Open Code Review Setup: Alibaba's Free AI Reviewer CLI

Open Code Review is a free, Apache-2.0 licensed AI code review CLI that Alibaba ran internally for two years before open sourcing it, and today it is the fastest-climbing tool on GitHub trending, up roughly 980 stars in a day on 15,100 total. Setup takes about five minutes: install the ocr binary, point it at any OpenAI or Anthropic compatible model, and run ocr review for line-level comments on your uncommitted work.

• v1.8.0 shipped today with binaries for Windows, macOS and Linux on amd64 and arm64, plus a self-updating npm package.
• The design is a hybrid: deterministic Go code picks the files and rules, and the LLM is used only for judgment.
• On a 200-pull-request benchmark it reported higher precision than Claude Code on the same model at roughly one ninth the tokens.
• You bring the model, and Delegation Mode needs no API key because your coding agent reviews.

What is Open Code Review and why is it trending?

Open Code Review, ocr on the command line, was Alibaba Group's internal review assistant. The project says it served tens of thousands of developers and flagged millions of defects over roughly two years before being open sourced on May 18, 2026. Written in Go, it now sits at 15,133 stars with 1,020 forks and an OpenSSF Best Practices Silver badge. It reads your Git diff, hands changed files to a configurable LLM through a tool-using agent, and emits comments anchored to specific lines. ocr scan reviews whole files instead, for a codebase with no useful history.

RelatedStrix Setup: Run an AI Penetration Tester on Your Code

The spike has one clear driver: the benchmark. Fifty popular repositories, 200 real pull requests and 10 languages, cross-validated by 80-plus senior engineers into 1,505 ground-truth issues. Against a general-purpose agent (Claude Code) on the same model, it reported higher precision and F1 at roughly one ninth of the tokens. Recall came out lower, which the team calls deliberate: precision over noise. Its case against pure prompting is that agents cut corners on large changesets, drift off the correct line, and swing in quality when a prompt changes. The built-in ruleset targets null pointer exceptions, thread safety, XSS and SQL injection.

How do you install the ocr CLI on macOS, Linux and Windows?

You need Git 2.41 or newer, since everything runs off Git. The npm route needs Node 18 or newer and is recommended, because the wrapper upgrades itself in the background:

# recommended, all platforms (needs Node 18+)
npm install -g @alibaba-group/open-code-review

To keep Node out of it, an installer script downloads the release binary and verifies its checksum. Today's v1.8.0 build is about 44.7 MB for Linux amd64:

# macOS / Linux, installs to /usr/local/bin by default
curl -fsSL https://raw.githubusercontent.com/alibaba/open-code-review/main/install.sh | sh

On Windows, PowerShell 5.1 or newer, use the PowerShell installer. It defaults to %LOCALAPPDATA%\Programs\ocr:

# Windows PowerShell
irm https://raw.githubusercontent.com/alibaba/open-code-review/main/install.ps1 | iex
ocr version

Both installers honour OCR_INSTALL_DIR and OCR_VERSION for pinning a tag in CI. All state lives in ~/.opencodereview/, so deleting it uninstalls cleanly.

How do you configure a model and run your first review?

There is no bundled model; you point it at an endpoint you already pay for:

ocr config provider          # pick a provider, enter the key
ocr config model             # choose a model
ocr llm test                 # verify the endpoint answers

In CI or anywhere without a TUI, write the same config non-interactively:

ocr config set provider                    anthropic
ocr config set model                       claude-opus-4-6
ocr config set providers.anthropic.api_key sk-ant-xxxxxxxxxx

Then review. Workspace mode is the default and covers staged, unstaged and untracked changes, so it works as a real pre-commit check:

cd your-project

ocr review                                      # staged + unstaged + untracked
ocr review --from main --to feature-branch      # compare two refs
ocr review --commit abc123                      # one commit
ocr review --preview                            # dry run, no LLM cost

ocr scan --path internal/agent                  # whole files, no git history needed

Run --preview first. It is free and lists every candidate file with the reason it was kept or dropped. That is how you catch a file excluded by a default test-path pattern instead of reviewed clean.

Relatedego lite Setup: Let Claude Code Drive Your Real Browser

For CI, ocr review --format json --audience agent leaves a clean JSON envelope on stdout, which the shipped recipes parse before posting comments through the GitHub or GitLab API; pipelines for Actions, GitLab CI, Bitbucket, Gerrit and GitFlic sit in examples/. Inside a coding agent, Delegation Mode is the cheapest entry: ocr delegate preview and ocr delegate rule hand file selection and rule resolution to ocr while your agent's model reviews, so no separate key is needed.

How does it compare with using a general coding agent?

What are the gotchas before you rely on it?

Five things worth knowing before this goes in a merge gate. First and most important, your model must support native tool calling. The whole review runs through tool calls, so a model that only narrates tool use in text can never work. The FAQ names deepseek-r1 as a casualty and qwen3 as one that works; the symptom is a loop of "No tool calls parsed" ending in zero comments.

Second, large files are skipped rather than truncated: if a file's prompt passes 80 percent of the 58,888-token budget it is dropped and noted in the warnings, so a big generated file goes unreviewed unless you exclude it. Third, and this will bite CI authors, partial failures still exit 0. The run exits non-zero only when every sub-agent failed, so a gate checking the exit code alone passes a review where half the files errored. Parse the warnings array. Fourth, comments sometimes arrive at line 0 when the model paraphrases code instead of copying it; the finding is real, just unplaced. Fifth, recall is lower by design, so this sits alongside human review. When output looks wrong, ocr rules check <file> shows the matching rule layer and ocr viewer replays the session.

Our take

The lesson is not that an AI can review code. Everyone knew that. It is that the winning move was taking work away from the model. Most AI review tools of the past two years tried to fix coverage and positioning with better prompting; this project treats those as engineering problems, and lets the model only judge. The one-ninth token figure is the consequence, and it decides whether review runs on every pull request or only when someone asks.

Two caveats stay in view. The benchmark comes from the party it flatters, and precision-first tuning means real defects slip through, so treating a green ocr review as proof of correctness is the wrong lesson. Use it as a cheap first pass over the boring, expensive bug classes. For that, five minutes of setup is close to a free win.

Original analysis by GenZTech. Tool documentation: alibaba/open-code-review on GitHub.