alibaba/open-code-review

Open-source & free — Battle-tested at Alibaba's scale. Hybrid architecture code review tool: deterministic pipelines + LLM Agent, precise line-level comments, built-in fine-tuned ruleset (NPE, thread-safety, XSS, SQL injection), OpenAI & Anthropic compatible.

OpenCodeReview – AI‑powered code‑review CLI

What it is – A command‑line tool that lets you run an LLM‑backed code reviewer on any Git repository. It reads diffs (or whole files), sends the relevant snippets to a configurable large language model, and returns structured, line‑level comments. The project grew from Alibaba’s internal code‑review assistant and is now open source.

Key capabilities

  • Diff‑aware reviewing – parses git diff output, selects exactly the changed files, bundles related files, and feeds them to the model.
  • Full‑file scan (ocr scan) – can audit an entire codebase when no Git history is available.
  • Deterministic engineering layer – hard‑coded file selection, bundling, rule matching and comment‑positioning to keep the review stable and precise.
  • Agent layer – uses a tuned prompt and a small, purpose‑built tool‑set so the LLM can retrieve additional context (full file contents, search the repo) and produce deeper feedback.
  • Multi‑model support – built‑in providers for Anthropic, OpenAI and others; you can also add custom endpoints via a simple JSON config or environment variables.
  • Integration hooks – ships as a skill/plugin for Claude Code, Codex, Cursor and generic AI coding agents, exposing slash commands like /open-code-review:review.

Installation

  • NPM (recommended): npm install -g @alibaba-group/open-code-review → provides the ocr command.
  • Binary releases: one‑liner curl …/install.sh | sh (macOS/Linux) or PowerShell irm …/install.ps1 | iex (Windows). SHA‑256 verification is built‑in.
  • From source: git clone … && make build && sudo cp dist/opencodereview /usr/local/bin/ocr.

First‑time setup

  1. Run ocr config provider (interactive) or ocr config set … (CI‑friendly) to pick a provider, supply an API key and choose a model.
  2. Test the connection with ocr llm test.
  3. Inside a Git repo, simply run ocr review to review all staged/unstaged changes, or use flags like --from main --to feature or --commit <sha> for specific ranges.
  4. For a whole‑repo audit, use ocr scan (optionally with --path <dir>).

Typical workflow

# configure once
ocr config provider            # pick Anthropic, OpenAI, etc.
ocr config model               # choose claude‑sonnet‑4‑6, gpt‑4o, …
ocr llm test                   # verify connectivity

# review a PR locally
cd my‑project
ocr review                     # diff‑mode review

# CI integration
ocr config set provider openai
ocr config set providers.openai.api_key $OPENAI_API_KEY
ocr review --from $BASE --to $HEAD --no‑interactive

Why it matters – Compared with generic agents (e.g., Claude Code), OpenCodeReview achieves higher precision and uses far fewer tokens (≈ 1/9), making it cheaper and less noisy for CI pipelines. The deterministic pre‑processing guarantees that every changed file is examined and that comments land on the correct line numbers.

Where to learn more – Official site https://open-codereview.ai, benchmark graphics in the repo, and the multilingual README (English, Chinese, Japanese, Korean, Russian).