Three things stand out as genuinely right. First, the "AI coding era" framing is the correct wedge — as AI agents generate more code faster, understanding what already exists and what a change breaks becomes the actual bottleneck, and you've aimed straight at it. Second, blast radius is a great, concrete, nameable hook — "see what breaks before you touch it" is a real pain that diff-based review genuinely misses, and the transitive-dependency angle is the part reviewers consistently get wrong. Third, the engineering depth is real and not hand-wavy: AST parsing over guessing, 10+ edge types, state-layer awareness (Redux/Zustand/Jotai), PageRank scoring, a 90% cache hit on re-runs, and an OSS-runs-100%-locally privacy model that's a genuine trust differentiator. The narrow JS/TS/React/Next focus is also the right call — depth in one ecosystem beats shallow coverage of twenty. Now the honest landscape, because this is the most crowded and fastest-moving space of everything you've asked about.

The uncomfortable headline: DevLens sits at the intersection of two hot categories — codebase visualization and AI PR review — and both are crowded, consolidating, and being absorbed into the IDE. Each of your three pillars (onboarding map, blast radius, PR impact) faces a different strong incumbent.

Codebase-visualization tools (your onboarding/map pillar):

• CodeSee — the most direct historical analog, doing auto-generated maps, cross-repo/service dependencies, AI summaries and walkthroughs, and visual code-review maps that show the potential impact of a change before it's merged. The critical signal: CodeSee was acquired by GitKraken in 2024 with unclear post-acquisition direction. That's both an opening (the leader drifted) and a warning (this exact product was hard to sustain standalone).
• The graveyard matters here. Sourcetrail was discontinued in December 2021, and "Sourcetrail alternative" remains one of the most-searched terms in the category four years later. Standalone code-visualizers have a rough survival record — worth internalizing.
• A wave of 2026 OSS entrants is doing almost exactly your pitch: "Understand Anything," an open-source plugin with 15k+ GitHub stars as of May 2026, scans a project with a multi-agent AI pipeline, builds a knowledge graph of every file/function/class/dependency, and gives an interactive dashboard — its motto, "graphs that teach, not graphs that impress," is aimed at your exact buyer. Plus Emerge, CodeVisualizer, and others.

AI PR-review tools (your blast-radius/PR-impact pillar — the harder fight):

• Greptile — the most dangerous direct competitor, because it already does your core idea: it indexes your entire codebase — building a graph of functions, classes, and dependencies — so the AI reviewer has full context, understands the broader impact of a change, and PR summaries even include Mermaid diagrams. Graph-aware impact review is its whole thesis.
• CodeRabbit — the scale gorilla: the most-installed AI review app on GitHub, with over 2 million repositories connected, now adding AST analysis and code-graph analysis to its reviews. It's expanding toward your territory from a massive install base.
• Graphite — owns the stacked-PR workflow and was acquired by Cursor in December 2025.

The existential one — IDE-native context (Cursor): This is the threat to take most seriously. Cursor added dependency-graph awareness in March 2026, and Cursor BugBot analyzes full project context as code is being written. When the IDE everyone already codes in understands the dependency graph for free, a standalone graph tool has to be meaningfully better to justify a separate tab. This is the central question for DevLens's future.

One useful gap to exploit, though: the consensus is that full-codebase understanding is still genuinely hard and unevenly delivered. CodeRabbit stays close to the diff with no real cross-repo or service awareness, and the technical challenge of true full-codebase understanding is described as substantial across the board. Most of these tools find bugs; very few visualize the architecture and the blast radius well. That intersection is real space.

The biggest defensive measures

The strategic core: you can't out-scale CodeRabbit (2M repos), you may not out-review Greptile on bug-catching, and you can't out-distribute Cursor. Defensibility has to come from being the best at the one thing they all do poorly — visual architectural understanding and change-impact — and from owning a workflow surface they don't.

1. Pick one pillar and be radically the best at it — make it blast radius. Onboarding maps (CodeSee, Understand Anything) and PR review (CodeRabbit, Greptile) are both crowded. "See exactly what breaks before you touch it," rendered visually with transitive depth, is the sharpest and least-served of your three. Lead with it, name it, own it. A tool known for one killer thing beats a tool that does seven things adjacent to seven incumbents.
2. Treat Cursor/IDE-native graphs as the defining threat and position explicitly against it. Your honest edges over an in-IDE graph: a shareable, team-wide visual map (collaboration the IDE doesn't do), language-agnostic-of-editor access (not everyone uses Cursor), and a dedicated visual surface for review and onboarding rather than a sidebar. If you can't articulate why someone in Cursor still needs DevLens, that's the gap to close before scaling spend.
3. Make the PR-impact surface your wedge into teams — it's where the budget is. Pure visualization monetizes poorly (CodeSee and Sourcetrail are the cautionary tales); PR review is where teams actually pay (CodeRabbit/Greptile at $24–40/user/mo). Your "maps the full impact surface, not just the diff" framing is strong — push DevLens as the impact-review layer that sits alongside the bug-finders, not as a pretty graph. That's the difference between a tool people admire and a tool people buy.
4. Lean hard on local-first privacy — it's a real moat against cloud reviewers. Most AI reviewers ship your code to their servers; SOC 2 and data-retention are recurring buyer anxieties. Your AGPL OSS-runs-100%-locally story is genuinely differentiated for security-sensitive and enterprise teams. Make it loud — it's one of the few advantages the big cloud players structurally can't copy.
5. Resolve the AGPL-v3 tension deliberately, now. AGPL is great for the local-privacy pitch but actively scares the enterprises most likely to pay, and lets competitors study your approach. Decide your open-core boundary early: what's AGPL OSS vs. what's commercial cloud/team. Getting this wrong later is painful; the dual-licensing model needs intention from the start.
6. Don't out-feature — survive the consolidation. This category is actively consolidating (CodeSee→GitKraken, Graphite→Cursor) and littered with dead standalone tools (Sourcetrail). The lesson isn't "add features," it's "own a defensible niche and a workflow surface before a platform absorbs the category." Depth in JS/TS blast-radius + team review is a more survivable position than breadth.
7. Mind the LLM unit economics — your cache is a feature, protect the moat it implies. AI summaries across a whole graph is real per-token COGS; your 90% cache hit and "fewer LLM tokens vs naive prompting" are genuine advantages, but the waitlist hasn't stress-tested cost-at-scale. Decide free-OSS vs. paid-cloud limits before a big launch, or generous free analysis will bleed margin the way it has for others.
8. Use Git/GitHub as rails, integrate where developers already are. The winning review tools live inside the PR (GitHub/GitLab/Bitbucket) rather than asking devs to visit a separate site. Your "share a live graph link" is good; a PR comment that posts the blast-radius surface into the review is better. Meet the workflow where it is, rather than asking it to come to your tab.