Open Code Review

Open Code Review is Alibaba’s open-source AI code review tool with 47,700+ stars on GitHub — battle-tested at Alibaba’s scale and built on a hybrid of deterministic pipelines and an LLM agent.

Overview

Pure LLM reviewers are enthusiastic but noisy; pure rule engines are precise but blind to intent. Open Code Review splits the work between them. Deterministic pipelines run exact, line-level checks backed by a built-in multi-language ruleset covering classic defects such as null-pointer risks, thread-safety problems, XSS and SQL injection. On top of that, an LLM agent reads the change with repository-level context — the surrounding code, not just the diff — and reasons about design and logic issues a rule cannot express. The result is precise, actionable comments attached to the exact lines that need attention, rather than a generic summary. It works with OpenAI- and Anthropic-compatible model APIs, integrates into CI workflows, and ships as an agent-friendly tool with a skill and harness design for coding assistants. Released under the Apache License 2.0.

Key Features

• Hybrid architecture – deterministic checks for precision plus an LLM agent for contextual reasoning.
• Precise line-level comments – findings point at exact lines, not vague file-level complaints.
• Built-in multi-language rulesets – NPE, thread-safety, XSS, SQL injection and other defect patterns.
• Repository-level context – the agent reviews changes against the whole codebase, not just the diff.
• OpenAI and Anthropic compatible – bring the model provider you already use.
• CI-friendly – run it in pipelines as an automated first-pass reviewer.
• Battle-tested at scale – hardened inside Alibaba before its open-source release.

💳 Pricing

Open Code Review is free and open source under the Apache License 2.0. You self-host it and only pay your chosen model provider for the tokens its agent consumes.

Who Is It For

Engineering teams that want automated first-pass code review with fewer false positives than LLM-only tools — especially large codebases where security and concurrency defects are expensive to miss.