OpenCodeReview
An AI-powered code review CLI that combines deterministic pipelines with LLM agents, battle-tested at Alibaba scale, delivering precise line-level comments.
- Source repo
- alibaba/open-code-review
- Stars
- ★ 48k
- Last updated
- today
- License
- Apache-2.0
- Primary language
- Go
- FA score
- 53/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformCodex · Claude CodeChatGPT (Partial support)
- Cost
- Free software; you pay for model usage
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- A developer reviewing a feature branch before merging:
ocr review --from main --to feature-branchprovides line-level comments on all changed files. - Not a fit if
- Users unwilling to configure an API key or pay per-token model costs
- Environments still on Git versions below 2.41
- Source review
- 53/100 · Major gaps
What does this agent do, and when should you use it?
OpenCodeReview (OCR) is an AI-powered code review CLI tool open-sourced by Alibaba Group, originally the internal official AI code review assistant that served tens of thousands of developers and identified millions of defects. It uses a hybrid architecture: deterministic engineering handles file selection, bundling, rule matching, and comment positioning for hard correctness; an LLM agent handles dynamic decisions, reading full files and searching the codebase for deep context. It reads Git diffs and produces structured comments with line-level precision, supporting multi-language rulesets for NPE, thread-safety, XSS, and SQL injection. The CLI offers commands like ocr review and ocr scan, with session resume and delegation mode. It integrates with coding agents like Claude Code, Codex, and Cursor via plugins, and supports CI/CD platforms. Licensed under Apache-2.0, with documentation in English, Simplified Chinese, Japanese, Korean, and Russian.
OpenCodeReview reads Git diffs to generate review comments. The deterministic layer selects which files to review, filters irrelevant ones, and bundles related files (e.g., grouping message_en.properties with message_zh.properties). It matches review rules to each file's characteristics using a template engine, and uses external positioning and reflection modules to improve comment accuracy. The LLM agent, configured via ocr config provider and ocr config model, reads full file content, searches the repository for context, and generates line-specific comments. Commands include: ocr review for workspace, branch ranges (--from main --to feature-branch), or single commits (--commit abc123); ocr scan for full-file scans of directories or files; ocr session list and --resume to continue interrupted reviews; and ocr delegate for delegation mode where a coding agent performs the review using its own LLM. Output is structured review comments, with options for CI/CD integration.
- A developer reviewing a feature branch before merging:
ocr review --from main --to feature-branchprovides line-level comments on all changed files. - A CI pipeline automatically runs
ocr reviewon each pull request to catch defects early, integrating with GitHub Actions or GitLab CI. - A security auditor uses
ocr scan --path internal/agentto review entire unfamiliar codebases for vulnerabilities like SQL injection or XSS. - A team using Claude Code or Codex wants code review without managing a separate LLM API key, using
ocr delegateso the coding agent performs the review. - A developer working on a massive changeset relies on OCR's file bundling and concurrent sub-agents to maintain full coverage and stable performance.
- An organization wants to enforce custom review rules, configuring path-specific rules to focus the model's attention on critical files.
How do you install or deploy this agent?
Install globally via npm: npm install -g @alibaba-group/open-code-review. The ocr command becomes available. Alternative methods include install script, GitHub Release binary, or from source, as documented in the official installation guide.
How do you use this agent?
- Configure an LLM: run
ocr config providerto select a provider (OpenAI/Anthropic compatible) or add custom, thenocr config modelto choose a model. The interactive UI guides through API key entry and connectivity test. 2. Review code: navigate to project and runocr reviewto review all changes, or specify a branch rangeocr review --from main --to feature-branch, or a commit--commit abc123. 3. Full-file scan:ocr scan --path internalscans a directory. 4. Delegation mode:ocr delegate previewto preview, no LLM needed. To resume an interrupted review, useocr session listand--resume <session-id>.
What are this agent's strengths and limitations?
- Deterministic + Agent hybrid ensures precise file selection and rule matching, improving review accuracy over pure language-driven agents.
- Proven at Alibaba scale: served tens of thousands of developers and found millions of defects, indicating production readiness.
- Higher precision and F1 than general-purpose agents (e.g., Claude Code) with the same underlying model, while consuming about 1/9 of the tokens and faster.
- Built-in multi-language ruleset covers common issues like NPE, thread-safety, XSS, and SQL injection, reducing false positives.
- Extensive integrations: plugins for Claude Code, Codex, Cursor, OpenCode, and CI/CD systems, plus MCP server support.
- Requires LLM configuration with API key for default mode, adding cost and setup complexity.
- CLI-only interface may be less accessible for non-developers; requires Git >= 2.41.
- Network dependency for API calls; latency and availability depend on the model provider.
- Recall is lower than general-purpose agents by design, potentially missing some issues that need human review.
