cui.guru

alibaba/open-code-review · 50.9k stars · Beginner · 12 min · 2026-11-14

Install and use alibaba/open-code-review

An AI code review CLI that selects files deterministically, reviews them with a tool-using agent, and returns line-level comments you can run locally, in your coding agent, or in CI.

TL;DR

Open Code Review (ocr) reads your Git diff, sends the changed files to an LLM agent that can read and search the rest of the repo, and prints structured review comments with line numbers. Install it with npm, point it at a model, run ocr review, then wire it into Claude Code, Copilot CLI or GitHub Actions when you like the output.

Why this repo matters

The README names three problems with reviewing through a general-purpose agent and a prompt: incomplete coverage on larger changesets, reported issues that drift off the real line, and quality that swings with small prompt changes. Its answer is a hybrid: engineering code decides which files are reviewed, how they are grouped and how comments are positioned, while the agent handles the dynamic parts. The project says it began as Alibaba's internal AI review assistant and is Apache-2.0 licensed.

Best practices

  • Give it business context. The bundled skill tells agents to always pass --background "..." with a short summary of what the change is for.
  • Preview before you spend tokens. ocr review --preview lists which files will be reviewed without calling the LLM.
  • Write results to a file when an agent drives it. The skill recommends --output <path> so long reviews are not truncated by stdout handling.
  • Triage by severity. Every comment carries a severity (critical, high, medium, low) and a category (bug, security, performance, maintainability, test, style, documentation, other). The skill reports by severity and discards low items as likely nitpicks.
  • Customize rules per path. Review rules are matched to each file by path pattern, so Go, Java, YAML and workflow files each get their own guidance. See the Review Rules doc.
  • Mind the trade-off. The README says OCR has higher precision and uses about one ninth of the tokens of a general agent on its benchmark, but lower recall. It is tuned for fewer false alarms, not for catching everything.

How-to

Where do I start?

1. Install the CLI

Where do I start? You need Git 2.41 or newer, then one npm command.

npm install -g @alibaba-group/open-code-review

That puts the ocr command on your path. The README also lists an install script, release binaries and building from source.

Next: Connect a model

Try it

Pick a branch with a small change. Run ocr review --preview, check the file list is what you expect, then run ocr review --format json --output result.json and open the file. Find one comment, confirm its line number matches the code, and note its severity and category.

Pitfalls

  • Git older than 2.41 will not work; the README lists it as a prerequisite.
  • A Claude Code login does not configure ocr review. Either set up a provider or use delegation mode.
  • On rate limits, lower concurrency with --concurrency <n>; the default is 8 file workers.
  • If --output is rejected as an unknown flag, your CLI is old; upgrade with npm i -g @alibaba-group/open-code-review@latest.

Next steps