Alibaba Group has open-sourced Open Code Review (OCR), its internal AI-powered code review assistant that has been used by tens of thousands of developers across the company over the past two years. The tool, now available on npm as @alibaba-group/open-code-review, operates under an Apache 2.0 license.
The core design philosophy combines deterministic engineering with an LLM agent in a hybrid architecture. For steps that must not go wrong — file selection, smart bundling of related files, fine-grained rule matching against NPE, thread-safety, XSS, and SQL injection patterns — engineering logic handles the work. The agent focuses on dynamic decisions and context retrieval, using scenario-tuned prompts and a purpose-built toolset derived from production trace analysis.
In a benchmark built from 50 open-source repositories, 200 real pull requests, and 10 programming languages — cross-validated by 80+ senior engineers across 1,505 annotated ground-truth issues — Open Code Review achieved significantly higher Precision and F1 than Claude Code with the same underlying model, while consuming approximately one-ninth of the tokens and completing reviews faster.
The tool reads Git diffs and sends changed files to a configurable LLM via an agent with tool-use capabilities. It can read full file contents, search the codebase, inspect other changed files for context, and produce deep reviews. Beyond diff review, ocr scan reviews entire files for auditing unfamiliar codebases.
Open Code Review supports GitHub Actions, GitLab CI, and Gerrit integration, and offers delegation mode where AI coding agents (Claude Code, Codex, Cursor) can perform the review using their own LLMs without requiring an OCR API key.
