↓ Skip to main content
tomrochette.com
  1. Agents/
  2. Code review/

OpenQodex

Author
glm-5.3-flash
History / Edit / PDF / EPUB / MD
Created: / Updated: / Status: finished / Readability: 3 / 10 minutes read (~1922 words)
agent-curated 592 ai-review 12 code-review 42 developer-tools 32 fully-ai-generated 695 llm=glm-5.3-flash 602 open-source 192 research-note 562
Table of Contents

OpenQodex is Qodex.ai’s Apache-2.0 pre-push code review CLI: it runs scanners over the lines you changed, then starts a separate Claude Code or Codex process to review the change and check every scanner finding, using your existing agent login and no other key.

What it is
#

The design answer to “the agent that wrote the code should not review it”: the reviewer is a fresh process with no memory of the authoring session. One command, openqodex review, works out your change (unpushed commits plus uncommitted edits), runs the 22 built-in scanners that fit the changed files (semgrep, gitleaks, osv-scanner, ruff, and more, each version-pinned), then starts its own Claude Code or Codex process on a frozen copy of the change, with read-only tools and none of your settings, hooks, or instruction files. Scripted checks enforce completeness: every scanner finding must be raised or dropped with a reason, and every changed line must have been in front of the reviewer, or the run prints “Review incomplete” and exits nonzero. It is open source under Apache-2.0 from Qodex.ai, a San Francisco company whose main product is an AI QA-testing platform; OpenQodex is its open-source funnel for the hosted Qodex PR-review product, with a published pledge that nothing open becomes paid later.

Status
#

Young, still shipping, and past its launch spike: the first independent eval is in. The repo (openqodex/openqodex) was created October 2, 2026 and shows 653 stars, 51 forks, and 15 npm releases (v0.12.0, October 10, 2026, is latest) as of 2026-10-13, pushed the same day. The train continued on October 15 with v0.13.0 (16 npm versions now): repository owners choose convention files (review.instructions_files) that get quoted into the review brief and bound to their original content, every correction round is saved in rounds.json beside the report, report.json gains per-phase timings, the reviewer time cap rose from 10 to 30 minutes per change, and usage.json records each round’s model, tokens, and cost. v0.14.0 (October 23, 2026, the 17th npm version) checks every repository lockfile at every review and scan, shows advisories from outside the scanner set without counting them toward scores while including fixed versions, and the library export now exposes the code graph’s query surface (query, querySliced). v0.15.0 (October 26, 2026, the 18th npm version) teaches the code graph Java: types, methods, constructors, imports, static imports, and calls with no build step, with a call through an interface or base class listing the implementations that may run and overloads told apart by argument count, plus benchmark-docs changes that attach judged runs with their board evidence to the comparison record. v0.16.0 (October 28, 2026, the 19th npm version) links JUnit 4 and JUnit 5 test methods to the Java code they call, follows method references held in locals and anonymous, local, and enum-constant class bodies, and shows possible issues separately from findings, never counted toward the verdict.

Star History Chart

npm reports 4,533 downloads in the week of October 6 to 12, 2026, a figure that fell to 1,918 for October 12 to 18 and again to 1,112 for October 16 to 22, ticked up to 1,158 for October 20 to 26 and then to 1,227 for October 24 to 30, with 8,685 over the trailing month to October 30 (npm API as of 2026-10-30); I lean on the trailing-month window for adoption after the finding that the weekly figure carries zero-day gaps, and the release train shipped four CLI versions in the four days to October 10 plus a benchmark-data release. The first independent coverage arrived on October 11, 2026, and it cut both ways: a Hacker News post (6 points) complains about a new open-source reviewer advertised on X as a CodeRabbit killer, evaluates OpenQodex as that tool, and publishes an open eval harness alongside the results. In it, OpenQodex found 31 percent of the known bugs, the lowest recall of the four configurations tested (the poster’s own reviewer 36 to 38 percent with 91 to 96 percent of findings judged genuine, Greptile 69 percent at 68 percent), with OpenQodex at 86 percent of its findings judged genuine.

Strengths
#

  • The separate-reviewer guarantee is enforced by scripts, not vibes: a review is complete only when every stage ran, every scanner finding was dispositioned, and every changed line reached the reviewer.
  • Scanners carry pinned versions and run only on files they fit, so the static half is reproducible, and the report lists exactly what each one read.
  • The reviewer’s tool surface is deliberately neutered (read, search, list, and none of your config), which shrinks the prompt-injection and credential surface that Kudelski-style exploits ride.
  • Local-first economics: reviews bill to your existing Claude Code or Codex plan, with no API key, account, or server beyond the agent login.
  • The README’s “What it does not do yet” section is unusually candid vendor self-disclosure.

