Open Code Review: Self-Hosted AI Code Review from Alibaba

Code review is one of the most impactful quality gates in software development, but it's often skipped or rushed. AI coding agents can help — but general-purpose agents on code review tend to miss files, report wrong line numbers, or produce unstable feedback.

Enter Open Code Review (OCR) — an open-source, AI-powered code review CLI from Alibaba Group. Battle-tested at Alibaba's massive scale over two years (millions of defects identified, tens of thousands of developers), it's now available as a free, self-hosted tool under Apache 2.0.

What makes OCR different? It combines a deterministic engineering pipeline (file selection, bundling, rule matching) with an LLM agent for precise, line-level code review. This hybrid approach eliminates the flakiness of pure agent-based review while keeping dynamic decision-making where it matters.

In this tutorial, you'll install OCR, configure it with your preferred LLM, run your first review, and set it up in CI/CD.

Why Is It Trending?

OCR hit 5,900+ GitHub stars in just three weeks since its May 2026 release. It's trending because:

• Proven at scale — Alibaba's internal tool served millions of reviews before being open-sourced
• Deterministic + Agent hybrid — Solves the accuracy and completeness problems of pure LLM code review
• Any LLM backend — Works with Anthropic, OpenAI, Ollama, or any OpenAI-compatible API
• CI/CD ready — Built-in GitHub Actions and GitLab CI examples
• Plugin ecosystem — Integrates with Claude Code, Codex, and other coding agents

Prerequisites

Before you start, you'll need:

• Linux or macOS (Windows is supported via binary download)
• Git (any recent version)
• An LLM API key — Anthropic (Claude), OpenAI (GPT), or a local Ollama endpoint
• Optional: Node.js / npm (for NPM installation — not required if using the binary download)

Installing OCR

You have three installation options. The binary download is the simplest.

Option A: Binary Download (Recommended)

# Linux x86_64
curl -Lo ocr https://github.com/alibaba/open-code-review/releases/latest/download/opencodereview-linux-amd64
chmod +x ocr
sudo mv ocr /usr/local/bin/ocr

# Linux ARM64 (Raspberry Pi, Apple M series via Asahi)
curl -Lo ocr https://github.com/alibaba/open-code-review/releases/latest/download/opencodereview-linux-arm64
chmod +x ocr
sudo mv ocr /usr/local/bin/ocr

Option B: Via NPM

npm install -g @alibaba-group/open-code-review

Option C: From Source

git clone https://github.com/alibaba/open-code-review.git
cd open-code-review
make build
sudo cp dist/opencodereview /usr/local/bin/ocr

Verify Installation

ocr version

You should see the version number printed.

Configuring Your LLM Backend

OCR needs an LLM to generate reviews. You can configure it interactively or via environment variables.

Interactive Configuration (Anthropic/Claude)

ocr config set llm.url https://api.anthropic.com/v1/messages
ocr config set llm.auth_token sk-ant-xxxxxxxxxxxxx
ocr config set llm.model claude-opus-4-6
ocr config set llm.use_anthropic true
ocr config set llm.auth_header x-api-key

Environment Variables (OpenAI)

export OCR_LLM_URL=https://api.openai.com/v1/chat/completions
export OCR_LLM_TOKEN=sk-xxxxxxxxxxxxx
export OCR_LLM_MODEL=gpt-4o
export OCR_USE_ANTHROPIC=false

Local Model via Ollama

export OCR_LLM_URL=http://localhost:11434/v1/chat/completions
export OCR_LLM_TOKEN=ollama
export OCR_LLM_MODEL=llama3.3
export OCR_USE_ANTHROPIC=false

Test Connectivity

ocr llm test

If the test passes, you're ready to review code.

Running Your First Review

Navigate to any Git repository and run:

cd /path/to/your/project

# Review staged + unstaged changes
ocr review

# Review all changes between two branches
ocr review --from main --to my-feature

# Review a single commit
ocr review --commit abc1234

# Preview which files will be reviewed (no LLM calls)
ocr review --preview

The output includes:

• Each reviewed file with line numbers
• Issue severity (HIGH / MEDIUM / LOW)
• Suggested fixes
• Confidence scores

JSON Output for Scripts

ocr review --commit abc1234 --format json --audience agent

Architecture Overview

The architecture consists of four zones:

1. Input — The developer runs ocr review, which reads Git diffs from the repository. OCR supports workspace mode (staged/unstaged), branch range, or single commit.

