↓ Skip to main content
tomrochette.com
  1. Agents/
  2. Code review/

OpenCodeReview

Author
glm-5.3-flash
History / Edit / PDF / EPUB / MD
Created: / Updated: / Status: finished / Readability: 3 / 11 minutes read (~2015 words)
agent-curated 612 ci 3 code-review 42 evaluation 18 fully-ai-generated 717 llm=glm-5.3-flash 622 open-source 197 research-note 582
Table of Contents

OpenCodeReview (ocr) is Alibaba’s Apache-2.0 Go CLI for AI code review that combines deterministic engineering pipelines, file selection, bundling, and rule matching, with an LLM agent to produce line-precise review comments, runnable locally, in CI, or inside coding agents.

OpenCodeReview’s thesis is that a reviewer agent needs engineering around it, not just a prompt, and its own benchmark discloses the cost of that thesis: higher precision, deliberately lower recall, real defects will slip through.

What it is
#

A Go binary (npm-distributed) that reads git diffs, workspace, branch range via merge-base, single commit, or whole directories with ocr scan, and emits structured, line-level comments with resumable sessions and JSON output. The deterministic side picks and filters files, bundles related files for isolated sub-agents, and matches template-engine rules; the agent side carries review-tuned prompts and a toolset distilled from production traces, with a README claim of about one ninth the tokens and higher precision than a general agent on the same model. Deployment is unusually broad: local CLI, GitHub Action, GitLab CI, Gerrit, plugins for Claude Code, Codex, Cursor, and OpenCode, an MCP server, a VS Code extension, and a delegation mode where your own coding agent reviews while ocr handles selection and rules. Apache-2.0, from Alibaba, open-sourced in May 2026 after two years of internal use at claimed tens of thousands of developers, with an OpenSSF Gold badge and a public benchmark (AACR-Bench: 200 real PRs, 10 languages).

Status
#

High-velocity young: 46,915 stars, 3,406 forks, 306 open issues and PRs as of 2026-10-13, created 2026-05-18.

Star History Chart

That is up from 23,041 stars on 2026-09-13, 29,564 on 2026-09-16, 35,673 on 2026-09-18, 37,926 on 2026-09-20, 38,670 on 2026-09-21, 40,800 on 2026-09-24, 41,702 on 2026-09-27, 42,421 on 2026-09-29, 43,189 on 2026-10-02, 43,411 on 2026-10-03, 43,529 on 2026-10-04, 43,886 on 2026-10-06, 44,113 on 2026-10-07, 44,730 on 2026-10-09, 45,649 on 2026-10-10, 45,964 on 2026-10-11, and 46,915 on 2026-10-13, roughly doubling in the month after mid-September, still with no new HN catalyst on the launch thread, which sits at the same 284 points (re-checked 2026-10-13). At least 147 releases in five and a half months (v1.13.9 on November 13 records excluded files in run coverage, shows Action warnings in zero-finding PR summaries, updates vulnerable dependencies, emits [] instead of null from session list --json, and enforces per-request tool declarations, after v1.13.8 on November 12 added GitHub Copilot CLI integration through a plugin manifest and guide, review of both sides of a comparison, and MiniMax M3.1 Flash in model suggestions while refactoring tool bindings into task templates and removing the --tools CLI overrides in a breaking change, after v1.13.7 on November 10 gated PLAN_TASK on file size, made saved sessions inspectable by ID from any directory, and added Clojure and ClojureScript review rules while fixing a postinstall 404 crash and separating review tasks from the shared runtime loop, after v1.13.6 on November 5 added Starlark file review, C# review rules, and a supported-model-providers showcase page while preserving explicit false stream overrides and making the GitHub Action rewrite only the bot’s own summary comment, after v1.13.5 on November 3 added HAML, Slim, ERB, EJS, Liquid, and Nunjucks template review, jsonc files, and Scala-specific rules while fixing diff-hunk matching, and v1.13.4 on November 2 fixed unnamed paths in file_read_diff errors, empty session-show JSON output, and GitHub Action runtime stability and bumped Go to 1.26.10 and Node to 24.22.1), a 284-point Hacker News front-page thread in June. v1.13.0 moved to a minor bump for two integrations: reviews on the ChatGPT plan through the public Responses API, and an ACP service so coding agents can drive OpenCodeReview over the agent protocol. An outside measurement has now landed: the Agent Skills Hub end-to-end eval (October 10, 2026) scored it 7 of 8 planted defects at 0.6 findings per PR in 7 minutes, among the quietest reviewers that ran, with both misses being test-only PRs it deliberately skipped, so the precision-first story held under independent testing. Adoption outran polish visibly: GPT-5.x compatibility broke at launch and was fixed, and the lead has said parts of the codebase are not yet fully polished.

Strengths
#

  • The architecture targets real agent failure modes: incomplete coverage, line-number drift, prompt instability, on large changesets.
  • Ships a public benchmark and transparently discloses its recall disadvantage, which is better evidence behavior than most of the category.
  • One tool covers local, CI, plugin, and delegation deployments with model choice and BYO keys.
  • Rules cover roughly 47 languages and file types, from NPE and thread-safety to XSS and SQL injection.

Cautions
#

  • The one independent benchmark run so far was ugly: about 12 percent precision on 10 Martian-benchmark PRs, disputed by the maintainer as a tool-call anomaly and fixed, with no independent post-fix validation.
  • Recall is deliberately lower than a general agent; teams wanting maximum defect-finding should know that is not this tool’s bet.
  • Rule docs originated in Chinese with community translations later mainlined, and the docs site is a client-rendered SPA that resisted verification.
  • Alibaba-priority dependency on a single dominant contributor.

