foundr.companyby Perea
← foundr.host·Beta

foundr.host — market insights

MECE market analysis. Numbers are point-in-time (May 2026) — sources linked so you can re-verify. TAM > SAM > SOM are nested slices, not aspirational forecasts.

TAMTotal addressable

~$9.4B / yr (2025), growing to ~$18.8B by 2030

Proxy

Global cloud object storage market (S3-compatible / API-driven). AWS S3 alone is the largest single line item — AWS segment $128.7B FY25, storage ~10–15% (~$13–19B).

Calc

TBRC: $9.44B (2025) → $10.97B (2026) at 16.2% CAGR → $18.79B (2030). Adjacent AI-powered storage TAM is $27–36B (2025) growing 23–25% CAGR — represents the demand shift foundr.host rides.

Sources
SAMServiceable addressable

~$300–500M / yr

Proxy

AI-native solo founders + small dev teams who (a) need programmatic object storage, (b) reject S3 console/IAM overhead, (c) want flat predictable pricing.

Calc

~119k Backblaze B2 customers (the indie/dev wedge) × $750 ARPU = $89M B2 ARR — call that the current indie object-storage SAM. Add Cloudflare R2's dev base + Vercel Blob's Next.js footprint = $300–500M of indie/AI-dev storage spend addressable today. MCP's 97M monthly SDK downloads signals the agent-driven storage wedge is forming.

Sources
SOMServiceable obtainable (3–5 yr)

~$5–15M ARR by year 5

Proxy

Capture ~10% of the Backblaze B2 indie wedge equivalent via MCP-native distribution.

Assumptions
  • 50k AI-native solo founders (~0.05% of GitHub's 100M+ devs, ~10% of B2's 119k customer base today)
  • 70% free / 25% Solo $9 / 5% Pro $29
  • Paid blended ARPU ≈ $148/yr × 15k paid = $2.2M ARR (yr 3) → $10–15M ARR (yr 5)
Analog precedent

Backblaze B2 went from a "wrap durable storage cheap" indie wedge in 2015 to $88.9M ARR / 119k customers / $750 ARPU / 27% YoY growth in 2025. Cloudflare R2 went 12k devs at GA (Sep 2022) to a material slice of CF's $2.17B FY25 in three years.

Sources

The top 3 incumbents

Who controls the market — and why they can't pivot.

Each incumbent's vulnerabilities tagged by kind: technical, business model, regulatory / channel, cultural.

#1AWS S3

~$15–20B est. revenue (segment of $128.7B AWS FY25), ~60%+ object storage share

  • Tech debt

    8+ layers of access control (IAM + bucket policy + ACL + Block Public Access + KMS + access points + Object Lambdas + cross-account). Globally-unique bucket names = "Bucket Monopoly" attack surface. Console "originally written by a monk being crushed by a wine barrel" (Corey Quinn).

  • Business model misalignment

    Egress fees ($0.09/GB) are the profit center — CMA, FTC, and EU Commission all opened 2025 antitrust probes specifically on egress + lock-in. Account creation requires credit card + console + IAM root user before a single API call.

  • Regulatory / channel dependency

    UK CMA Strategic Market Status designation pending; EU DMA core-platform review live; FTC expanded inquiry 2025. Egress fees explicitly targeted.

  • Cultural / incentive trap

    Cannot credibly add "no console, MCP-native, $9 flat" without cannibalizing the IAM-console-egress flywheel that funds the rest of AWS.

#2Cloudflare R2

Material slice of $2.17B CF FY25 (29.8% YoY)

  • Tech debt

    Tied to Cloudflare account model + Workers paradigm; S3-compat API but no native multi-tenant JWT primitive — every customer rolls their own per-user prefix + auth. No MCP server.

  • Business model misalignment

    Zero-egress wedge is brilliant for media/CDN, but Class A operations ($4.50/M) punish chatty agent workloads. Pricing assumes humans browsing files, not agents iterating.

  • Regulatory / channel dependency

    Increasingly enterprise-led — Q4'25 had 73% of revenue from $100k+ customers and a $42.5M ACV deal.

  • Cultural / incentive trap

    Cloudflare's "Agentic Internet" pitch is Workers + Workers AI, not storage. R2 is plumbing, not a standalone agentic primitive.

#3Backblaze B2

$79.9M FY25 revenue, +26% YoY, 119k customers, $750 ARPU

  • Tech debt

    Application Key UI requires console signup, key gen, scope selection — the exact friction foundr.host wraps. No MCP server. No JWT-per-tenant. Founded 2007 mindset (backup-first).

  • Business model misalignment

    Pivoting upmarket — "Flamethrower" startup program, $15M neocloud TCV deals, "$50k+ ARR customers grew 73%." The indie/solo-dev segment becomes wallet-share farm for enterprise expansion.

  • Cultural / incentive trap

    18-year-old company doing GTM transformation toward enterprise. Cannot credibly stay "solo founder primitive" while courting $50k+ ARR neoclouds — which is why we wrap them.

Strategic moves (12 mo)

Ranked by leverage. Top of the list ships first.

