Open Code Review

What is Open Code Review?

Open Code Review is the open source version of the code review agent Alibaba used internally for two years. It runs as a CLI, reads your Git diffs, searches the repository for context, and leaves precise line-level comments. You connect any OpenAI or Anthropic compatible model, so your code stays private.

Top Features:

• Line-level comments: places review notes on the exact lines of code that need attention.
• Hybrid pipeline: combines deterministic file selection and rules with an LLM agent.
• Built-in rulesets: catches null pointer errors, thread-safety bugs, XSS, and SQL injection.

Use Cases:

• Pre-commit checks: review staged and unstaged changes before pushing to a shared branch.
• Codebase audits: scan full files in an unfamiliar repository to surface risky code.
• CI pipelines: output JSON or SARIF results for automated quality gates and dashboards.

Who Can Use Open Code Review?

• Software engineers: get fast feedback on local changes before asking teammates for review.
• Platform teams: embed private reviews in internal systems with full control of data.
• AI researchers: use it as a reward signal when training code generation models.

Pricing

• Open source (free): licensed under Apache 2.0 with every CLI feature and no account needed.
• LLM usage (your provider): you pay your chosen model provider directly for the tokens used.

Pros and Cons

Pros:

• Proven at scale: ran inside Alibaba for two years across tens of thousands of projects.
• Token efficient: uses far fewer tokens than general agents on the same review work.
• Model freedom: works with any OpenAI or Anthropic compatible endpoint, including private ones.

Cons:

• CLI only: there is no hosted dashboard or graphical interface for reviewers.
• Bring your key: you must supply and pay for your own LLM access.
• Setup required: teams need Node and a little configuration before the first review.

FAQs:

1) Is it free to use?

Yes, it is free under Apache 2.0, but model usage costs apply.

2) Which models does it support?

Any OpenAI or Anthropic compatible provider, plus custom endpoints for private deployments.

3) How do I install it?

Run a single npm global install, then set your provider with the interactive setup.

4) Can it review a whole repository?

Yes, scan mode reviews full files and groups them by language or directory.

5) Does it work in CI?

Yes, it can output JSON or SARIF summaries suited to automated pipelines.