Logo
Deploy Now

Categories

Self-Hosted Developer Tools DevOps AI Automation Security CI/CD Code Review

Stars

21,294

Forks

1,557

Watchers

67

Developer links

Last Updated: 08-24-2026 09:23 AM (UTC)

Open Code Review

Originated as Alibaba Group's official internal AI code review assistant serving tens of thousands of developers and identifying millions of code defects over two years before open-sourcing in May 2026 — now at 21,000+ GitHub stars — Open Code Review is the production-hardened platform that proves enterprise-grade code review can be fully open-source under Apache 2.0. The hybrid architecture separates deterministic engineering pipelines (file selection, diff parsing, rule matching for NPE, thread-safety, XSS, and SQL injection across 10+ languages) from LLM-powered agent reasoning with tool-use capabilities including FileRead, CodeSearch, and cross-file context inspection, consuming approximately one-ninth the tokens of general-purpose coding agents while delivering line-level precise comments with severity and confidence scoring. The bundled web dashboard (port 4173) provides review management, findings triage, result browsing, and direct GitHub posting without external dependencies, while the session viewer (port 5483) renders full LLM request/response traces for debugging and auditing. Integration spans GitHub Actions, GitLab CI, GitFlic CI, and Gerrit with delegation mode enabling Claude Code, Cursor, and other AI agents to leverage OCR's engineering logic alongside their own LLM reasoning. Supports OpenAI, Anthropic, Google Gemini, DeepSeek via built-in providers plus Ollama and vLLM for air-gapped deployments. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Open Code Review

Benefits

  • Alibaba-Scale Battle Testing
  • Validated across tens of thousands of developers identifying millions of real code defects over two years of production use at one of the world's largest tech companies.
  • Hybrid Precision Architecture
  • Deterministic pipelines handle file selection and rule matching while LLM agents provide deep reasoning, consuming one-ninth the tokens of general-purpose coding agents.
  • Built-In Web Dashboard
  • Bundled dashboard on port 4173 provides review management, findings triage, result browsing, and direct GitHub posting without requiring any separate frontend deployment.
  • Universal Platform Integration
  • Native CI/CD plugins for GitHub Actions, GitLab CI, GitFlic CI, and Gerrit with delegation mode for Claude Code, Cursor, and other MCP-aware AI agents.

Features

  • Multi-Language Rule Engine
  • Built-in deterministic rules for NPE, thread-safety, XSS, SQL injection, and convention drift across Java, TypeScript, Go, Python, Rust, and C++.
  • Agent Tool Use
  • LLM agent with FileRead, CodeSearch, and cross-file inspection capabilities delivers deep multi-file reasoning beyond surface-level diff feedback.
  • Session Persistence
  • JSONL-based session storage with embedded viewer server renders complete LLM request/response traces for review auditing and debugging.
  • Delegation Mode
  • Host AI agents like Claude Code or Cursor use OCR's deterministic engineering logic while providing their own LLM reasoning for flexible integration.
  • Vulnerability Detection
  • Identifies injection vectors, unsafe deserialization, leaked secrets, authentication bypasses, and race conditions with direct line references in changed files.