The first sign that an AI agent is becoming a product is usually an OAuth consent screen. The model has already written the email, planned the trip or found the invoice. Then it meets the world: a thicket of tokens, scopes, rate limits, tenant IDs and APIs that change their minds without notice. Intelligence may be the attraction. Integration is the cover charge.
Dev Jain has chosen to build at that unfashionable border. He is the founder and CEO of Corsair, a Winter 2025 Y Combinator company making an open-source TypeScript integration layer for agents and software products. The pitch is practical: connect once to a framework that handles credentials, authentication, webhooks and permissions, then reserve a team's attention for the part of the product its customers can actually see.
It is a company about avoiding repetition, founded by someone whose education began with physical systems. At the University of Texas at Austin, Jain studied mechanical engineering and economics. His undergraduate work included research on a domestic water heater that used phase-change material to store heat, earning a best-poster award from the American Society of Mechanical Engineers in 2019. He also studied the efficiency of modeling nuclear reactions on university supercomputers.
From stored heat to moving information
Mechanical engineering teaches a useful suspicion: a system is only as elegant as its losses. Heat escapes. Materials fatigue. A clean drawing encounters friction. Economics adds a related question: who pays for the inefficiency? Jain later moved into software, but the shape of the problem stayed familiar. Modern products lose time at their joints.
Before Corsair, Jain worked at Curri, a logistics-technology company from Y Combinator's Summer 2019 batch. He joined as a software engineer in 2022 and remained until 2024. Earlier roles crossed web content, reverse-logistics automation, software and mechanical engineering. The sequence is less a reinvention than a tightening focus: from systems in the world, to systems represented in software, to the connective code that lets those systems cooperate.
“We're building the TypeScript integration framework.”Dev Jain, on Corsair's mission
Corsair began in 2024 and joined YC the following winter. Its public materials once used the name Demeter; today the company is Corsair, with a two-person team listed by YC in New York City while Jain's professional profile places him in San Francisco. The geography is distributed. The technical grievance is concentrated.
The layer Jain wants developers to stop rebuilding
auth + permissions
The demo ends where Corsair begins
A developer can make a model call one API in an afternoon. A company must let many customers connect many accounts without allowing one tenant's credentials to wander into another's request. Tokens expire. Schemas drift. Providers disagree about pagination, retries and webhooks. The same application may need to read a calendar freely, ask before sending an email and refuse to delete anything at all.
Corsair turns those distinctions into product primitives. Its permission modes range from open to read-only. A cautious setting permits ordinary reads and writes while requiring approval for destructive actions. A strict setting lets reads through, pauses writes and blocks destructive calls. Credentials remain behind the integration layer, resolved when a tool is called rather than exposed to the agent.
The company's own favorite illustration has a light touch. An agent drafts a sensible email, then signs it “Best, Claude.” The user denies the request, corrects the agent and reviews a new one. The comedy works because the control is concrete. No manifesto is needed. The wrong signature is visible before it becomes somebody else's inbox problem.
In the YC launch demonstration, Corsair showed a GitHub clone wired through its SDK. The interface was put together in an afternoon. That detail was the point: the visible application could be disposable because the hard-won integration work beneath it was reusable. One layer could serve an agent, a backend job and a customer dashboard instead of being trapped inside a single workflow.
The maintenance tax nobody demos
Jain's description of the problem begins with a blunt ratio. In a typical integration, Corsair argues, about 95 percent of the code resembles every other integration: authentication, retries, errors, pagination, credential storage and the choreography of getting data into a predictable shape. The small remainder is the behavior that makes one product distinctive. Yet teams repeatedly spend their time on the common portion because each provider presents a different front door.
That tax compounds in a way a prototype conceals. The first integration is a feature. The tenth is a maintenance program. Every provider can rotate an authentication flow, deprecate a route or introduce a new version. A fix that looks local may affect hundreds of customer connections. For an AI product, the cost is sharper because a tool description and its schema help determine what the model believes it can do. Silent drift does not merely break a button. It can confuse the agent's available actions.
Corsair's TypeScript emphasis is Jain's answer to part of that uncertainty. Typed inputs and outputs move some errors out of runtime and into development, where an editor or compiler can expose them before a customer's agent encounters them. Plugins place provider-specific behavior behind a common pattern. Webhook signatures, tool definitions and tenant-scoped credentials become conventions rather than decisions remade for every adapter.
The word “framework” matters here. A conventional integration service can resemble a menu: choose the connections the vendor has already prepared, then work inside its limits. Jain wants Corsair to behave more like material developers can shape. They can run the managed hub, host the system themselves, add a missing plugin or drop down to direct SDK calls where a product needs custom behavior. The promise is not that every API becomes identical. It is that their repetitive edges stop occupying the entire engineering conversation.
An open catalog, not a velvet rope
Jain's other important decision was to make the core open source under the Apache 2.0 license. That is partly philosophical and partly architectural. A product responsible for valuable credentials asks for unusual trust. Inspectable code and a self-hosted option let customers decide where that trust lives. Corsair also offers a managed service for teams that would rather not operate the OAuth and webhook machinery themselves.
Openness changes how the integration catalog grows. Jain has said that, of roughly 70 early integrations, he wrote fewer than 10 and the community built the rest. A missing provider becomes a public issue. Someone who needs it can implement the adapter. The contribution then becomes inventory for the next developer. In that loop, community is not an audience gathered around the product. It is one way the product acquires surface area.
“Your data remains yours either way.”Corsair's launch promise on managed and self-hosted use
By August 2026, Corsair's public repository had attracted thousands of GitHub stars, with active issues, pull requests and discussions around the plugin system. Jain was also publishing a steady series of practical guides on multi-tenant OAuth, TypeScript tool calling, credential management, MCP gateways and the difference between a workflow engine and an integration platform. The writing repeats the company's thesis from different angles: the model is only one component, and production begins when identity, permission and maintenance enter the room.
The useful boredom of infrastructure
There is a temptation in AI to make every sentence about autonomy. Jain's work is interesting because it is full of boundaries. Which tenant is making this call? Which scopes were granted? Which actions may run immediately? Which require a person? What happens when the provider changes an endpoint? These are not cinematic questions. They are the questions that determine whether a demo can be trusted on Tuesday morning.
Corsair is still an early company, and the integration market already contains large incumbents, unified APIs and a widening field of agent-focused tools. Its argument is narrower than a claim to automate everything. Jain is betting on a programmable layer that can be inspected, extended and used beyond a single agent protocol. The same REST foundation can sit beneath agents, conventional applications and background jobs.
That choice also reflects a founder who arrived at AI infrastructure through engineering rather than spectacle. A heat-storage experiment succeeds when energy remains available at the right moment. An integration layer succeeds when credentials remain unavailable to the wrong component. In both cases, the work is about controlling movement through a system.
Jain's aspiration, stated without ornament, is to build the TypeScript integration framework. The more revealing ambition sits inside the definite article. He wants the repeated work to become a shared layer: one credential model, one permission vocabulary and adapters maintained where developers can see them. If agents are to act in the ordinary software of offices and households, somebody must make ordinary reliability a feature.
The future may arrive with a reasoning trace and a glowing chat box. It will still need a refresh token. Dev Jain seems content to meet it there.