Open Code Review (ocr) is an Apache-2.0 CLI code-review tool open-sourced by Alibaba, built on a hybrid architecture that combines deterministic pipelines with an LLM agent. It reviews Git diffs or scans whole files and returns line-level comments, with independent positioning and reflection modules aimed at reducing false positives. Built-in fine-tuned rules target null-pointer exceptions, thread-safety issues, XSS, and SQL injection. The project states it originated from Alibaba's internal system and "served tens of thousands of developers and identified millions of code defects" (vendor claim, not independently verified). Integration surface: ready-made GitHub Actions, GitLab CI, and GitFlic CI pipelines; installable as a Claude Code / Codex / Cursor plugin or Agent Skill; and an MCP server. It is provider-agnostic — Anthropic, OpenAI, Dashscope, Deepseek, Z-AI, plus any OpenAI/Anthropic-compatible custom endpoint, so no model lock-in. Standard AI-reviewer data-flow caveat: diffs/files are sent to whichever LLM endpoint you configure. Telemetry is disabled by default (optional OTLP export); config lives locally in ~/.opencodereview/config.json.
Open Code Review
Alibaba's open-source hybrid AI code reviewer with line-level comments
- Pricing Model
- open-source
- License
- Open Source
- Telemetry
- Clean
- Last Verified
- Aug 26, 2026
- Supported Platforms
- CLI on Windows/macOS/Linux (`ocr review`/`ocr scan`). CI/CD via GitHub Actions, GitLab CI, GitFlic CI. Coding-agent plugins for Claude Code, Codex, Cursor; Agent Skill; MCP server. Provider-agnostic.
- Primary Categories
- Code Review AI
- Tags
- Static Analysis, CLI, CI/CD, MCP
Open-source (Apache-2.0) CLI code reviewer from Alibaba that pairs deterministic rule pipelines with an LLM agent to post precise, line-level review comments. Runs locally or in CI, is provider-agnostic across OpenAI/Anthropic-compatible endpoints, and ships built-in rules for common defects.
Pricing & Platform Specs
Pricing Summary
Free and open-source under the Apache-2.0 license. Teams self-host the tool and supply their own API keys for LLM providers (Anthropic, OpenAI, DashScope, DeepSeek) or local models.
full pricing breakdown →Supported Platforms
CLI on Windows/macOS/Linux (`ocr review`/`ocr scan`). CI/CD via GitHub Actions, GitLab CI, GitFlic CI. Coding-agent plugins for Claude Code, Codex, Cursor; Agent Skill; MCP server. Provider-agnostic.
Categories
Alternatives
AI-powered code review
AI-powered code review tool that automatically analyzes pull requests and provides line-by-line feedback on code quality, bugs, security vulnerabilities, and best practices. Integrates with GitHub and GitLab as a bot that comments on PRs. Uses LLMs to understand code context and suggest improvements. Learns from your codebase patterns and team preferences. Supports all major programming languages. Reduces review cycle time while catching issues human reviewers might miss.
AI code review with full codebase context
Greptile is a Y Combinator-backed AI code review tool that indexes your entire codebase to build a semantic code graph of functions, classes, and dependencies. Unlike diff-only reviewers, it catches cross-file issues, architectural drift, and convention violations with an 82% bug catch rate. Supports GitHub, GitLab, Jira, Slack, and VS Code. Offers cloud and self-hosted VPC deployment with SOC2 Type II compliance. Used by 250+ companies including Stripe and Amazon.
Automated code quality
Codacy is a managed code quality, security and AI-guardrails platform for GitHub, GitLab and Bitbucket teams. It scans pull requests and repositories for quality, coverage and security issues while adding AI Inventory, AI Guardrails, AI Risk Hub, AI Reviewer and Verity beta surfaces for AI-assisted engineering.
Code quality and security analysis platform
SonarQube is an open-source code quality and security platform with 10K+ GitHub stars that inspects code for bugs, vulnerabilities, code smells, and security hotspots. It enforces quality gates in CI/CD pipelines, supports 30+ languages in Team plans and 40+ in Enterprise, and remains the industry standard for static code quality management.
Sources & verification
- Sources checked
- Content verified
Verification dates are editorial checks. Routine CMS saves and automatic updatedAt timestamps do not advance them.
FAQ
What is Open Code Review?
Open-source (Apache-2.0) CLI code reviewer from Alibaba that pairs deterministic rule pipelines with an LLM agent to post precise, line-level review comments. Runs locally or in CI, is provider-agnostic across OpenAI/Anthropic-compatible endpoints, and ships built-in rules for common defects.
Is Open Code Review free?
Yes — Open Code Review is open source and free to use. Free and open-source under the Apache-2.0 license. Teams self-host the tool and supply their own API keys for LLM providers (Anthropic, OpenAI, DashScope, DeepSeek) or local models.
Is Open Code Review open source?
Yes — Open Code Review is open source.
Is Open Code Review still maintained?
Yes — Open Code Review is active. Its listing was last verified on August 26, 2026.
What are the best Open Code Review alternatives?
The first editor-selected Open Code Review alternatives are CodeRabbit, Greptile, Codacy, and more.
