Open Code Review: Alibaba's Deterministic-Plus-Agent CLI for AI Code Review

Claude Code • CI/CD Tools Compared: GitHub Actions vs GitLab CI vs Jenkins

What Is Open Code Review? #

Open Code Review is an AI-powered code review CLI, installed as the ocr command, that started as Alibaba Group’s internal review assistant. Per the project’s own README, it served tens of thousands of internal developers and identified millions of code defects over roughly two years before Alibaba open-sourced it under Apache-2.0.

🔗 GitHub: https://github.com/alibaba/open-code-review 🌐 Homepage: https://open-codereview.ai

It reads Git diffs, sends changed files to a configurable LLM through a tool-using agent, and produces structured, line-level review comments. The agent isn’t limited to the raw diff text — it can read full file contents, search the codebase, and inspect other changed files for context, which is what separates it from a plain “paste the diff into a prompt” reviewer. At 17,700+ GitHub stars, 1,200+ forks, Apache-2.0 licensed, and an OpenSSF Silver Best Practices badge, with a commit from August 1, 2026 (the day before this article), it reads as an actively maintained project rather than a one-off internal-tool dump.

The Problem It’s Trying to Solve #

The README is specific about what motivated a purpose-built tool instead of pointing a general coding agent at the diff:

• Incomplete coverage — general-purpose agents doing code review on larger changesets tend to selectively review some files and skip others.
• Position drift — reported issues frequently don’t match the actual code location; line numbers or file references drift off target.
• Unstable quality — natural-language-driven review “skills” are hard to debug, and quality swings with minor prompt changes.

The stated root cause: a purely language-driven review pipeline has no hard constraints on the process itself.

Core Design: Deterministic Engineering × Agent Hybrid #

Open Code Review splits review work between two mechanisms, each handling what it’s argued to be better at:

Deterministic engineering — hard constraints, for steps that must not go wrong:

• Precise file selection — decides exactly which changed files need review and which get filtered, so nothing important is silently skipped
• Smart file bundling — groups related files (e.g. message_en.properties with message_zh.properties) into one review unit, each run as an isolated sub-agent, which both stays stable on large changesets and supports concurrent review
• Fine-grained rule matching — matches review rules to each file’s characteristics via a template engine rather than language-model guidance, keeping the model’s attention narrow
• External positioning and reflection modules — separate comment-positioning and comment-reflection steps meant to improve both where a comment lands and whether its content is accurate

Agent — dynamic decision-making, for the parts that need judgment:

• Scenario-tuned prompts optimized specifically for code review
• A distilled, purpose-built toolset — the README says it came from analyzing tool-call traces (call frequency, per-tool repetition rates, and how adding tools affected the overall call chain) in production data, rather than reusing a generic agent toolkit

Benchmark: What “Better Than a General Agent” Actually Means Here #

The benchmark set: 200 real pull requests across 50 popular open-source repositories and 10 programming languages, cross-validated by 80+ senior engineers against 1,505 annotated ground-truth issues. The headline claim, using the same underlying model for both sides: Open Code Review gets meaningfully higher precision and F1 than a general-purpose agent (Claude Code) doing the same review, at roughly 1/9 the token cost — with lower recall, described as a deliberate precision-over-noise trade-off.

Worth being clear-eyed about: this benchmark is self-reported by the project maintainers, not an independent third-party evaluation. Treat it as a documented methodology to weigh against your own trial run, not an audited result.

Installation & Quickstart #

Prerequisites #

Git 2.41+ is required — Open Code Review relies on it for diff generation, code search, and repository operations.

Install #

npm install -g @alibaba-group/open-code-review

This puts the ocr command on your PATH. Install-script and GitHub Release binary options also exist for environments without npm.

Configure an LLM #

ocr config provider          # Select a built-in provider or add a custom one
ocr config model             # Pick a model for the active provider

The interactive setup walks through provider selection, API key entry, model choice, and tests connectivity automatically. This step is skippable if you’re going to use Delegation Mode instead (see below).

