# Open Code Review

> Alibaba's code-review CLI that pins the review process with deterministic engineering and leaves only the judgement calls to an LLM agent

- Category: AI Coding / AI Code Review & Security
- Language: Go
- Licence: Apache-2.0
- Repository: https://github.com/alibaba/open-code-review
- Website: https://open-codereview.ai
- Canonical page: https://ai-tldr.dev/tools/open-code-review/
- Updated: 2026-09-16

## In short

Open Code Review (`ocr`) is a command-line code-review tool that Alibaba Group ran internally for two years before open-sourcing it. It sits in the AI Code Review & Security category of the AI Coding tools and is open-source, written in Go and licensed Apache-2.0. To get started: install the CLI.

## Overview

Open Code Review (`ocr`) is a command-line code-review tool that Alibaba Group ran internally for two years before open-sourcing it. It reads Git diffs, sends the changed files to a configurable LLM through an agent that can read whole files, search the codebase and inspect sibling changes for context, and returns structured review comments anchored to specific lines. A second mode, `ocr scan`, reviews entire files rather than a diff, for auditing an unfamiliar codebase or a directory with no meaningful changeset.

The design argument in the README is that a purely language-driven reviewer drifts: on large changesets general-purpose agents skip files, report issues at the wrong line, and swing in quality with small prompt edits. Open Code Review therefore hard-codes the steps that must not go wrong. Engineering logic decides which files are reviewed and which are filtered, bundles related files (its example is `message_en.properties` with `message_zh.properties`) into isolated sub-agent review units so very large changesets divide and run concurrently, matches rules to each file by template rather than by prompt, and runs separate comment-positioning and reflection modules over the model's output. The agent is left with dynamic decisions and context retrieval.

The project publishes AACR-Bench to back the trade-off: 200 real pull requests from 50 popular open-source repositories across 10 languages, with 1,505 ground-truth issues cross-validated by more than 80 senior engineers. Against a general-purpose agent on the same underlying model it reports higher precision and F1 at roughly one-ninth the tokens, with lower recall as a deliberate choice in favour of fewer false alarms. It is written in Go, ships as `@alibaba-group/open-code-review` on npm plus an install script, GitHub Release binaries and a source build, runs on Windows, macOS and Linux, and is Apache-2.0.

## What it does

- Hybrid architecture: deterministic pipelines for file selection, bundling and rule matching; an LLM agent for dynamic decisions
- Line-level inline comments, with external positioning and reflection modules correcting location and content drift
- `ocr scan` reviews whole files for codebases and directories where there is no useful diff
- Per-bundle sub-agents with isolated context, so very large changesets divide, review concurrently and stay stable
- Built-in multi-language ruleset covering NPE, thread-safety, XSS and SQL injection
- OpenAI- and Anthropic-compatible providers, configured interactively with a connectivity test
- AACR-Bench: 200 real PRs, 10 languages, 1,505 human-validated ground-truth issues, published on Hugging Face

## Getting started

Install the npm package to get the global `ocr` command, then configure a model provider. Git 2.41 or newer is required — the tool relies on it for diffs, code search and repository operations.

1. Install the CLI

   npm is the documented default; the project also publishes an install script, GitHub Release binaries and a source build.

```bash
npm install -g @alibaba-group/open-code-review
```

2. Configure a model

   The interactive flow walks through provider selection, API key entry and model choice, then tests connectivity. A model is required unless you use Delegation Mode.

```bash
ocr config provider
ocr config model
```

3. Review a diff

   Run `ocr` inside a Git repository to review the current changeset with line-level comments.

```bash
ocr
```

4. Audit a whole directory

   `ocr scan` reviews complete files instead of a diff — useful on an unfamiliar codebase.

```bash
ocr scan
```

## When to use it

- Reach for it when a general-purpose coding agent keeps skipping files or misplacing line numbers on large pull requests
- Reach for it when review token cost matters and you would rather have fewer, more precise findings than exhaustive ones
- Reach for it when you need reproducible review behaviour in CI rather than output that shifts with prompt wording
- Reach for it when auditing an unfamiliar repository that has no meaningful diff to review

## Version history

- 2026-09-16 v1.12.3: Two allowlist features keep secrets out of a review: secret paths are excluded, and per-environment .env files are protected. A path-traversal bypass in the code_search and code_comment tools is fixed by normalizing paths, and a tool-call JSON response that arrives with trailing content is now recovered instead of failing the run.
- 2026-07-28 v1.8.0: v1.8.0 added remote MCP servers over Streamable HTTP, Bicep and Terraform review support, and chunked inline comments.