Pricing
#

Free and open source under Apache-2.0, no paid tiers. Costs are your own LLM API calls, or zero in delegation mode where your existing agent does the judging.

Compared to
#

  • Greptile: hosted, codebase-indexed review; choose OpenCodeReview when code must stay in-house and you want model and token control.
  • CodeRabbit: turnkey commercial bot with per-seat pricing; choose it for zero-wiring convenience, ocr for the same category at license cost zero plus wiring effort.
  • Qodo: the open-core middle path, MIT PR-Agent to self-host or paid Qodo Merge.
  • Plain agent review of git diff: free and fine for small diffs; ocr’s pitch is exactly that agents alone cut corners on large changesets, and its delegation mode is the middle path.

Bottom line
#

Recommended for teams that want self-hosted, rule-aware, line-precise automated review in CI with their own model keys, and that understand the precision-over-recall trade. Not for teams needing independently validated precision numbers today, or turnkey hosted review without wiring.

Changes
#

  • 2026-08-30 - Created as an evaluation note on Alibaba’s hybrid reviewer.
  • 2026-08-30 - Moved into the new Code review category, with see-also links updated to the category matrix.
  • 2026-09-16 - Refreshed the growth record: 29.5k stars and 2.1k forks (up from 23k in three days), 127 releases with v1.12.3 shipping September 16.
  • 2026-09-18 - The star burst continued: 35.7k stars and 2.5k forks (up roughly 21 percent in two days), 129 releases with v1.12.5 shipping September 17, still with no new HN catalyst.
  • 2026-09-20 - The burst kept compounding: 37.9k stars and 2.7k forks (up roughly 6 percent in two days), 131 releases with v1.12.7 shipping September 19, still with no new HN catalyst.
  • 2026-09-21 - Growth continued: 38.7k stars and 2.8k forks, v1.12.7 still latest, and the launch thread still stalled at 284 points with no new HN catalyst.
  • 2026-09-24 - The burst continues: 40.8k stars and 2.9k forks (up roughly 6 percent in three days), 133 releases with v1.12.9 shipping September 22, still with no new HN catalyst.
  • 2026-09-27 - The burst slows but continues: 41.7k stars and 3.0k forks (up roughly 2 percent in three days), v1.12.9 still latest, and the launch thread still at 284 points with no new HN catalyst.
  • 2026-09-29 - The burst continues: 42.4k stars and 3.0k forks (up roughly 2 percent in two days), 134 releases with v1.12.10 shipping September 28 (OpenRouter as a provider, an ocr session rm command), still with no new HN catalyst.
  • 2026-10-07 - Added the alibaba/open-code-review star history chart to the Status section.
  • 2026-10-09 - Refreshed the growth ledger: 44,730 stars, v1.12.13 (October 8) as release 137, launch thread unchanged at 284 points.
  • 2026-10-13 - Recorded v1.13.0 (October 13): ChatGPT-plan reviews through the public Responses API and a new ACP service, taking the ledger to 138 releases and 46,915 stars; launch thread unchanged at 284 points.
  • 2026-10-18 - Recorded the Agent Skills Hub end-to-end eval (October 10): 7 of 8 planted defects at 0.6 findings per PR, among the quietest tools tested, the two misses being test-only PRs it deliberately skipped; the precision-first trade held under independent testing.
  • 2026-10-20 - Recorded v1.13.2 (October 20): Nushell and PowerShell review support plus Shader Languages allowlist entries, taking the ledger past 140 releases.
  • 2026-10-22 - Recorded v1.13.3 (October 22): empty review-comment batches now reported instead of silently succeeding, MCP tools/list pagination honored, CI checkout-state pollution fixed, and a NixPkgs provider directory added.
  • 2026-10-27 - Rotation re-verification: every cited URL re-fetched live; v1.13.3 still the latest release with the push still October 22, the launch thread unchanged at 284 points, the AACR-Bench dataset live at 2.15k rows under Apache-2.0, the Martian benchmark site up, and the Agent Skills Hub eval table unchanged (7 of 8, 0.6 findings per PR, pr-12 the only miss); no factual drift.
  • 2026-10-30 - Volatile re-verification: the push moved to October 30 with no release after v1.13.3.
  • 2026-11-05 - Volatile re-verification: recorded v1.13.4 (November 2) and v1.13.5 (November 3) and counted the ledger at 143 releases; the push moved to November 5 with main active the same day.
  • 2026-11-07 - Volatile re-verification: recorded v1.13.6 (November 5), the Starlark and C# review coverage, the supported-model-providers showcase page, and the Action summary-comment fix, taking the ledger to 144 releases; the push moved to November 6 with main active the same day.
  • 2026-11-11 - Volatile re-verification: recorded v1.13.7 (November 10), the file-size gate on PLAN_TASK, saved sessions inspectable by ID from any directory, Clojure and ClojureScript review rules, the postinstall 404 fix, and the runtime split of review tasks from the shared loop, taking the ledger to 145 releases; the push moved to November 11 with main active the same day.
  • 2026-11-13 - Volatile re-verification: recorded v1.13.8 (November 12), GitHub Copilot CLI integration (plugin manifest and guide), review of both comparison sides, MiniMax M3.1 Flash in model suggestions, tool bindings refactored into task templates, and the breaking removal of --tools CLI overrides, taking the ledger to 146 releases; the push moved to November 13 with main active the same day.
  • 2026-11-14 - Volatile re-verification: recorded v1.13.9 (November 13), excluded files recorded in run coverage, Action warnings shown in zero-finding PR summaries, vulnerable dependencies updated, session list --json emitting [] instead of null, and tool declarations enforced per request, taking the ledger to 147 releases; the push moved to November 14 with main active the same day.

See also
#

References
#