阿里巴巴开源 Open Code Review：确定性流水线与 LLM Agent 结合的代码审查工具

---

什么是 Open Code Review？

Open Code Review 是一款由 AI 驱动的代码审查 CLI 工具。它起源于阿里巴巴集团内部官方 AI 代码审查助手——过去两年间，已服务数万名开发者，并识别出数百万处代码缺陷。经过超大规模的充分验证后，我们将其孵化为面向社区的开源项目。只需配置一个模型端点即可开始使用。

它读取 Git diff，通过具备工具调用能力的 Agent 将变更文件发送给可配置的 LLM，并生成具备行级精度的结构化审查评论。该 Agent 可以读取完整文件内容、搜索代码库、检查其他变更文件以获取上下文，并进行深度审查——而不只是对 diff 提供表层反馈。除 diff 审查外，ocr scan 还可审查整个文件，适用于审计不熟悉的代码库，或没有有效 diff 的目录。

访问官方网站了解更多详情。

与通用 Agent（Claude Code）相比，在使用相同底层模型的情况下，Open Code Review 可实现显著更高的 Precision 和 F1，同时仅消耗约 1/9 的 Token，并能更快完成审查。请注意，其 Recall 低于通用 Agent——这是刻意作出的权衡，优先保证准确性而非制造噪声。

一项真实世界代码审查基准测试：由 50 个热门开源仓库、200 个真实 Pull Request 和 10 种编程语言构建，并经 80 多名资深工程师交叉验证（共标注 1,505 个真实问题）。

指标	衡量内容	重要性
F1	Precision 与 Recall 的调和平均数	衡量整体审查质量的最佳单一指标
Precision	已报告问题中真实缺陷所占比例	越高 = 需要人工甄别的误报越少
Recall	被发现的真实缺陷所占比例	越高 = 漏过审查的问题越少
Avg Time	每次审查的实际耗时	影响 CI 流水线延迟
Avg Token	每次审查消耗的 Token 总量	直接影响 API 成本

通用 Agent 的问题

如果你曾使用 Claude Code 等带有代码审查 Skills 的通用 Agent，可能遇到过以下痛点：

• 覆盖不完整——面对较大的变更集时，Agent 往往会“偷工减料”，选择性地只审查部分文件，从而遗漏其他文件。
• 位置漂移——报告的问题经常与实际代码位置不匹配，行号或文件引用会偏离目标位置。
• 质量不稳定——由自然语言驱动的 Skills 很难调试，审查质量会随着 Prompt 的细微变化而显著波动。

根本原因在于：纯语言驱动的架构缺少对审查流程的硬性约束。

核心设计：确定性工程 × Agent 混合架构

Open Code Review 的核心理念，是将确定性工程与 Agent 相结合，让两者各自处理最擅长的工作。

确定性工程——硬性约束

对于 绝不能出错 的审查步骤，使用工程逻辑而非语言模型来保证正确性：

• 精准文件选择——精确判定哪些文件需要审查、哪些应被过滤，确保不会遗漏重要变更。
• 智能文件打包——将相关文件归入同一个审查单元（例如，message_en.properties 与 message_zh.properties 会被打包在一起）。每个文件包均作为拥有隔离上下文的子 Agent 运行——这种分治策略可在超大变更集上保持稳定，并天然支持并发审查。
• 细粒度规则匹配——根据每个文件的特征匹配审查规则，让模型注意力高度聚焦，并从源头消除信息噪声。与纯语言驱动的规则指导相比，基于模板引擎的规则匹配更加稳定、可预测。
• 外部定位与反思模块——独立的评论定位和评论反思模块，系统性提升 AI 反馈的位置准确性与内容准确性。

Agent——动态决策

Agent 的能力集中用于最关键的环节——动态决策与动态上下文检索：

• 场景调优的 Prompt——针对代码审查深度优化的 Prompt 模板，在提升效果的同时降低 Token 消耗。

• 场景调优的工具集——从大规模生产数据中的工具调用轨迹深度分析中提炼而来，包括调用频率分布、各工具重复调用率，以及新增工具对整体调用链的影响，最终形成一套专为代码审查打造的工具集；相较通用 Agent 工具集，它更稳定、更可预测。

