Open Code Review - Alibaba's open-source AI code review CLI tool

What is Open Code Review

Open Code Review is an AI code review CLI tool open-sourced by Alibaba, derived from production-grade practices within the group that serve tens of thousands of developers and execute over a million review tasks. The tool adopts a hybrid architecture of deterministic engineering + LLM Agent, supports connecting to any LLM, completes reviews locally, and keeps data completely private. The tool comes with built-in review rules covering 10+ languages including Java, Go, and Python. Its token cost is only 1/5 that of general Agent solutions, and it scores 26.1% on the SEM.F1 metric in the AACR-Bench benchmark.

Main features of Open Code Review

• Hybrid architecture review engine: The deterministic engineering module handles task decomposition, file filtering, line number localization, and rule routing; the LLM Agent handles risk detection, context exploration, and issue classification. The two each perform their own roles, balancing quality, cost, and speed.
• Precise line-level comment localization: An independent three-layer progressive LLM localization module anchors each comment precisely to a specific line number; combined with an independent reflection module, it intercepts hallucinations and knowledge drift at an early stage.
• Multi-model protocol support: Natively supports the Anthropic Messages API and OpenAI Chat Completions API, can connect to custom model endpoints, and is compatible with automatic reading of Claude Code environment variables.
• Dynamic concurrent processing: Dynamic subtask decomposition and parallel review based on Goroutines, so even very large change sets can be completed quickly.
• Intelligent memory compression: Three-layer partitioned (frozen/compressed/active) context management for code review scenarios, breaking through token limits to achieve in-depth review.
• Built-in review rules: A rule library validated through massive real-world scenarios, covering vulnerability types such as NPE, thread safety, XSS, and SQL injection, and supporting custom rule injection via a four-layer priority chain.

How to use Open Code Review

• Install the tool: Install globally via npm i -g @alibaba-group/open-code-review , or download the binary for the corresponding platform from GitHub Releases.
• Configure the model: Run the ocr config set command to set the LLM endpoint, token, and model name; if Claude Code has already been configured, the environment variables will be automatically recognized.
• Verify connectivity: Execute ocr llm test to confirm that the model connection is normal.
• Start reviewing: Use ocr review to review workspace changes,ocr review --from main --to feature to review branch differences, or ocr review --commit abc123 to review a single commit.
• Integrate into workflows: It can be integrated into Claude Code as a Skill or Plugin, or connected to GitHub Actions / GitLab CI via --format json output.

Core advantages of Open Code Review

• Production-validated: Validated by 20K+ active users and 1M+ review tasks within Alibaba, with an adoption rate exceeding 30%.
• Extremely low cost: Token consumption is only 1/5 that of general Agent + Skills solutions.
• Private data: Runs locally; code never leaves the private environment, making it suitable for sensitive scenarios such as finance and e-commerce.
• Precise localization: The independent localization module solves the "line number drift" problem commonly seen in general Agents.
• Mature rules: Built-in rules directly target the high-frequency pain points of domestic teams (NPE, SQL injection, XSS).
• Zero-configuration compatibility: Automatically detects the Claude Code environment variables, no repeated configuration needed.

Project address of Open Code Review

• Project website：https://alibaba.github.io/open-code-review/
• GitHub repository：https://github.com/alibaba/open-code-review

Comparison of Open Code Review with similar competing products

Application scenarios of Open Code Review

• Individual developers: Quick self-check before local commit, replacing part of the manual review process.
• Platform teams: Integrate into internal DevOps systems to unify review policies and data flow.
• ML researchers: Serve as a code quality verifier for RL training pipelines, providing reliable reward signals for code generation models.
• Finance/e-commerce enterprises: Run in isolated intranet environments, meeting security and compliance requirements while enjoying AI review capabilities.
• Open-source project maintainers: Automatically review PRs through GitHub Actions, reducing the burden on maintainers.