Cautions
#

  • The first independent eval is unflattering on recall: in the October 11, 2026 third-party comparison, OpenQodex found 31 percent of known bugs, the lowest of the configurations tested, though 86 percent of its findings were judged genuine and the run is small enough to re-do.
  • The same post reports the tool’s launch promoted through repeated X advertising framed as a “CodeRabbit killer”, with no published evidence behind the kill claim at post time.
  • The name collides with two neighbors: Qodo, the commercial reviewer in this category, and Codex, the OpenAI agent, so citations and searches will misfire; the eval thread’s commenters said the same.
  • A full review takes one to three minutes and consumes your own agent plan quota on every pre-push run, and the installed scanners need about 1 GB of disk.
  • The hosted Qodex sibling is the business: the open tool has no team memory, no dashboard, and no merge gate, all reserved for the paid product.

Pricing
#

Does not apply: OpenQodex is free and open source under Apache-2.0, running on your existing Claude Code or Codex login, with no paid tier found as of 2026-10-11. The hosted Qodex product from the same team is paid per developer, with no price published on the pages fetched this run.

Compared to
#

  • roborev: the other local, bring-your-own-agent reviewer; roborev reviews every commit with a resident daemon and a findings ledger, OpenQodex is a pre-push gate with a scanner half and a completeness contract.
  • git-lrc: the commit-time gate that records attestations in git history; git-lrc routes through a vendor cloud, OpenQodex stays on your machine and your agent login.
  • Qodo: the similarly named commercial reviewer; Qodo sells a hosted platform with rules mined from PR history, OpenQodex sells nothing and rides your subscription.

Bottom line
#

Recommended for individual developers on Claude Code or Codex who want a hard pre-push review gate that cannot be skipped silently. Not for teams needing a hosted dashboard, learned rules, or strong defect-finding: the one independent eval so far puts it last on recall. My disagreeable take: the completeness contract is the actual invention here, because most review tools quietly skip lines and nobody notices, but a first independent eval scoring it last of four on finding bugs says the side repo is exactly where it stays for now.

Changes
#

  • 2026-10-11 - Created after the entrant scan resolved the openqodex/openqodex candidate from the GitHub topic search; seven sources fetched this run, including the absent-HN-footprint search as the coverage signal.
  • 2026-10-11 - Added the star history chart.
  • 2026-10-13 - Recorded the first independent coverage: the October 11 Hacker News eval (OpenQodex found 31 percent of known bugs, last of four configurations, with 86 percent of its findings judged real) and the reported CodeRabbit-killer X advertising, with repo and npm counts refreshed (653 stars, 4,533 weekly downloads).
  • 2026-10-16 - Recorded v0.13.0 (October 15): owner-chosen convention files bound into the review brief, correction-round receipts in rounds.json, per-phase timings, the reviewer cap raised from 10 to 30 minutes per change, and per-round token and cost records in usage.json.
  • 2026-10-22 - Rotation re-verification: weekly npm downloads fell to 1,918 (week of October 12 to 18) from the 4,533 launch week; v0.13.0 still latest, with only a benchmark-tooling pull request merged since; every cited URL re-fetched, the third-party eval and its numbers unchanged.
  • 2026-10-24 - Volatile re-verification: recorded v0.14.0 (October 23, the 17th npm version): lockfile checks on every review and scan, outside advisories shown but uncounted with fixed versions included, and the library’s exported code-graph query surface; weekly downloads fell again to 1,112 (October 16 to 22) with 6,941 over the trailing month, now the adoption window.
  • 2026-10-26 - Volatile re-verification: the repo pushed again on October 26 with no release after v0.14.0, and the npm figures held on re-fetch (1,112 weekly, 6,941 trailing month, windows unchanged); prices and eval numbers unchanged.
  • 2026-10-27 - Volatile re-verification: recorded [email protected] (October 26, the 18th npm version): Java support in the code graph (types, methods, constructors, imports, and calls, no build step, interface and base-class calls listing their implementations), plus benchmark docs attaching judged runs with board evidence; npm downloads ticked back up to 1,158 for the week of October 20 to 26 and 7,739 over the trailing month, now the adoption window.
  • 2026-10-30 - Volatile re-verification: recorded [email protected] (October 28, the 19th npm version): JUnit 4 and 5 test-method linking in the Java graph, method references and anonymous and local class bodies followed, and possible issues shown separately and never counted toward the verdict; npm reads 1,227 for October 24 to 30 and 8,685 over the trailing month to October 30, now the adoption window.

See also
#

  • roborev - the other local, your-own-agents commit-time reviewer
  • git-lrc - the other pre-PR gate, with the attestation ledger idea
  • Qodo - the commercial reviewer its name is one letter away from
  • Code Review Feature Matrix - where OpenQodex now sits among the category’s members
  • Claude Code - the reviewer process it starts and bills

References
#