Open Code Review

// Overview

Open Code Review (`ocr`) is a command-line code-review tool that Alibaba Group ran internally for two years before open-sourcing it. It reads Git diffs, sends the changed files to a configurable LLM through an agent that can read whole files, search the codebase and inspect sibling changes for context, and returns structured review comments anchored to specific lines. A second mode, `ocr scan`, reviews entire files rather than a diff, for auditing an unfamiliar codebase or a directory with no meaningful changeset.

The design argument in the README is that a purely language-driven reviewer drifts: on large changesets general-purpose agents skip files, report issues at the wrong line, and swing in quality with small prompt edits. Open Code Review therefore hard-codes the steps that must not go wrong. Engineering logic decides which files are reviewed and which are filtered, bundles related files (its example is `message_en.properties` with `message_zh.properties`) into isolated sub-agent review units so very large changesets divide and run concurrently, matches rules to each file by template rather than by prompt, and runs separate comment-positioning and reflection modules over the model's output. The agent is left with dynamic decisions and context retrieval.

The project publishes AACR-Bench to back the trade-off: 200 real pull requests from 50 popular open-source repositories across 10 languages, with 1,505 ground-truth issues cross-validated by more than 80 senior engineers. Against a general-purpose agent on the same underlying model it reports higher precision and F1 at roughly one-ninth the tokens, with lower recall as a deliberate choice in favour of fewer false alarms. It is written in Go, ships as `@alibaba-group/open-code-review` on npm plus an install script, GitHub Release binaries and a source build, runs on Windows, macOS and Linux, and is Apache-2.0.

// What it does

• Hybrid architecture: deterministic pipelines for file selection, bundling and rule matching; an LLM agent for dynamic decisions
• Line-level inline comments, with external positioning and reflection modules correcting location and content drift
• `ocr scan` reviews whole files for codebases and directories where there is no useful diff
• Per-bundle sub-agents with isolated context, so very large changesets divide, review concurrently and stay stable
• Built-in multi-language ruleset covering NPE, thread-safety, XSS and SQL injection
• OpenAI- and Anthropic-compatible providers, configured interactively with a connectivity test
• AACR-Bench: 200 real PRs, 10 languages, 1,505 human-validated ground-truth issues, published on Hugging Face

// Getting started

Install the npm package to get the global `ocr` command, then configure a model provider. Git 2.41 or newer is required — the tool relies on it for diffs, code search and repository operations.

npm install -g @alibaba-group/open-code-review

ocr config provider
ocr config model

ocr

ocr scan

Commands and code are distilled from the project's own documentation — always check the official repo for the latest.

// When to use it

• Reach for it when a general-purpose coding agent keeps skipping files or misplacing line numbers on large pull requests
• Reach for it when review token cost matters and you would rather have fewer, more precise findings than exhaustive ones
• Reach for it when you need reproducible review behaviour in CI rather than output that shifts with prompt wording
• Reach for it when auditing an unfamiliar repository that has no meaningful diff to review

// Version history

Every verified update to Open Code Review that AI/TLDR tracked, newest first — each links to our coverage and the official changeset.

1. 2026-09-16v1.12.3

   Two allowlist features keep secrets out of a review: secret paths are excluded, and per-environment .env files are protected. A path-traversal bypass in the code_search and code_comment tools is fixed by normalizing paths, and a tool-call JSON response that arrives with trailing content is now recovered instead of failing the run.

   our coverage →changeset ↗
2. 2026-07-28v1.8.0

   v1.8.0 added remote MCP servers over Streamable HTTP, Bicep and Terraform review support, and chunked inline comments.

   our coverage →changeset ↗

// How Open Code Review compares

Open Code Review alongside other open-source ai code review & security tools AI/TLDR tracks, ranked by GitHub stars.