alibaba/open-code-review

{"i": 0, "repo": "alibaba/open-code-review", "stars": 13145, "lang": "Go", "ok": true, "char_count": 1863, "text": "Open Code Review is an AI-powered code review tool that started as an internal assistant at Alibaba. Over two years, it served tens of thousands of developers and identified millions of code defects. Alibaba has now released it as a free, open source project. You configure a model endpoint, and the tool reads your Git changes, sends the modified files to a language model, and produces structured review comments pinned to specific lines of code.\n\nWhat sets it apart is its hybrid approach. Many general purpose AI agents struggle with large changesets: they skip files, report issues at the wrong line numbers, and produce inconsistent results when prompts change slightly. Open Code Review addresses this by pairing deterministic engineering logic with an AI agent. The engineering side handles tasks where correctness is critical, such as selecting which files to review, bundling related files together, and matching rules to file characteristics. The agent side handles dynamic decisions and context retrieval, reading full file contents and searching the codebase when needed.\n\nThe tool ships with a fine-tuned ruleset covering common defect categories like null pointer exceptions, thread safety issues, cross-site scripting, and SQL injection. It also supports custom rules. Beyond reviewing diffs, a scan mode lets you audit entire files or directories, which is useful when exploring unfamiliar codebases.\n\nIn a benchmark built from 50 open source repositories, 200 real pull requests, and 10 programming languages, Open Code Review achieved higher precision and F1 scores than general purpose agents using the same underlying model, while consuming roughly one-ninth of the tokens. The trade-off is lower recall, meaning it may miss some issues in exchange for producing fewer false alarms. The benchmark was cross-validated by over 80 senior engineers across 1,505 annotated issues.\n\nInstallation is straightforward: install Node.js, run a single npm command, and the ocr command becomes available globally. Git 2.41 or newer is required. The full README is longer than what was shown.", "error": null}