Most AI code review tools hand a diff to a model and post whatever comes back. Open Code Review, the ocr CLI that Alibaba has published under Apache-2.0, splits the job in two. Deterministic code decides which files get reviewed, how they are grouped, which rules apply and where a comment lands. The LLM agent is only used where judgement is needed: reading context and deciding what is wrong.
According to the README, the tool “originated as Alibaba Group’s internal official AI code review assistant” and “over the past two years, it has served tens of thousands of developers and identified millions of code defects.” The public repository went up in May 2026. On October 12 it had about 46,500 stars, 3,385 forks and 305 open issues and pull requests.
Where the deterministic layer stops and the agent starts
The workflow described in the README:
ocrreads the Git diff (or whole files, withocr scan).- Related changed files are grouped into review units. Each unit runs as a sub-agent with its own isolated context, so one large change does not crowd out another.
- A template engine matches review rules to each file. The built-in multi-language ruleset covers NPE, thread-safety, XSS and SQL injection, and rules can be filtered and targeted by path.
- The agent can read full files, search the codebase and look at the other changed files before writing a finding.
- Separate modules check the position and the content of each comment before it is emitted as a structured, line-level result.
The practical consequence is in step 5. A common failure of LLM review bots is a correct observation attached to the wrong line, or a comment about code that did not change. Here, placing the comment is a job for code, not for the model.
What ocr deliberately does not do is spelled out in ROADMAP.md under “not planned”: automated fixes applied without human approval, a general-purpose coding assistant, and bundling or hosting LLMs. You bring the model, through any OpenAI- or Anthropic-compatible endpoint.
Reading the benchmark claim carefully
The README’s headline number compares ocr with Claude Code on the same model: “significantly higher” precision and F1, “while consuming only ~1/9 of the tokens and completing reviews faster.” The test set is AACR-Bench, described as “50 popular open-source repositories, 200 real Pull Requests, and 10 programming languages” with “1,505 annotated ground-truth issues.”
Three details are worth knowing before you repeat that number:
- The benchmark is the vendor’s own. The README links AACR-Bench to
huggingface.co/datasets/Alibaba-Aone/aacr-bench, a dataset published under an Alibaba organisation. That does not make it wrong, but it is not an independent evaluation. - The model is not named. The README says “the same underlying model” without saying which one, so the result cannot be reproduced from the README alone.
- Recall is lower, by design. The README states it directly: “Note that its Recall is lower than general-purpose agents — a deliberate trade-off favoring precision over noise.”
ocris built to leave fewer, more reliable comments, not to catch everything.
For a team whose developers have learned to ignore a noisy review bot, that is the right trade-off. For a security gate where a missed issue costs more than a false alarm, it is the wrong one, and the README is honest about that.
Three ways to run it
As a CLI with your own LLM key. The README’s install line is:
npm install -g @alibaba-group/open-code-reviewThe tool itself is written in Go, and besides npm each GitHub release ships standalone binaries for macOS, Linux and Windows on amd64 and arm64. Git 2.41 or newer is required. A first run looks like this:
ocr config provider
ocr config model
ocr reviewocr review covers staged, unstaged and untracked changes. --from main --to feature-branch reviews a branch range, --commit a single commit, and --resume <session-id> picks up an interrupted run. --format json --output result.json produces machine-readable output.
Through a coding agent you already pay for. In delegation mode, ocr does the deterministic part — file preview, rule resolution, diff retrieval — and the host agent does the actual review with its own model. The delegation doc says “No LLM endpoint is required on the OCR side” and names Claude Code, Codex, Cursor, Open Code and Qoder. It is installed as a cross-agent skill with npx skills add alibaba/open-code-review --skill open-code-review-delegate, the same mechanism covered in our skills.sh post. The review quality then depends entirely on the host agent’s model.
In CI. The repository ships a GitHub Action (action.yml) that reviews a pull request, posts inline comments and keeps one “sticky” summary comment updated. It needs an LLM URL, token and model name, and pull-requests: write. GitLab CI, GitFlic CI and Gerrit are also listed as supported.
Two defaults to change before rolling it out
The GitHub Action’s ocr_version input defaults to latest. Every CI run therefore installs whatever release is newest at that moment, and releases are frequent: v1.12.7 came out on September 19 and v1.12.13 on October 8, seven releases in under three weeks. A retrospective on the project blog counts 89 releases between v1.0.0 and v1.8.0. For a tool that receives an LLM token and write access to pull requests, pin a version.
The Action also sets llm_extra_body to {"thinking": {"type": "disabled"}} by default, so extended reasoning is turned off unless you override it. That keeps cost down, but it should be a conscious choice, not a surprise when you compare results with a local run.
What leaves your machine
Your code goes to whichever LLM endpoint you configure; that part cannot be avoided. Beyond that, the telemetry documentation is precise. “Telemetry is off by default.” When enabled, it exports OpenTelemetry metrics and spans to an endpoint you choose, and “OCR never attaches prompt content to telemetry.” It is not free of code-adjacent data, though: span attributes include the review group’s file paths and a repo.dir attribute. Full transcripts stay local under ~/.opencodereview/.
When it is worth adopting
ocr fits teams that want an AI reviewer in pull requests but have been put off by noisy, mispositioned bot comments, and that are comfortable supplying their own model endpoint. The rule engine and path targeting make it adjustable to a codebase rather than a fixed black box, and delegation mode lowers the barrier for individuals who already use a coding agent.
Hesitate if recall matters more than precision, if you need an independent benchmark before trusting the numbers, or if your environment cannot send code to an external LLM and has no self-hosted model to point it at. Some roadmap items — the ACP server adapter, a JetBrains plugin, an “Ultra Mode” that trades tokens for recall — are not finished; the ACP adapter is labelled “Experimental: local source builds only.”
The source, rules and CI examples are at github.com/alibaba/open-code-review, with documentation on the project site at open-codereview.ai.