Leverage is encoded in position — no fake score. #1 is the highest-leverage move we can make in the next quarter.

  1. 01

    Ship the MCP server as the install path, not an add-on

    Q3

    Every onboarding doc opens with one line in `claude_desktop_config.json`. Founders never see a bucket, key, or IAM JSON.

  2. 02

    Lock in the "no dashboard" promise as positioning wedge

    Q2

    Cloudflare, AWS, B2 are all adding UI. Make "no dashboard, by design" the t-shirt. Land 3 founder quotes saying "I never had to log in."

  3. 03

    Quote-tweet free tier as paid acquisition channel

    Q2

    1GB-for-a-quote-tweet converts organic distribution into a measurable funnel. Public leaderboard + Zapier/n8n connector pulls non-coders in.

  4. 04

    JWT-per-agent: ship a `spawn_agent_credential` MCP tool

    Q3

    Solo founders running fleets want one credential per agent revokable without rotating the keychain. The structural moat — no incumbent issues short-lived per-agent JWTs scoped to a sub-prefix.

  5. 05

    Egress-priced parity with R2, communicated as "no $1,300 surprises"

    Q3

    Run a monthly "this is what your bill could have been on S3" comparison page.

  6. 06

    Land 5 lighthouse MCP-server SaaS integrations

    Q4

    Fast.io, SeetYah, agent-fs, Convex, InstantDB co-publish "we use foundr.host as our blob layer." Each becomes a referral spigot.

  7. 07

    Public roadmap: vector-aware object metadata

    Q4 research

    When agents write a file, they emit context too. Storing the embedding alongside the blob (no separate vector DB) is the natural next layer and no incumbent ships it.

Economic moats

What we can hold — and what we can't.

Honest split. We refuse to call cost-leadership or distribution a moat unless it actually defends.

Real (defensible)

  1. 01

    MCP-native interface as primary surface

    Incumbents will ship MCP wrappers, but their auth model (IAM users, R2 API tokens, B2 application keys) was never designed for ephemeral per-agent credentials. Refactoring AWS IAM to issue JWTs scoped to one prefix per agent is a multi-year platform change.

  2. 02

    JWT tenancy on top of B2 (not under it)

    Tenancy lives in our control plane, not B2's permission system, so we own issuance, scoping, revocation paths. B2 cannot replicate without giving up its primitives.

  3. 03

    "No dashboard" as covenant

    Every dashboard we DON'T ship is part of the product. Incumbents' product orgs are structurally incapable of NOT shipping a console — there's always a PM who wins next quarter by adding tabs.

Not real (incumbents can match)

  1. 01

    Storage price

    B2 sits underneath us. R2 already prices at $0.015/GB with $0 egress. We cannot win on cost-per-byte; we can only win on cost-per-headache.

  2. 02

    Durability / availability

    All three incumbents are eleven-nines. Anyone who entered believing this was a moat is already wrong.

  3. 03

    S3 compatibility

    `@aws-sdk/client-s3` works against R2, B2, MinIO, Wasabi, Tigris. Compatibility is table stakes, not a wedge.

Switching costs in our favor

  • MCP tool surface — once an agent calls `foundr_host.upload(...)` in 50 prompts, swapping providers means rewriting prompts and re-testing every agent
  • Per-agent JWT scopes embedded in agent identity files — moving to a new provider means re-issuing the entire fleet

Switching costs against us

  • We sit on top of B2. If we ever need to migrate to R2 or self-managed Ceph, the data plane churn is on us
  • Agents that bypassed our MCP layer and went straight to the underlying S3 URL can swap providers with one env var

Power-user pain

5 unaddressed pains, real voices.

Each pain has ≥3 independent quotes from Reddit / HN / GitHub / X. If an incumbent could fix it, they would have already.

Pain A

IAM is a multi-day debugging tax even for senior engineers

  • “Spent 6 hours debugging why our GitOps pipeline kept blocking a critical deployment. IAM Access Analyzer doesn't care about your Permission Boundaries.”

    — abestdev, dev.to

  • “Three weeks of my life I will never get back… iam:PassRole Nightmare.”

    — cdatta, dev.to

  • “Even engineers internally at AWS frequently get tripped up with IAM permissions. It's rare that someone gets them right on the first try.”

    — HN commenter, "IAM Is the Worst", id=39714155

Why incumbents
can't fix

IAM's union-of-Allow / Deny-always-wins evaluation is load-bearing for every AWS service. Simplifying breaks the security posture of every Fortune-500 deployment.

Coverage

✅ Shipped foundr.host issues a JWT per agent scoped to a path prefix. No policy JSON, no Deny vs Allow evaluation. The credential IS the permission.

Pain B

The S3 global bucket namespace is a foot-gun

  • “Bucket name already exists — but it is not listed on the S3 Mgmt Console.”

    — AWS re:Post, QU1M5o_SwQTL24RN17n9ukjw

  • “Worked for a company which ran into an S3 bucket naming collision when working with a client — both decided hyphenated-company-name was a good S3 bucket name (my company lost that race).”

    — HN, id=39635591

  • “Globally unique names of S3 could be problematic with just the metadata of name — you could figure out how a company names their S3 buckets.”

