Open Code Review is an Apache-2.0, Go-based AI code review CLI that reads Git diffs, sends changed files to a configurable LLM through a tool-using agent, and returns line-level review comments, built for developers and platform teams that want large-scale review automated inside infrastructure they control.

What it is

Open Code Review is an AI-powered code review command-line tool written in Go and released under the Apache-2.0 licence. It sits in the developer tools and version control ecosystem, in the review step of the pull request workflow, and it replaces general-purpose coding agents used for review with a purpose-built hybrid pipeline. It originated as Alibaba Group's internal official AI code review assistant; over two years it served tens of thousands of developers and identified millions of code defects before being incubated into an open source project. Setup starts with a model endpoint, and it is compatible with OpenAI and Anthropic style endpoints.

The concrete problem it solves is quality drift in agent-driven review. General-purpose agents with skills show incomplete coverage on large changesets, selectively reviewing some files and missing others; position drift, where reported issues do not match the actual code location; and unstable quality, because natural-language-driven skills are hard to debug and fluctuate with minor prompt variations. The root cause named in the README is that a purely language-driven architecture lacks hard constraints on the review process. Open Code Review answers this with a hybrid split: deterministic engineering guarantees the steps that must not go wrong, such as file selection, file bundling, and rule matching, while the agent handles judgment. The measured result against Claude Code with the same underlying model is higher Precision and F1, about one ninth of the tokens, and faster completion, with lower Recall as a deliberate trade-off favouring precision over noise.

Key capabilities

• Hybrid architecture combining deterministic engineering with an LLM agent, so file selection, smart file bundling, and fine-grained rule matching are enforced by logic rather than by prompt text.
• Line-level precision in structured review comments, aimed at real defects instead of surface-level diff feedback.
• Repository-level agent context: the agent reads full file contents, searches the codebase, and inspects other changed files to deepen a review.
• ocr scan reviews entire files, covering auditing of unfamiliar codebases or directories that have no meaningful diff.
• Smart file bundling groups related files into a single review unit, for example message_en.properties bundled with message_zh.properties, and each bundle runs as a sub-agent with isolated context, which keeps large changesets stable and supports concurrent review.
• Built-in multi-language ruleset covering NPE, thread-safety, XSS, and SQL injection, matched to each file's characteristics through a template engine.
• Benchmark available as the AACR-Bench dataset on Hugging Face: 50 popular open source repositories, 200 real pull requests, 10 programming languages, and 1,505 annotated ground-truth issues cross-validated by more than 80 senior engineers.

Who uses it and how

• Organisations reviewing at Alibaba scale, where the tool has been validated on tens of thousands of developers and millions of identified defects.
• CI pipelines, where the benchmark's Avg Time and Avg Token metrics map directly to pipeline latency and API cost, and the roughly one ninth token consumption against general-purpose agents reduces per-review spend.
• Teams working on large changesets or monorepos, where bundling plus isolated sub-agents plus concurrent review counteracts agents that cut corners on file coverage.
• Auditors and onboarding engineers who run ocr scan over entire files and unfamiliar directories that have no diff to review.
• Teams already holding an OpenAI or Anthropic compatible endpoint, who point the CLI at their own model deployment rather than a separate review service.

Getting started

Configure a model endpoint, then run the ocr CLI; ocr scan extends it to whole-file review. The available facts do not document a package name, container image, compose file, or additional install step beyond configuring a compatible endpoint.

How it compares

Against general-purpose agents such as Claude Code running with skills, Open Code Review uses the same underlying model yet reports higher Precision and F1 while consuming roughly one ninth of the tokens and completing reviews faster. The honest contrast is Recall: general-purpose agents find a larger share of real defects, while Open Code Review accepts lower recall to reduce false alarms. Being Apache-2.0 and driven by a model endpoint the operator supplies, it also keeps code and review traffic inside that operator's own infrastructure.

When to use it — and when not to

A self-hoster must operate a model endpoint and absorb the token cost of every review, since the tool has no bundled model and the facts name no database, storage, or SMTP dependency to run. Teams that need maximum defect recall, or that cannot send code to an LLM at all, should not pick it, because lower recall is a designed property rather than a bug. The project carries 160 open issues and depends on an external endpoint, so it suits groups already comfortable running and tuning their own model access.

npm install -g @alibaba-group/open-code-review

ocr config provider          # Select a built-in provider or add a custom one
ocr config model             # Pick a model for the active provider