What is Open Code Review?
Open Code Review (the ocr command) is the open-source release of the AI review assistant Alibaba says it has run internally for two years. It reads a Git diff, decides deterministically which files need review, bundles related files into units that each run as an isolated sub-agent, matches review rules to each file, and lets an LLM agent read surrounding code before writing structured, line-level comments. ocr scan reviews whole files where there is no meaningful diff.
It works with any OpenAI- or Anthropic-compatible endpoint, or in delegation mode hands the review to your coding agent's own model while it handles file selection and rules. Plugins cover Claude Code, Codex, Cursor, Kimi Code and OpenCode, and CI recipes cover GitHub Actions, GitLab CI, GitFlic and Gerrit. A built-in ruleset targets null-pointer, thread-safety, XSS and SQL-injection defects.
The repository was created in May 2026, is written in Go under Apache-2.0, has about 49,200 GitHub stars, and is at v1.13.3 (22 October 2026), installed with npm install -g @alibaba-group/open-code-review.
Is Open Code Review worth it?
Open Code Review starts from a sharp diagnosis: a general coding agent asked to review a large change skips files, misplaces comments and varies with small prompt changes. Its answer is to take the steps that must not go wrong away from the model. Code decides which files are reviewed, groups related ones (a pair of message_en and message_zh properties files travel together), picks the rules for each, and checks comment positions in a separate module. The model is left to read context and judge.
The project's own benchmark backs the trade-off, with the usual caveat that it is self-reported. AACR-Bench, published on Hugging Face, uses 200 real pull requests from 50 open-source repositories in 10 languages, with 1,505 issues annotated by more than 80 engineers. Against Claude Code on the same model, OCR reports higher precision and F1 at about one ninth of the tokens, and states openly that its recall is lower. For a team drowning in bot comments, that is the right direction to err in.
Operationally it is well behaved. Telemetry is off by default and, when on, exports OpenTelemetry to a collector you choose. Sessions can be resumed, results written as JSON, and a browser viewer marks findings fixed or ignored. Delegation mode is the cheapest way in: no extra API key, because your existing agent does the reading.
The caveats are pace and fit. Seven months old with 367 open issues and pull requests and a minor release most weeks, it is moving faster than most CI tooling should. The model must support native tool calling, which rules out reasoning models such as deepseek-r1 that narrate calls in text. Against hosted reviewers such as CodeRabbit it offers control of the model and data path, and loses the managed dashboard and repository-wide learning.
Where it earns its place
A platform team of 12 Java engineers on GitLab
Add AI review to every merge request without flooding it with noise
Run ocr review in GitLab CI on the merge-base range against an internal OpenAI-compatible endpoint; the built-in rules catch null-pointer and thread-safety defects. Token use is reported per review, so cost per merge request can be tracked.
A solo developer already paying for Claude Code
Get a second review pass before opening a pull request
Install the Claude Code plugin and use delegation mode, so OCR picks files and rules while Claude does the reading. No extra API bill; review time comes from the existing subscription's limits.
A security engineer inheriting an unfamiliar service
Audit the codebase for injection and XSS issues with no useful diff
Run ocr scan --path on the service directory with JSON output, then triage findings in the session viewer. Precision-first tuning means fewer false alarms but no claim of complete coverage.
Before you commit
- Setup
- npm install -g @alibaba-group/open-code-review (or a release binary), Git 2.41 or newer, then ocr config provider and ocr config model; first review is ocr review in a repo. Existing ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN variables are picked up automatically.
- Integrations
- OpenAI- and Anthropic-compatible endpoints, Ollama with tool-capable models; plugins for Claude Code, Codex, Cursor, Kimi Code, OpenCode and a portable agent skill; GitHub Actions, GitLab CI, GitFlic CI and Gerrit; MCP servers to extend the agent; an IntelliJ extension in the repo.
- Data and privacy
- Changed files and context the agent reads go to the configured LLM endpoint only; config sits in ~/.opencodereview/config.json. Telemetry is off by default and goes only to an OTLP collector you set. Apache-2.0.
- Cost at scale
- No paid edition. Cost is LLM tokens per review, which the vendor puts at about one ninth of a general agent's on its benchmark; delegation mode moves the cost into an existing coding-agent subscription.
- Limits
- Recall is deliberately lower than a general agent's; models without native function calling loop until Max tool requests; fast release cadence; benchmark not independently replicated.
What’s good
- Deterministic file selection and bundling on large diffs
- Self-reported precision gain at about 1/9 of the tokens
- Delegation mode reuses your coding agent's model
- Telemetry off by default; OpenTelemetry when enabled
What’s not
- Lower recall by design; misses more than a general agent
- Benchmark is the vendor's own
- Needs native tool calling; some local models fail
- 367 open issues and pull requests, weekly releases
Best for
Engineering teams that want precise, line-anchored AI review in CI or the terminal on a model and endpoint they control.
Open Code Review alternatives
Open Code Review: common questions
- Is Open Code Review worth it?
- Open Code Review fixes the specific ways coding agents fail at review, skipped files and drifting line numbers, and it trades some recall for comments worth reading. We rate it 4.1 out of 5.
- How much does Open Code Review cost?
- Free and open source (Apache-2.0). You pay for the LLM endpoint you configure; delegation mode uses your coding agent's existing model instead.
- What are the downsides of Open Code Review?
- Lower recall by design; misses more than a general agent; benchmark is the vendor's own; needs native tool calling; some local models fail; 367 open issues and pull requests, weekly releases.
- Who is Open Code Review best for?
- Engineering teams that want precise, line-anchored AI review in CI or the terminal on a model and endpoint they control.
- How much does Open Code Review cost for a team or in production?
- No paid edition. Cost is LLM tokens per review, which the vendor puts at about one ninth of a general agent's on its benchmark; delegation mode moves the cost into an existing coding-agent subscription.
- Is Open Code Review safe for company data?
- Changed files and context the agent reads go to the configured LLM endpoint only; config sits in ~/.opencodereview/config.json. Telemetry is off by default and goes only to an OTLP collector you set. Apache-2.0.
- What are the best Open Code Review alternatives?
- The closest alternatives we have reviewed are OpenAI Codex CLI and OpenCode.
Answers checked Oct 31, 2026.
Make Open Code Review? Show this rating on your site
