Open Code Review — Alibaba AI Code Review CLI
Open Code Review is Alibaba open-source AI code review CLI — line-level comments, full-repo scans, CI/CD integration, and hybrid LLM architecture.
Alibaba doesn’t just use AI code review internally — they built their own, used it with tens of thousands of developers, found millions of code defects over two years of production, and then open-sourced it.
Open Code Review (open-code-review) is Alibaba’s AI-powered code review CLI. It reads Git diffs, sends changed files to a configurable LLM agent, and generates structured review comments with line-level precision. Unlike naive prompt wrappers, it combines deterministic engineering constraints with dynamic LLM decision-making to avoid classic pitfalls like file omission and line-number drift.
What is Open Code Review?#
Open Code Review is a CLI tool that performs AI-powered code review with:
- Precise line-level reviews — comments mapped exactly to file paths and line ranges
- Workspace & branch review (
ocr review) — staged, unstaged, and untracked changes; diffs between refs; or single commits - Full-file audits (
ocr scan) — audit entire repositories without a Git diff, perfect for unfamiliar codebases and security audits - Delegation mode (
ocr delegate) — let an external AI coding agent review using its own LLM, no extra API keys needed - Session management — list, resume, and replay interrupted review sessions
- CI/CD integration — GitHub Actions composite action, GitLab CI, Gerrit workflows
Installation#
npm install -g @alibaba-group/open-code-reviewRequires Git ≥ 2.41 and Node.js ≥ 14. Binaries are also available via GitHub Releases and container runners.
Configuration#
ocr config provider # Select built-in provider or custom endpoint
ocr config model # Select modelOr use environment variables: OCR_LLM_URL, OCR_LLM_TOKEN, OCR_LLM_MODEL, OCR_USE_ANTHROPIC.
How It Works#
Open Code Review uses a hybrid architecture — deterministic engineering pipelines plus a dynamic LLM agent.
Deterministic Engineering (Hard Constraints)#
- Precise file selection & filtering — programmatically determines which files need review, filters out irrelevant assets
- Smart file bundling — groups related files (headers/implementations, matching property files) so sub-agents get cohesive context
- Template-engine rule matching — applies strict rule patterns based on file paths, not just natural language
- External positioning & reflection — dedicated verification modules double-check comment line locations and content accuracy before output
Dynamic LLM Agent#
- Scenario-tuned prompt templates
- Purpose-built toolset distilled from production call-trace data
- Dynamic context retrieval, code search, and defect reasoning
This combination matters: generic coding agents often suffer from incomplete file coverage on large changesets, position drift, and unstable quality. Open Code Review matches or exceeds their precision while consuming roughly 1/9th the tokens and running faster.
CI/CD Integration#
GitHub Actions#
The composite action (action.yml) automatically:
- Triggers on pull requests or comment events
- Checks out the repository and computes the merge-base
- Runs
ocr review - Uploads diagnostic artifacts (
ocr-result.json) - Posts inline comments and sticky PR summaries
Smart Posting#
- Incremental comments — non-destructive, updates existing threads instead of spamming
- Sticky PR summaries — update in place
- Batching — splits large reviews into sequential batches (e.g., 50 comments per batch) to respect GitHub API rate limits
- Severity routing — routes low-severity or style findings from inline comments into the main PR summary
Key Commands#
| Command | Purpose |
|---|---|
ocr review | Review workspace changes, refs, or commits |
ocr scan | Audit entire repos or directories (no diff needed) |
ocr delegate | Delegate review to an external AI coding agent |
ocr session list | List, resume, or replay review sessions |
ocr config | Configure LLM provider and model |
Use Cases#
Automated PR review in CI — catch bugs, security vulnerabilities, and logic flaws automatically in GitHub/GitLab merge requests.
Legacy code & security auditing — ocr scan reviews entire codebases for compliance and architectural smells without needing a diff.
Local pre-commit checks — self-review staged or unstaged changes before pushing.
Enterprise code standards — enforce team-specific review rules across large polyglot codebases.
How It Compares#
| Aspect | Open Code Review | Generic coding agents | Static analyzers (SonarQube, ESLint) |
|---|---|---|---|
| Line precision | ✅ Exact | ⚠️ Drift risk | ✅ Exact |
| Semantic understanding | ✅ LLM | ✅ LLM | ❌ Pattern matching |
| Token efficiency | ✅ ~1/9th | ❌ Verbose | N/A |
| False positives on logic bugs | ✅ Low | ⚠️ Varies | ❌ High |
| Full-repo audit | ✅ ocr scan | ⚠️ Limited | ✅ |
| Privacy | ✅ Any LLM endpoint | Varies | ✅ On-prem |
| License | ✅ Apache 2.0 | Varies | Varies |
Why It Matters#
Open Code Review is a rare case of production-proven AI tooling going open source: millions of defects found across tens of thousands of developers before it was ever released. Its hybrid architecture — deterministic pipelines for precision, LLM agents for semantic understanding — is a blueprint for building reliable AI developer tools.
And it’s fully open source and privacy-first: plug in any LLM endpoint, including locally hosted models, and keep your codebase entirely private.