OpenCodeReview (ocr)

Introduction

OpenCodeReview (ocr) is Alibaba's AI code-review CLI, open-sourced in May 2026 after two years as the company's internal official review assistant — serving tens of thousands of developers and flagging millions of code defects before it ever shipped publicly. The ocr command reads git diffs, drives a configurable LLM agent, and returns structured review comments pinned to exact lines.

The architecture is where it departs from the pack. Instead of a purely language-driven agent, it combines deterministic pipelines with an LLM agent: engineering logic handles the steps that must not go wrong — file selection, bundling, rule matching, comment positioning — while the agent handles dynamic context retrieval and reasoning. The result behaves like a battle-tested linter with judgment: complete coverage on large changesets, stable line-level accuracy, and about 1/9 of the token consumption of general-purpose agents on the same model.

Key Features

• Line-level review comments — findings are pinned to exact file:line positions via external positioning and reflection modules, eliminating the position drift common with prompt-driven reviewers.
• Multi-language ruleset — built-in rules cover null-pointer dereferences, thread-safety, XSS, and SQL injection across languages, with template-engine-based rule matching that keeps the model's attention focused.
• ocr scan full-file audit — reviews entire files rather than diffs, for auditing unfamiliar codebases or directories with no meaningful git history.
• Delegation mode — ocr delegate preview lets OCR handle file selection and rule resolution while your coding agent (Claude Code, Codex, Cursor, Kimi, OpenCode) runs the review with its own LLM. No OCR API key required.
• Session resume — interrupted reviews resume with ocr session list and --resume <session-id>, and replay later in the browser-based Session Viewer.
• MCP server — exposes review capabilities over the Model Context Protocol so external tools can extend the review agent.

How It Works

The hybrid design splits responsibilities deliberately. Deterministic engineering imposes hard constraints on the review process: precise file selection decides exactly which files need review and which should be filtered; smart file bundling groups related files (e.g., paired .properties files) into single review units, each run as a sub-agent with isolated context — a divide-and-conquer strategy that stays stable on very large changesets and supports concurrent review. Fine-grained rule matching uses a template engine rather than free-form prompts, and independent positioning/reflection modules fix both the location and the content accuracy of every comment.

The agent is reserved for what it does best — dynamic decisions and dynamic context retrieval. Its prompt templates and toolset are scenario-tuned for code review, distilled from analysis of tool-call traces in large-scale production data (call frequency, per-tool repetition, impact on the call chain). The result is a purpose-built agent loop that is more stable and predictable for review than a generic agent toolkit.

Benchmark

Alibaba published AACR-Bench, a real-world review benchmark built from 50 popular open-source repositories, 200 real pull requests, and 10 programming languages, cross-validated by 80+ senior engineers on 1,505 annotated ground-truth issues (dataset on Hugging Face).

Compared to general-purpose agents (Claude Code) on the same underlying model, OpenCodeReview reports significantly higher Precision and F1 while consuming ~1/9 of the tokens and completing reviews faster.

The honest caveat: its Recall is lower — a deliberate trade-off favoring precision over noise. You get fewer false alarms to triage, but some real defects can slip through, so it pairs best with additional checks on security-critical paths.

Getting Started

Install with one command (requires Git >= 2.41):

npm install -g @alibaba-group/open-code-review

Configure a provider interactively (ocr config provider, ocr config model) — presets ship for Anthropic, OpenAI, DashScope, DeepSeek, and Z.AI, plus any custom OpenAI/Anthropic-compatible endpoint, so code stays on your infrastructure. Then review:

ocr review                          # review all workspace changes
ocr review --from main --to feature-branch   # branch range
ocr review --commit abc123          # single commit
ocr scan --path internal/agent      # full-file audit
ocr review --format json --output result.json  # structured output for CI

Full reference lives at open-codereview.ai/docs.

Integrations

OpenCodeReview plugs into the surrounding ecosystem instead of locking you in: CI/CD via GitHub Actions, GitLab CI, GitFlic CI, and Gerrit; coding agent plugins for Claude Code (/open-code-review:review), Codex, Cursor, Kimi Code, OpenCode, and QCA Forward; a portable agent skill (npx skills add alibaba/open-code-review --skill open-code-review); plus OpenTelemetry telemetry for observability.

Verdict

OpenCodeReview is the credible open-source challenger to commercial review tools like CodeRabbit: the same frontier models under the hood, but precision-first output at a fraction of the tokens, with complete control over where your code goes. Engineering teams and maintainers who want low-noise, self-hosted AI review — and already pay for an LLM key — should try it. Teams that need exhaustive recall on security-critical changes should treat it as one layer of a broader review stack, not the only one.

Further Reading

• GitHub Repository — Source code, releases, issues, and the AACR-Bench evaluation
• Official Website & Docs — Quickstart, CLI reference, review rules, and CI/CD guides
• AACR-Bench Dataset — 200 real PRs, 10 languages, 1,505 annotated issues