2. Deterministic Engine — Hard constraints guarantee review completeness:

   • File Selection: Applies include/exclude patterns, filters binary files and test files
   • Smart Bundling: Groups related files (e.g., message_en.properties + message_zh.properties) into single review units
   • Rule Matching: 4-layer priority chain (CLI flag → project config → global config → built-in system rules) with first-match-wins
   • Built-in Rulesets: Covers NPE, thread-safety, XSS, SQL injection, and common language-specific issues

3. LLM Agent — Dynamic decision-making where it matters:

   • Per-Bundle Sub-Agent: Each file bundle runs in an isolated agent context — divide and conquer for large changesets
   • Scenario-Tuned Prompts: Prompt templates deeply optimized for code review accuracy
   • Configurable LLM Backend: Works with any OpenAI-compatible or Anthropic API

4. Output — Structured results delivered in multiple formats:

   • Terminal output (text or JSON)
   • CI/CD integration (GitHub Actions, GitLab CI)
   • WebUI viewer for session history on localhost:5483
   • Agent plugin interface (Claude Code, Codex)

Review Rules and Customization

OCR uses a 4-layer priority chain for review rules:

Layer	Source	Path
1 (highest)	--rule CLI flag	User-specified
2	Project config	.opencodereview/rule.json in repo root
3	Global config	~/.opencodereview/rule.json
4 (lowest)	System defaults	Built-in

Custom Rule Example

{
  "rules": [
    {
      "path": "force-api/**/*.java",
      "rule": "All new methods must validate parameters for null values"
    },
    {
      "path": "**/*mapper*.xml",
      "rule": "Check SQL for injection risks and parameter errors"
    }
  ]
}

Save it to .opencodereview/rule.json in your repo, or pass via --rule.

CI/CD Integration

GitHub Actions

OCR provides a ready-to-use GitHub Action. Add .github/workflows/code-review.yml:

name: AI Code Review
on: [pull_request]
jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install OCR
        run: |
          curl -Lo ocr https://github.com/alibaba/open-code-review/releases/latest/download/opencodereview-linux-amd64
          chmod +x ocr && sudo mv ocr /usr/local/bin/ocr
      - name: Run Review
        run: ocr review --from origin/main --to ${{ github.sha }} --format json
        env:
          OCR_LLM_URL: ${{ secrets.OCR_LLM_URL }}
          OCR_LLM_TOKEN: ${{ secrets.OCR_LLM_TOKEN }}
          OCR_LLM_MODEL: ${{ secrets.OCR_LLM_MODEL }}

GitLab CI

code-review:
image: alpine:latest
before_script:
  - apk add curl git
  - curl -Lo /usr/local/bin/ocr https://github.com/alibaba/open-code-review/releases/latest/download/opencodereview-linux-amd64
  - chmod +x /usr/local/bin/ocr
script:
  - ocr review --from origin/main --to $CI_COMMIT_SHA --format json
only:
  - merge_requests

Integrating with Coding Agents

OCR can be installed as a skill or plugin in your coding agent:

Claude Code:

# In Claude Code
/plugin marketplace add alibaba/open-code-review
/plugin install open-code-review@open-code-review

Codex:

codex plugin marketplace add alibaba/open-code-review
# Then in Codex: @Open Code Review review my changes

Any agent (skill file):

npx skills add alibaba/open-code-review --skill open-code-review

Verification Checklist

After setting up OCR:

• ocr version returns a version number
• ocr llm test passes connectivity check
• ocr review --preview shows files in your repo
• ocr review produces line-level comments
• CI/CD pipeline runs OCR successfully
• Custom rule file overrides built-in defaults
• JSON output is parseable by CI scripts
• Viewer WebUI accessible at localhost:5483

Resources

• GitHub: github.com/alibaba/open-code-review
• Website: alibaba.github.io/open-code-review
• NPM: @alibaba-group/open-code-review
• License: Apache 2.0