Open Code Review: Alibaba's AI-Powered Code Review CLI Tool

Open Code Review is an open-source CLI tool developed by Alibaba Group that automates code reviews by combining deterministic engineering pipelines with LLM agents. Designed to handle massive scale, the tool reads Git diffs and generates structured, line-level comments to identify defects such as null pointer exceptions (NPE), thread-safety issues, XSS, and SQL injection.

Hybrid Architecture: Deterministic Engineering and LLM Agents

Open Code Review uses a hybrid architecture to solve common failures found in general-purpose AI agents, such as incomplete coverage of large changesets and "position drift" where reported issues do not match actual code lines.

Deterministic Engineering (Hard Constraints)

To ensure reliability and correctness, the tool uses hard-coded engineering logic for the following processes:

  • Precise File Selection: Determines exactly which files require review and filters unnecessary ones to ensure no critical change is missed.
  • Smart File Bundling: Groups related files (e.g., different language versions of a properties file) into single review units. Each bundle runs as a sub-agent with isolated context, allowing the tool to remain stable on very large changesets and support concurrent reviews.
  • Fine-grained Rule Matching: Uses a template-engine-based approach to match specific review rules to file characteristics, reducing noise and increasing predictability compared to natural-language prompts.
  • Positioning and Reflection: Employs independent modules for comment positioning and reflection to improve the accuracy of the feedback location and content.

LLM Agent (Dynamic Decision-Making)

The agent handles tasks requiring flexibility and context:

  • Scenario-Tuned Prompts: Uses prompt templates specifically optimized for code review to increase effectiveness and reduce token usage.
  • Scenario-Tuned Toolset: Utilizes a purpose-built toolset derived from production data analysis (including call frequency and repetition rates) to make the agent more stable than generic toolkits.

Installation and Configuration

Open Code Review can be installed via NPM or as a binary from GitHub Releases.

Installation

npm install -g @alibaba-group/open-code-review

LLM Configuration

The tool requires an LLM endpoint. Configuration can be done via the CLI or environment variables:

Interactive Configuration:

ocr config set llm.url https://api.anthropic.com/v1/messages
ocr config set llm.auth_token your-api-key-here
ocr config set llm.model claude-opus-4-6
ocr config set llm.use_anthropic true

Environment Variables:

export OCR_LLM_URL=https://api.anthropic.com/v1/messages
export OCR_LLM_TOKEN=your-api-key-here
export OCR_LLM_MODEL=claude-opus-4-6
export OCR_USE_ANTHROPIC=true

Usage and Integration

Core CLI Commands

  • ocr review: Starts a code review of staged, unstaged, and untracked changes.
  • ocr review --from <ref> --to <ref>: Compares two branches or references.
  • ocr review --commit <commit>: Reviews a specific commit.
  • ocr viewer: Launches a WebUI session viewer on localhost:5483 to inspect LLM request and response history.

Integration Options

Open Code Review is designed to be integrated into existing workflows:

  • Coding Agents: Can be installed as a skill or a Claude Code plugin (using /plugin marketplace add alibaba/open-code-review), enabling /open-code-review:review slash commands.
  • CI/CD Pipelines: Supports JSON output (--format json) for integration into GitHub Actions or GitLab CI to automate reviews on Merge/Pull Requests.

Review Rules and Customization

The tool resolves review rules through a four-layer priority chain (first-match-wins):

  1. CLI Flag: --rule flag overrides all others.
  2. Project Config: .opencodereview/rule.json in the repository root.
  3. Global Config: ~/.opencodereview/rule.json for user preferences.
  4. System Default: Embedded system_rules.json for common languages.

Rules are defined in JSON format, mapping file paths (supporting ** recursive matching) to specific review instructions.

Community Insights and Technical Feedback

While the tool is based on Alibaba's internal scale, early community feedback highlights several technical considerations:

  • Precision vs. Recall: One user reported that in a benchmark of 10 out of 50 PRs, the tool showed high recall (74%) but low precision (12%), leading to a high number of false positives.
  • Compatibility Issues: A user noted that the tool may not work with certain GPT-5.x models due to a hardcoded max_tokens parameter, which newer models require to be named max_completion_tokens.
  • Localization: The original internal rule files are written in Chinese, which may require translation for non-Chinese speaking users to customize them effectively.

"I like the pattern of making a dedicated cli/harness and just build a skill to teach coding agents to use it." — @gbrindisi

Sources