Open Code Review
AI code review validated on millions of real-world tasks
About Open Code Review
Open Code Review is the code review agent Alibaba runs internally, released as an Apache-2.0 CLI you install with npm or Homebrew and point at your own model endpoint. It reviews a working tree or a pull request and returns comments pinned to exact line numbers, with the same tool available as a step in GitHub Actions, GitLab CI, GitFlic and Gerrit. The distinction the project draws, and the reason to look at it instead of just asking a coding agent to review a diff, is architectural: it splits the job into a deterministic part (splitting the task, filtering files, positioning comments on lines, routing rules, scheduling asynchronous work) and an agent part (finding risk, exploring context, classifying issues). The engineering handles what can be made certain, the model handles what needs judgement, and the vendor argues this is why it costs a fraction of the tokens a general agent burns on the same review.
Everything runs where you run it. Requests go to the provider you configure through the Anthropic Messages API, the OpenAI Chat Completions API or the OpenAI Responses API; preset providers include Anthropic, OpenAI, DashScope, DeepSeek and Z.AI, and custom endpoints are supported for private deployments. There is no hosted service and no paid tier anywhere on the site or in the README. The project ships review rules covering more than 40 languages and file types, with built-in checks for null pointer exceptions, thread safety, cross-site scripting and SQL injection, and it publishes a benchmark of 200 real pull requests from 50 open-source repositories across 10 languages, scored by more than 80 senior engineers. That benchmark table ranks Open Code Review above Claude Code on every model tested; it is Alibaba's own benchmark, so read it as the vendor's claim rather than an independent result. The repository was created in May 2026 and reached 36,000 stars in four months.
Install the CLI, add a provider with its API key, and run ocr review in a repository to review the current changes or ocr scan to audit whole files. The agent reads the files, searches the codebase for the context it needs (the homepage demo shows it grepping for password hashing before commenting on a login handler), plans the review per file and emits comments with line ranges and a summary of files, comments, tokens and time. An effort setting controls depth: low for quick feedback, medium for the everyday balance, high for changes where nothing may slip; the agent keeps pressing past what it has already found and stops on its own once a pass turns up no new risk. A reflection module checks comments for hallucination and drift before they are shown, and a purpose-built memory compression scheme keeps long reviews inside the context window. In CI the same engine runs on each pull request through the GitHub Actions, GitLab CI, GitFlic or Gerrit integration.
- •Hybrid Architecture - Deterministic pipelines for task splitting, filtering, line positioning and scheduling; the model only for risk detection and classification
- •Precise Line-Level Comments - A dedicated positioning module with a three-tier strategy, plus a reflection pass that filters hallucinations
- •Any Model - Anthropic Messages, OpenAI Chat Completions and Responses APIs; presets for Anthropic, OpenAI, DashScope, DeepSeek and Z.AI; custom endpoints
- •Built-In Rules - Checks across 40+ languages and file types for NPE, thread safety, XSS, SQL injection and more
- •Effort-Driven Depth - Low, medium and high review levels that converge on their own instead of running to a fixed budget
- •CI Integrations - GitHub Actions, GitLab CI, GitFlic and Gerrit, alongside the local CLI
Developers who want a second pair of eyes on every diff without sending code to a review SaaS, and platform teams that need review policy and data flow under their own control. It also suits ML researchers using a code quality verifier as a reward signal, which the vendor calls out explicitly. It is not a fit for teams that want a hosted product with a dashboard, a billing relationship and someone to call; this is a CLI you operate, with your own model bill. Bear in mind that the community and much of the discussion are Chinese-first, the project is four months old, and the headline benchmark comparing it to Claude Code was produced by Alibaba.