• Git >= 2.41——Open Code Review 依赖 Git 生成 diff、搜索代码及执行仓库操作。

  npm install -g @alibaba-group/open-code-review

安装完成后，ocr 命令可在全局使用。

如需其他安装方式（安装脚本、GitHub Release 二进制文件、从源码安装），请参阅安装说明。

1. 配置 LLM

除非使用委托模式，否则必须先配置 LLM 才能审查代码。

ocr config provider          # 选择内置提供商或添加自定义提供商
ocr config model             # 为当前提供商选择模型

交互式 UI 将引导你完成提供商选择、API Key 输入和模型配置，并自动测试连接情况。

关于 CLI 设置、环境变量、自定义提供商及其他高级配置，请参阅配置说明。

2. 审查

cd your-project

# 工作区模式——审查所有已暂存、未暂存和未跟踪的变更
ocr review

# 分支范围——比较两个引用
ocr review --from main --to feature-branch

# 单个提交
ocr review --commit abc123

# 恢复被中断的范围审查或提交审查
ocr session list
ocr review --from main --to feature-branch --resume <session-id>

# 全文件扫描——审查完整文件而非 diff（不需要 Git 历史）
ocr scan                          # 扫描整个仓库
ocr scan --path internal/agent    # 扫描目录或指定文件

# 委托模式——让你的 AI 编码 Agent 自行执行审查
# OCR 负责文件选择和规则解析；无需配置 LLM
ocr delegate preview
ocr delegate rule src/main.go src/handler.go

完整文档位于 open-codereview.ai/docs：

• 快速开始——安装并运行你的首次审查
• 安装——所有平台及包管理器
• CLI 参考——全部命令和参数
• 审查规则——通过路径过滤与目标指定自定义审查规则
• 配置——配置键与环境变量
• MCP Server——使用外部工具扩展审查 Agent
• 编码 Agent 集成——将 OCR 集成至 Claude Code、Codex、Cursor 等工具。
  • Skill——安装为可复用的 Agent Skill
  • 插件——安装为 Claude Code / Codex / Cursor 插件
  • 委托模式——让 Agent 使用其自身的 LLM 进行审查
• CI/CD 集成——GitHub Actions、GitLab CI、GitFlic CI 和 Gerrit 集成
• 会话查看器——在浏览器中浏览和回放审查会话
• 遥测——用于可观测性的 OpenTelemetry 集成
• FAQ——常见问题与故障排除

本项目的存在离不开所有贡献者。有关开发环境配置、编码规范及如何提交 Pull Request，请参阅CONTRIBUTING.md。

Apache-2.0 —— Copyright 2026 Alibaba

English | 简体中文 | 日本語 | 한국어 | Русский

---

What is Open Code Review?

Open Code Review is an AI-powered code review CLI tool. It originated as Alibaba Group's internal official AI code review assistant — over the past two years, it has served tens of thousands of developers and identified millions of code defects. After thorough validation at massive scale, we incubated it into an open source project for the community. Simply configure a model endpoint to get started.

It reads Git diffs, sends changed files to a configurable LLM via an agent with tool-use capabilities, and generates structured review comments with line-level precision. The agent can read full file contents, search the codebase, inspect other changed files for context, and produce deep reviews — not just surface-level diff feedback. Beyond diff review, ocr scan reviews entire files for auditing unfamiliar codebases or directories that have no meaningful diff.

Visit the official website for more details.

Compared to general-purpose agents (Claude Code), Open Code Review achieves significantly higher Precision and F1 with the same underlying model, while consuming only ~1/9 of the tokens and completing reviews faster. Note that its Recall is lower than general-purpose agents — a deliberate trade-off favoring precision over noise.

A real-world code review benchmark built from 50 popular open-source repositories, 200 real Pull Requests, and 10 programming languages — cross-validated by 80+ senior engineers (1,505 annotated ground-truth issues).

Metric	What it measures	Why it matters
F1	Harmonic mean of precision and recall	Best single number for overall review quality
Precision	Proportion of reported issues that are real defects	Higher = fewer false alarms to triage
Recall	Proportion of real defects that are found	Higher = fewer issues slip through review
Avg Time	Wall-clock time per review	Matters for CI pipeline latency
Avg Token	Total tokens consumed per review	Directly impacts API cost

The Problem with General-Purpose Agents

If you've used general-purpose agents like Claude Code with Skills for code review, you've likely encountered these pain points:

• Incomplete coverage — On larger changesets, agents tend to "cut corners," selectively reviewing only some files and missing others.
• Position drift — Reported issues frequently don't match the actual code location, with line numbers or file references drifting off target.
• Unstable quality — Natural-language-driven Skills are hard to debug, and review quality fluctuates significantly with minor prompt variations.