    — redserk4, HN id=43895607

Why incumbents
can't fix

AWS shipped "Account Regional Namespaces" in 2026 but kept the global namespace as default because two decades of `bucket.s3.amazonaws.com` URLs are load-bearing. R2 inherits the same pattern.

Coverage

✅ Shipped foundr.host scopes everything under the founder's handle (`handle.host.foundr.world/<path>`). No global namespace, no squatting.

Pain C

Dashboards are operational friction, not control planes

  • “R2 is a great product and a really annoying one to use in the browser once the work stops being trivial.”

    — Stefan Greeff, R2 Desk Pro author

  • “The AWS Management Console. The very phrase sends shivers down the spine of even seasoned developers.”

    — Sthitaprajna Sahoo, Medium

  • “I just destroyed my Backblaze buckets recently and realized they didn't have a delete button. You have to make a deletion API request for every single item.”

    — HN, id=20624544

Why incumbents
can't fix

Every cloud product org has a PM whose career advances by shipping more dashboard tabs. The console is the demo surface for sales; deleting it is a political non-starter.

Coverage

✅ Shipped foundr.host has no dashboard, by design. State changes happen through MCP tools; the "console" is the chat transcript.

Pain D

Surprise bills from PUT / unauthorized-request / egress meters

  • “Charges of over $1,300 in a single day… nearly 100 million PUT requests… all happened just a few days after I ensured my client that the price will be negligible, like $20 at most for the entire month.”

    — Maciej Pocwierz, Semantive

  • “Welcome to July, time to get your bill, and it was $2700.”

    — Corey Quinn, Whiteboard Confessional

  • “$58,000 to AWS — the billing appeared all at once, jumping from $140 to over $56,000 in a single night.”

    — Damiano Giorgi, Bedrock incident

Why incumbents
can't fix

Per-operation metering IS the revenue model. AWS waiving unauthorized-PUT charges in May 2024 was the first concession in a decade. R2 zeroed egress but kept Class A ops at $4.50/M.

Coverage

✅ Shipped Free / $9 / $29 flat. The customer literally cannot get a surprise bill because there is no per-operation meter exposed to them.

Pain E

Agents need credentials that match their identity, not a human's IAM user

  • “Object stores work fine, but the agent now owns secrets to a cloud account, has to manage IAM, and the storage is unauthenticated from the platform's perspective.”

    — colonistone_34, dev.to

  • “Every agent platform that asks "do you have an S3 account?" is asking the wrong question.”

    — same essay

  • “I have an aws account with more than 1000 iam users. I need to rotate access / secret keys in an effective way.”

    — AWS re:Post, QUCwWbdfydQ7S4-UEfteiHNw

Why incumbents
can't fix

IAM was designed for humans and EC2 instances. Issuing thousands of short-lived per-agent credentials means standing up Cognito + STS + a token-vending Lambda — a 200-line architecture diagram before the first byte uploads.

Coverage

✅ Shipped foundr.host's JWT-per-agent issuance is one MCP tool call. The credential IS bound to the agent's identity, and revoking it is a single tool call away.

Synthesis

Where SAM × incumbent vulnerability × unaddressed pain converges.

A wedge counts only when all three columns align. Status = what we've actually shipped against it.

WedgeSAM segmentIncumbent vulnPain solvedStatus
MCP-native install (no SDK, no console)Solo founders running Claude/Cursor agentsAWS/R2/B2 require SDK + credential management before first uploadI just want my agent to save a PDF✅ Shipped
Per-agent JWT scoped to prefixFounders running 5+ agents in parallelIAM access keys are account-wide; revoking one rotates allLost-key panic; can't revoke a single misbehaving agent✅ Shipped
Quote-tweet 1GB free tierIndie hackers, "I'll try anything free"Incumbents require credit card before first byteCold-start friction; bill-fear✅ Shipped
Predictable flat tiers ($9 / $29)Founders who got a Pocwierz-style bill onceS3 PUT/egress meters; unauthorized requests historically chargeableI'm afraid to leave this running✅ Shipped
No bucket-name globals (handle-scoped namespace)Anyone who's hit `BucketAlreadyExists`S3's global partition namespace; bucket-squattingWhy is `my-app-files` taken by someone else?✅ Shipped
Agent identity ↔ storage identity bindingMulti-agent fleets, agent platformsObject stores work but the agent now owns secrets to a cloud accountAuth shape mismatch between platform identity and storage⚠️ Partial
Embedding-aware blob metadataRAG-shaped agentsNo incumbent ships vector metadata at the object layerSeparate vector DB just to remember "what was in this file"❌ Gap
Realtime tail / event hose over MCPAgent operators watching multiple runsS3 Event Notifications → SNS → Lambda glueI just want to see what my agent wrote, live⚠️ Partial

Capture strategy

Where foundr.host actually wins.

Each angle ties SOM capture to a specific incumbent vulnerability above.

See how we sell into that gap.

The market thesis lives here. The pricing, MCP surface, and feature list live on the features page.

Full features & pricing← Back to foundr.host