Open Code Review — AI-Powered Code Review by Alibaba

Introduction

Open Code Review is an open-source tool from Alibaba that combines rule-based static analysis with LLM-powered review. It produces precise line-level comments on pull requests, catching bugs like null pointer exceptions, thread safety issues, XSS, and SQL injection.

What Open Code Review Does

• Analyzes pull request diffs for bugs, security issues, and code smells
• Posts precise line-level comments directly on pull requests
• Runs deterministic rule pipelines for known bug patterns (NPE, thread safety, XSS)
• Uses LLM agents for semantic review of logic and design issues
• Integrates with GitHub, GitLab, and Bitbucket via webhooks

Architecture Overview

The system uses a hybrid architecture. First, a deterministic pipeline runs fine-tuned rules against the diff to catch well-known patterns (null dereferences, injection flaws, race conditions). Then an LLM agent reviews the remaining diff with repository-level context to catch semantic issues. Results merge into a unified comment set, deduplicated and ranked by severity.

Self-Hosting & Configuration

• Deploy via Docker Compose with minimal configuration
• Connect to your Git platform via webhook integration
• LLM backend is configurable (OpenAI, Anthropic, or compatible)
• Built-in ruleset covers Java, Python, JavaScript, TypeScript, and Go
• Custom rules can be added via YAML configuration files

Key Features

• Hybrid architecture combining static rules with LLM reasoning
• Built-in fine-tuned ruleset for common vulnerability patterns
• Repository-level context for deeper semantic analysis
• Line-level precision in review comments
• OpenAI and Anthropic compatible API support

Comparison with Similar Tools

• PR-Agent — LLM-only code review; Open Code Review adds deterministic rule pipelines
• SonarQube — traditional static analysis; Open Code Review adds LLM-powered semantic review
• Semgrep — pattern-based scanning; Open Code Review integrates LLM context for false positive reduction
• CodeRabbit — SaaS review tool; Open Code Review is self-hosted and open source

FAQ

Q: What programming languages are supported? A: Java, Python, JavaScript, TypeScript, and Go are supported with built-in rules; LLM review works on any language.

Q: Does it work with monorepos? A: Yes, it analyzes only the changed files in a pull request regardless of repository size.

Q: How are false positives handled? A: The hybrid approach reduces false positives by cross-checking rule matches against LLM understanding.

Q: Can I disable the LLM component? A: Yes, it can run in rules-only mode for environments without LLM API access.

Sources

• https://github.com/alibaba/open-code-review
• https://github.com/alibaba/open-code-review/blob/main/README.md