Review your changes #

cd your-project

# Workspace mode — review all staged, unstaged, and untracked changes
ocr review

# Branch range — compare two refs
ocr review --from main --to feature-branch

# Single commit
ocr review --commit abc123

# Resume an interrupted range or commit review
ocr session list
ocr review --from main --to feature-branch --resume <session-id>

Full-file scan (no diff required) #

# scan the entire repository
ocr scan

# scan a directory or specific files
ocr scan --path internal/agent

Delegation Mode: Reviewing Without a Separate LLM Key #

# Let your AI coding agent perform the review itself.
# OCR handles file selection and rule resolution; no LLM configuration needed.
ocr delegate preview
ocr delegate rule src/main.go src/handler.go

This is the option worth knowing about if you already pay for Claude Code, Codex, or Cursor and don’t want a second LLM bill just for code review: Open Code Review still does the deterministic work (deciding what to review and which rules apply), but hands the actual model call to the coding agent you already have open.

Coding Agent Integrations #

Beyond the standalone CLI, Open Code Review ships integrations so it runs from inside the agent you’re already using:

CI/CD Integration #

Documented integrations cover GitHub Actions, GitLab CI, GitFlic CI, and Gerrit. In practice, ocr review --from main --to feature-branch (branch-range mode) is the command shape most pipelines would wire into a pull-request check, with ocr session list / --resume available if a run gets interrupted mid-pipeline.

Open Code Review vs. Pointing a General Agent at the Diff #

Use Cases #

1. Pre-Merge CI Gate #

Wire ocr review --from main --to feature-branch into a GitHub Actions or GitLab CI pull-request check to get line-level review comments before a human reviewer looks at the PR.

2. Auditing an Unfamiliar Codebase #

Use ocr scan --path <dir> when you’ve inherited a repository with no meaningful diff to review — a full-file scan rather than a diff-based one.

3. Cost-Conscious Review Without a Second API Key #

Use Delegation Mode (ocr delegate preview / ocr delegate rule) to get Open Code Review’s deterministic file selection and rule matching while the actual model call runs through Claude Code, Codex, or Cursor you’re already paying for.

4. Large-Changeset Review #

The smart file-bundling design (grouping related files into isolated sub-agent review units) is specifically aimed at changesets where a general agent would start dropping files.

Related Repositories #

Related Articles #

• Claude Code — the general-purpose coding agent Open Code Review benchmarks itself against and integrates with via plugin
• CI/CD Tools Compared: GitHub Actions vs GitLab CI vs Jenkins — for the pipeline layer you’d wire ocr review into

Conclusion #

Open Code Review makes a narrow, testable argument: code review is a task where deterministic engineering (file selection, bundling, positioning) should do the parts that must not go wrong, and an LLM agent should be reserved for the parts that actually need judgment — rather than handing the whole job to a general-purpose agent. Backed by two years of internal production use at Alibaba, a self-reported benchmark against Claude Code, and an Apache-2.0 license, it’s a reasonable option to trial if diff-review coverage or comment-positioning accuracy has been a pain point with a general agent’s review Skill.

Best for: Teams wiring AI code review into a CI/CD gate who want more consistent file coverage and comment positioning than a general-purpose agent’s review Skill, without necessarily paying for a second LLM subscription (via Delegation Mode).

GitHub: https://github.com/alibaba/open-code-review

Recommended Infrastructure for CI Integration #

Running ocr review in a pipeline means the LLM calls happen on CI infrastructure, not your laptop:

• DigitalOcean — $200 free credit for 60 days, useful if you’re self-hosting GitLab CI runners or GitHub Actions self-hosted runners that call out to your configured LLM provider.
• HTStack — Hong Kong VPS with low-latency access from mainland China, useful for CI infrastructure serving mainland-based teams. Same IDC that hosts dibi8.com.

Affiliate links — they don’t cost you extra and they help keep dibi8.com running.

Last updated: 2026-08-02

References & Sources #

• Open Code Review on GitHub
• Open Code Review homepage & docs
• npm package