# Open Code Review — AI-Powered Code Review by Alibaba

> Battle-tested hybrid code review tool combining deterministic static analysis pipelines with LLM agents for precise, line-level review comments.

## Install

Save as a script file and run:

# Open Code Review — AI-Powered Code Review by Alibaba

## Quick Use
```bash
git clone https://github.com/alibaba/open-code-review.git
cd open-code-review
docker compose up -d
# Configure your repository webhook to point at the service
```

## Introduction
Open Code Review is an open-source tool from Alibaba that combines rule-based static analysis with LLM-powered review. It produces precise line-level comments on pull requests, catching bugs like null pointer exceptions, thread safety issues, XSS, and SQL injection.

## What Open Code Review Does
- Analyzes pull request diffs for bugs, security issues, and code smells
- Posts precise line-level comments directly on pull requests
- Runs deterministic rule pipelines for known bug patterns (NPE, thread safety, XSS)
- Uses LLM agents for semantic review of logic and design issues
- Integrates with GitHub, GitLab, and Bitbucket via webhooks

## Architecture Overview
The system uses a hybrid architecture. First, a deterministic pipeline runs fine-tuned rules against the diff to catch well-known patterns (null dereferences, injection flaws, race conditions). Then an LLM agent reviews the remaining diff with repository-level context to catch semantic issues. Results merge into a unified comment set, deduplicated and ranked by severity.

## Self-Hosting & Configuration
- Deploy via Docker Compose with minimal configuration
- Connect to your Git platform via webhook integration
- LLM backend is configurable (OpenAI, Anthropic, or compatible)
- Built-in ruleset covers Java, Python, JavaScript, TypeScript, and Go
- Custom rules can be added via YAML configuration files

## Key Features
- Hybrid architecture combining static rules with LLM reasoning
- Built-in fine-tuned ruleset for common vulnerability patterns
- Repository-level context for deeper semantic analysis
- Line-level precision in review comments
- OpenAI and Anthropic compatible API support

## Comparison with Similar Tools
- **PR-Agent** — LLM-only code review; Open Code Review adds deterministic rule pipelines
- **SonarQube** — traditional static analysis; Open Code Review adds LLM-powered semantic review
- **Semgrep** — pattern-based scanning; Open Code Review integrates LLM context for false positive reduction
- **CodeRabbit** — SaaS review tool; Open Code Review is self-hosted and open source

## FAQ
**Q: What programming languages are supported?**
A: Java, Python, JavaScript, TypeScript, and Go are supported with built-in rules; LLM review works on any language.

**Q: Does it work with monorepos?**
A: Yes, it analyzes only the changed files in a pull request regardless of repository size.

**Q: How are false positives handled?**
A: The hybrid approach reduces false positives by cross-checking rule matches against LLM understanding.

**Q: Can I disable the LLM component?**
A: Yes, it can run in rules-only mode for environments without LLM API access.

## Sources
- https://github.com/alibaba/open-code-review
- https://github.com/alibaba/open-code-review/blob/main/README.md

---
Source: https://tokrepo.com/en/workflows/asset-ae2af9a5
Author: Script Depot