-supplied description of Hyrum. It is self-reported and unverified. No third-party evidence, revenue data, customer feedback, or traction metrics are available.

The description states that Hyrum:

• Builds a per-consumer ledger of API behavior missing from published OpenAPI documents.
• Captures API sessions using a Go-based capture agent.
• Redacts sensitive data during capture.
• Separates observations into T1, T2, and T3 reliability levels.
• Replays changes against base and candidate builds to show behavioral differences.
• Uses a Fastify control plane with PostgreSQL storage.
• Has a Next.js/React UI for review workspaces.
• Integrates OpenAI’s Responses API and GPT-5.6 for advisory behavior naming and impact explanation.
• Operates with deterministic replay via Ed25519-signed container images.

Inference: The system appears to be a prototype focused on API change validation, not a full CI/CD integration or production-grade tool.

The description states:

• Hyrum addresses the gap between schema diffs and real-world API behavior.
• It aims to detect reliance on undocumented behaviors that only surface after release.
• The system is positioned as a pre-release gate mechanism, not a post-failure detective tool.
• It claims to block releases based on T1 evidence, warn on T2, and log T3.

Claim vs. Fact: These are self-stated positioning claims. No evidence of adoption or effectiveness in real-world API teams is provided.

The description states:

• Hyrum targets API teams who want to validate changes before merging.
• It is designed for developers reviewing API modifications and identifying potential breakage.
• The system is built with a review workspace, suggesting internal developer use.

Inference: The target customer is likely API engineers or DevOps teams working in SaaS environments where API stability is critical.

Not evidenced.

Absence of evidence: No mention of pricing, licensing, or monetization strategy. The project is presented as a hackathon submission with no indication of commercial intent.

The description states:

• Built using Go for capture/replay agents.
• Uses Fastify for the control plane and PostgreSQL for storage.
• Next.js/React for UI.
• Integrates OpenAI Codex and GPT-5.6 for advisory tasks.
• Implements redaction during capture, not post-processing.
• Uses deterministic replay with masked values and Ed25519-signed reports.
• Extractor package is shared between capture and replay to prevent disagreements.

Inference: The system shows technical maturity in handling API session capture, redaction, and deterministic replay. However, it is a prototype, not a production-ready tool.

Not evidenced.

Absence of evidence: No data on usage, customers, or adoption. The project was submitted to a hackathon and includes no mention of real-world deployment or feedback.

Not evidenced.

Absence of evidence: No mention of existing tools in this space, nor any comparison with competitors. The description does not reference similar solutions or market positioning.

• Over-engineering risk: The use of Ed25519 signing, deterministic replay, and shared extractors suggests a high level of technical sophistication that may not be justified for a hackathon prototype.
• AI dependency risk: GPT-5.6 is used for advisory tasks but cannot make decisions or alter evidence — this is a deliberate design choice, but it raises questions about whether AI adds real value or just complexity.
• Limited scope: The system only processes 50,000 scripted events in a deterministic test corpus — not production traffic.
• No commercial viability: No pricing, monetization, or customer data are provided.

Inference: The project is technically impressive but lacks commercial traction or real-world validation.

1. What specific API teams or use cases were you targeting in the hackathon?
2. How does Hyrum’s T1/T2/T3 classification map to actual customer impact or release risk?
3. Have you tested Hyrum with any real-world API teams beyond the hackathon?
4. What are the performance implications of capturing and replaying large volumes of API traffic?
5. How do you plan to integrate Hyrum into existing CI/CD pipelines?
6. Are there any known false positives or missed cases in your current implementation?