Open Code Review

Open Code Review is an open-source AI code-review CLI incubated from Alibaba Group’s internal review assistant. It reads Git diffs or full files, explores repository context with agent tools, and produces structured comments positioned on the relevant lines. The tool separates deterministic engineering work—file selection, task splitting, rule routing, scheduling, and comment positioning—from LLM reasoning about risks and defects. Users configure an LLM provider or endpoint, including OpenAI-compatible and Anthropic-compatible APIs, and can run reviews locally, in coding-agent workflows, or in CI/CD integrations. The software itself is free and Apache-2.0 licensed; using a hosted model can create separate provider API costs and data-governance obligations.

✨ Key Features

• AI review CLI — Install the @alibaba-group/open-code-review package and run reviews from a terminal with the ocr command.
• Diff, branch, commit, and full-file review — Review working-tree changes, a branch range, a single commit, or scan files without relying on Git history.
• Repository-level context — Let the agent read full files, search the codebase, inspect related changed files, and reason beyond the visible diff.
• Line-level comment positioning — Generate comments attached to precise lines through a dedicated positioning module.
• Hybrid deterministic + agent architecture — Keep file filtering, task splitting, rule routing, scheduling, and other engineering steps deterministic while using the LLM for semantic risk analysis.
• Reflection and hallucination checks — Use the separate reflection stage described by the official product page to intercept unsupported findings and knowledge drift.
• Configurable review depth — Select low, medium, or high effort to trade review speed and token usage against deeper risk exploration.
• Rules and LLM protocols — Use built-in rules for 40+ languages/file types, customize path-targeted rules, and support Anthropic Messages, OpenAI Chat Completions, OpenAI Responses APIs, and custom endpoints.
• Providers and coding-agent integrations — Configure Anthropic, OpenAI, DashScope, DeepSeek, Z.AI, or private providers, and extend the review agent through MCP integrations for Claude Code, Codex, Cursor, and OpenCode.
• CI/CD and review sessions — Integrate with GitHub Actions, GitLab CI, GitFlic CI, and Gerrit; list, resume, and inspect review sessions.
• Delegation and telemetry — Let a coding agent perform reviews without an OCR-managed LLM API key, and use the documented OpenTelemetry integration for observability.
• Open-source distribution — Source code is publicly available under the Apache-2.0 license.

💳 Pricing

• Open Code Review costs — The CLI is free and open source under Apache-2.0, with no paid SaaS subscription listed. Users cover configured provider API charges and quotas; private/local endpoints shift hosting responsibility to the user; delegation can use a coding agent’s model without an OCR API key, with any agent or provider charges remaining separate.

There is no universal “free AI review” quota to promise: the CLI is free, while model inference may not be. Confirm the selected provider’s pricing, retention, training, region, and security terms before sending proprietary code. The product website’s benchmark numbers and internal-user claims are product claims, not a guarantee of defect-detection quality.

⚖️ Alternatives Compared

🎯 Use Cases

• Local pre-commit review: Inspect working-tree changes before opening a pull request.
• Branch and commit review: Review a feature branch or a specific commit with repository context.
• Whole-repository scanning: Scan files beyond a Git diff when a full-file review is needed.
• Security-oriented review: Use built-in rules for risks such as XSS, SQL injection, null-pointer errors, and thread-safety issues, then verify findings manually.
• Large-language-model experimentation: Compare providers or private endpoints while keeping the review workflow consistent.
• Coding-agent workflows: Add review commands to Claude Code, Codex, Cursor, or OpenCode workflows.
• CI/CD quality gates: Run reviews in GitHub Actions, GitLab CI, GitFlic CI, or Gerrit pipelines.
• Internal platform integration: Embed the CLI, MCP server, API, or session workflow into an organization’s development platform.
• ML and RL evaluation: Use structured review findings as code-quality signals or reward inputs, as described by the official site.
• Privacy-sensitive development: Route code to a self-hosted or private model endpoint after reviewing the complete data path and provider configuration.

AI code review is an advisory control, not a replacement for human review, tests, static analysis, dependency scanning, or security assessment. A private endpoint does not automatically make a workflow secure: inspect logs, telemetry, prompt contents, model retention, network egress, secrets, and access controls. Review comments can be false positives or miss defects, especially when repository context or configuration is incomplete.