# Open Code Review — AI-Augmented Code Review at Scale

> Alibaba's open-source hybrid code review tool combining deterministic rule pipelines with LLM agents for precise, line-level review comments with built-in security rulesets.

## Install

Save as a script file and run:

# Open Code Review — AI-Augmented Code Review at Scale

## Quick Use
```bash
git clone https://github.com/alibaba/open-code-review.git
cd open-code-review
make build
./ocr review --repo . --diff HEAD~1
```

## Introduction
Open Code Review is an open-source, hybrid-architecture code review tool developed by Alibaba. It combines deterministic analysis pipelines with LLM-powered agents to deliver precise, line-level review comments. The tool comes with fine-tuned rulesets for common vulnerabilities like null-pointer exceptions, thread-safety issues, XSS, and SQL injection.

## What Open Code Review Does
- Performs automated code reviews with line-level precision on pull requests and diffs
- Combines static analysis rules with LLM agents for contextual understanding
- Ships with built-in rulesets for NPE, thread-safety, XSS, SQL injection, and more
- Integrates with GitHub, GitLab, and other Git hosting platforms via webhooks
- Supports OpenAI and Anthropic compatible LLM providers for the agent layer

## Architecture Overview
Open Code Review runs a two-stage pipeline. The first stage applies deterministic rules written in Go that scan for known code patterns and anti-patterns. The second stage sends flagged code sections to an LLM agent for contextual analysis and natural-language comment generation. Results are deduplicated and ranked by severity before being posted as inline review comments. The architecture is designed for horizontal scaling to handle enterprise review volumes.

## Self-Hosting & Configuration
- Build from source with Go or use the provided Docker image
- Configure your Git platform integration via webhook URLs and access tokens
- Set LLM provider credentials for the agent-powered review stage
- Customize rulesets by enabling or disabling individual checks in the config
- Deploy as a service that listens for pull request events from your Git platform

## Key Features
- Hybrid architecture combining static rules with LLM contextual understanding
- Line-level precision for review comments rather than file-level summaries
- Built-in fine-tuned rulesets battle-tested at Alibaba scale
- Compatible with OpenAI and Anthropic APIs for the LLM layer
- Open-source and self-hostable for data-sensitive environments

## Comparison with Similar Tools
- **PR-Agent** — LLM-first code review; Open Code Review adds deterministic rule pipelines for precision
- **SonarQube** — static analysis platform; Open Code Review adds LLM-powered contextual reasoning
- **Semgrep** — pattern-based static analysis; Open Code Review combines patterns with natural-language review
- **CodeRabbit** — commercial AI review; Open Code Review is fully open-source and self-hosted
- **GitHub Copilot Code Review** — cloud-based; Open Code Review can run entirely on-premises

## FAQ
**Q: Does it support languages beyond Java?**
A: The deterministic rules target Java primarily, but the LLM agent layer works across any language the model understands.

**Q: Can I add custom rules?**
A: Yes. The rule engine supports custom pattern definitions that you can add alongside the built-in rulesets.

**Q: How does it handle false positives?**
A: The hybrid architecture reduces false positives by requiring both the rule engine and LLM agent to agree before posting high-severity comments.

**Q: Does it work with private repositories?**
A: Yes. It runs self-hosted so all code stays within your infrastructure.

## Sources
- https://github.com/alibaba/open-code-review


---
Source: https://tokrepo.com/en/workflows/asset-33d9e42a
Author: Script Depot