Open Code Review is an AI-powered code review CLI tool developed by Alibaba Group and released as open source. The tool originated as Alibaba's internal code review assistant and has been battle-tested over two years serving tens of thousands of developers while identifying millions of code defects before being incubated into a community project. Written in Go, it combines deterministic engineering pipelines with LLM agent capabilities to deliver precise, line-level code review comments.
The tool operates by reading Git diffs and sending changed files to a configurable language model through an agent equipped with tool-use capabilities. Beyond surface-level diff analysis, the agent can read full file contents, search the codebase, inspect other changed files for context, and generate deep reviews. The system also supports a scan mode that reviews entire files for auditing unfamiliar codebases or directories without meaningful diffs. The tool supports multiple LLM providers including OpenAI and Anthropic, and is available across Windows, macOS, and Linux platforms.
A core distinguishing feature is Open Code Review's hybrid architecture that pairs deterministic engineering with agent-based decision-making. The deterministic layer handles critical review steps that must not fail, including precise file selection to ensure no important changes are missed, smart file bundling that groups related files into single review units for divide-and-conquer processing on large changesets, fine-grained rule matching that focuses the model's attention on relevant rules, and external positioning and reflection modules that systematically improve both location accuracy and content accuracy of AI feedback. The agent layer concentrates on dynamic decision-making and context retrieval through scenario-tuned prompts optimized for code review and a distilled toolset derived from production data analysis.
The tool includes a built-in multi-language ruleset covering common security and reliability issues including null pointer exceptions, thread-safety problems, cross-site scripting vulnerabilities, and SQL injection risks. This represents a deliberate trade-off favoring precision over recall to minimize false alarms.
The project addresses specific pain points with general-purpose agents including incomplete coverage on larger changesets where agents selectively review only some files, position drift where reported issues frequently don't match actual code locations, and unstable quality from natural-language-driven approaches. The deterministic engineering layer solves these problems by enforcing hard constraints on the review process rather than relying purely on language model outputs.
Installation requires Git version 2.41 or later, as Open Code Review depends on Git for diff generation, code search, and repository operations. The tool provides an interactive UI for configuring LLM providers, API keys, and model settings with automatic connectivity testing. The project maintains comprehensive documentation at open-codereview.ai/docs and is distributed via npm as the @alibaba-group/open-code-review package. The project has achieved OpenSSF Best Practices Silver level certification and is available under an open-source license.