- Advanced configuration (custom providers, environment variables) has a learning curve, as documented in the official configuration docs.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| OpenCodeReview This agent | 53 · Major gaps | CLIFree + model costs | ★ 48k | today | Go | Codex · Claude Code |
| MCO | 73 · Some gaps | CLIFree + model costs | ★ 538 | 11d ago | Python | Codex · Claude Code |
| Agent Skills — Production-Grade Engineering Skills for AI Agents | 71 · Some gaps | CLIFree + model costs | ★ 108k | 5d ago | JavaScript | Codex · Claude Code · OpenAI API |
| CoCo Super Intelligence | 69 · Some gaps | Agent plugin / skillFree + model costs | ★ 744 | today | Python | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows: CLI tool requires user-configured LLM API keys, but least privilege principle is not explicitly stated; interactive config UI may provide user confirmation, but not clearly documented; data flow transparency is insufficient, no detailed explanation of how code and prompts are sent to LLM; sensitive data handling (e.g., API keys) is mentioned in security policy, but no implementation details; dependency security: CI includes govulncheck and CodeQL, but no vulnerability reports provided; external effects: tool calls external LLM APIs, but data exfiltration scope not specified; rollback: session resume feature exists, but no rollback mechanism described; source attribution: publisher unverified, but code has copyright notice. Deductions: least privilege, user confirmation, data flow transparency, sensitive data handling, external effects, rollback, and source attribution lack concrete implementation evidence, only partial mentions.
Evidence shows: README and docs are consistent; CI includes tests and coverage checks, but no test results provided; dependency availability: go.mod and package.json exist, but no dependency locking or mirrors; failure messages: no error handling documentation. Deductions: self-consistency is supported by docs, but dependency availability and failure messages lack concrete evidence.
Evidence shows: README clearly targets developers, supports multiple platforms and agents; capability boundaries documented, e.g., diff and scan modes; trigger precision: rule matching and file selection mechanisms; environment fit: supports multiple OS and CI integrations. Deductions: capability boundaries and trigger precision are documented, but no specific configuration examples provided.
Evidence shows: information architecture clear, with doc links; install notes detailed, multiple installation methods; naming stability: CLI command names consistent, but version in package.json is 0.0.0; examples and FAQ documented; known limitations mentioned in README (e.g., lower recall); license Apache-2.0; versioning changelog not provided; maintenance responsibility: contribution guide and security policy exist. Deductions: naming stability deducted due to unupdated version, versioning changelog missing.
Evidence shows: output usability: generates line-level comments, structured format; marginal value: benchmark against generic agents; cost benefit: claims low token consumption, but no specific data. Deductions: cost benefit lacks concrete data support.
Evidence shows: README has benchmark claims, but no raw data; cross-source corroboration: OpenSSF badge, but no specific report; fact-inference separation: docs distinguish design trade-offs, but not explicitly labeled. Deductions: claim traceability insufficient, cross-source corroboration lacks concrete evidence.
- Publisher identity unverified; be cautious about supply chain risks.
- Handling of sensitive information like API keys is not explicit in source; check config storage.
- Data flow transparency insufficient; process of sending code and prompts to LLM not detailed.
- Version in package.json is 0.0.0, which may affect dependency resolution.
- Benchmark claims lack raw data; independent verification needed.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
🐛 Bug Fixes - fix(config): fix bad config for providers or keys that cotains dots (self-defined) (#1661) - fix(scan): surface llmloop token-budget stop on the run-level state (#1745) - fix(frontend): update vulnerable development dependencies (#1751) - fix(llmloop): count a grace-round task_done as completion (#1678) - fix(vscode): update vulnerable development dependencies (#1746) Other Changes - chore(deps): bump google.golang.org/grpc to v1.83.2 (#1205) Full Changelog: https://github.com/alibaba/open-code-review/compare/v1.13.0...v1.13.1View on GitHub ↗ -
Release notes excerpt
🚀 Features - feat(auth): enable ChatGPT plan reviews through public Responses (#1622) - feat(acp): support ACP service for OpenCodeReview (#1218) 🐛 Bug Fixes - fix: follow up ChatGPT auth recovery and provider credentials (#1622) (#1718) - fix(scan): record rendered prompt overflow as a failed review (#1652) - fix(agent): make deleted files readable through file_read_diff (#1698) - fix(agent): list deleted files under their own path in the change list (#1680) - fix(opencode): preserve OCR output on Windows (#1606) 📖 Documentation …View on GitHub ↗ -
Release notes excerpt
🐛 Bug Fixes - fix(scan): treat "." as the repository root and convert separators first (#1598) - fix(readme): use a proxy-friendly DeepWiki badge (#1673) - fix(llm): clarify independent timeouts and deadline diagnostics (#1159) Full Changelog: https://github.com/alibaba/open-code-review/compare/v1.12.12...v1.12.13View on GitHub ↗
FAQ
What are the prerequisites for using OpenCodeReview?
How does OCR save tokens compared to general agents?
Can I customize the review rules?
Is OpenCodeReview suitable for large codebases?
What is delegation mode and when should I use it?
ocr delegate) lets your coding agent (e.g., Claude Code) perform the review using its own LLM, so you don't need to configure a separate LLM for OCR. It's useful when you already use a coding agent and want to reduce setup.