The root cause: a purely language-driven architecture lacks hard constraints on the review process.

Core Design: Deterministic Engineering × Agent Hybrid

Open Code Review's core philosophy is to combine deterministic engineering with an agent, each handling what it does best.

Deterministic Engineering — Hard Constraints

For review steps that must not go wrong , engineering logic — not the language model — guarantees correctness:

• Precise file selection — Determines exactly which files need review and which should be filtered, ensuring no important change is missed.
• Smart file bundling — Groups related files into a single review unit (e.g., message_en.properties and message_zh.properties are bundled together). Each bundle runs as a sub-agent with isolated context — a divide-and-conquer strategy that stays stable on very large changesets and naturally supports concurrent review.
• Fine-grained rule matching — Matches review rules to each file's characteristics, keeping the model's attention sharply focused and eliminating information noise at the source. Compared to purely language-driven rule guidance, template-engine-based rule matching is more stable and predictable.
• External positioning and reflection modules — Independent comment-positioning and comment-reflection modules systematically improve both the location accuracy and content accuracy of AI feedback.

Agent — Dynamic Decision-Making

The agent's strengths are concentrated where they matter most — dynamic decisions and dynamic context retrieval:

• Scenario-tuned prompts — Prompt templates deeply optimized for code review, improving effectiveness while reducing token consumption.

• Scenario-tuned toolset — Distilled from deep analysis of tool-call traces in large-scale production data — including call frequency distributions, per-tool repetition rates, and the impact of new tools on the overall call chain — resulting in a purpose-built toolset that is more stable and predictable for code review than a generic agent toolkit.

• Git >= 2.41 — Open Code Review relies on Git for diff generation, code search, and repository operations.

  npm install -g @alibaba-group/open-code-review

After installation, the ocr command is available globally.

For other installation methods (install script, GitHub Release binary, from source), see Installation.

1. Configure LLM

You must configure an LLM before reviewing code, unless you use Delegation Mode.

ocr config provider          # Select a built-in provider or add a custom one
ocr config model             # Pick a model for the active provider

The interactive UI guides you through provider selection, API key entry, and model configuration, then automatically tests connectivity.

For CLI setup, environment variables, custom providers, and other advanced configuration, see Configuration.

2. Review

cd your-project

# Workspace mode — review all staged, unstaged, and untracked changes
ocr review

# Branch range — compare two refs
ocr review --from main --to feature-branch

# Single commit
ocr review --commit abc123

# Resume an interrupted range or commit review
ocr session list
ocr review --from main --to feature-branch --resume <session-id>

# Full-file scan — review whole files instead of a diff (no git history needed)
ocr scan                          # scan the entire repository
ocr scan --path internal/agent    # scan a directory or specific files

# Delegation mode — let your AI coding agent perform the review itself
# OCR handles file selection and rule resolution; no LLM configuration needed
ocr delegate preview
ocr delegate rule src/main.go src/handler.go

Full documentation lives at open-codereview.ai/docs :

• Quickstart — install and run your first review
• Installation — all platforms and package managers
• CLI Reference — every command and flag
• Review Rules — customize review rules with path filtering and targeting
• Configuration — config keys and environment variables
• MCP Server — extend the review agent with external tools
• Coding Agent Integrations — integrate OCR into Claude Code, Codex, Cursor, etc.
  • Skill — install as a reusable agent skill
  • Plugin — install as a Claude Code / Codex / Cursor plugin
  • Delegation Mode — let your agent review using its own LLM
• CI/CD Integration — GitHub Actions, GitLab CI, GitFlic CI, and Gerrit integration
• Session Viewer — browse and replay review sessions in browser
• Telemetry — OpenTelemetry integration for observability
• FAQ — common questions and troubleshooting

This project exists thanks to all the people who contribute. See CONTRIBUTING.md for development setup, coding guidelines, and how to submit pull requests.

Apache-2.0 — Copyright 2026 Alibaba