Review your own code like Alibaba does: a hands-on guide to OpenCodeReview

OpenCodeReview stats banner: 20K+ internal active users, 3M+ real-world tasks, 1/9 token cost, 25.10% AACR-Bench, on a dark background — OpenCodeReview's own stats: 20K+ internal users, 3M+ review tasks, 1/9th the token cost of Claude Code on 1,000 PRs. Image: alibaba/open-code-review (Apache-2.0).

Most AI code reviews are a coin flip: ask a general-purpose agent to review a big diff and it skims files, cites line numbers that don't exist, and changes its mind with every prompt tweak. OpenCodeReview (alibaba/open-code-review) is Alibaba's answer, now open source: an AI code reviewer — past 46,000 GitHub stars, Apache-2.0 — built as a hybrid of deterministic engineering and an agent. The engineering picks exactly which files to review, bundles related files into review units, and pins each comment to the right line; the agent does the judgment calls. This tutorial installs it, points it at a model, and runs it on your own code.

What you’ll need

Node.js and Git ≥ 2.41 — the tool ships as an npm package and leans on Git for diffs, search, and repository operations.
An LLM API key for the default mode — or skip the key entirely with delegation mode in Step 6.

Step 1 — install the reviewer

One npm command installs it globally as ocr:

npm install -g @alibaba-group/open-code-review

Confirm it landed:

ocr --version

Step 2 — connect a model

The interactive setup walks you through provider selection, API key entry, and model choice, then tests the connection for you:

ocr config provider
ocr config model

For non-interactive setups — CI machines, scripts — the configuration docs list every environment variable the interactive UI would set.

OpenCodeReview benchmark chart comparing F1, precision, recall, wall-clock time, and tokens per review against general-purpose coding agents — The project's own benchmark: F1, precision, recall, wall-clock time, and tokens per review. Image: alibaba/open-code-review (Apache-2.0).

Step 3 — review your uncommitted changes

Workspace mode reviews everything you haven't committed — staged, unstaged, and untracked files:

cd your-project
ocr review

This is the loop to build into your pre-commit habit: write code, ocr review, fix what it flags, commit.

Step 4 — review a branch diff

For a feature branch, review everything since it diverged from main (merge-base mode):

ocr review --from main --to feature-branch

Reviewing a single commit works the same way:

ocr review --commit abc123

Interrupted a long review? Resume it instead of starting over:

ocr session list
ocr review --from main --to feature-branch --resume <session-id>

Step 5 — scan whole files, no git history needed

Diff review needs Git. Full-file scan doesn't — point it at a directory and it reviews every file it finds:

ocr scan
ocr scan --path internal/agent
ocr scan --resume <session-id>

Useful for legacy code you just inherited and never want to diff against anything.

Step 6 — delegation mode: no API key at all

If you'd rather not configure a model, delegation mode splits the job: OCR handles file selection and rule resolution, and your own coding agent performs the review:

ocr delegate preview
ocr delegate rule src/main.go src/handler.go

Preview first to see which files and rules OCR selected, then hand those to your agent. The README also documents plugins for Claude Code, Codex, Cursor, Kimi Code, and OpenCode, plus a portable agent skill for anything compatible.

OpenCodeReview provider setup screen showing supported LLM providers — Provider setup: pick a provider, enter a key, OCR tests the connection. Image: alibaba/open-code-review (Apache-2.0).

Step 7 — feed the results to your agent

Machine-readable output turns the review from a chat transcript into a step in an automated loop:

ocr review --format json --output result.json

Hand result.json to your coding agent with “fix everything in here” and you've got a review-fix cycle that runs unattended. The docs cover GitHub Actions, GitLab CI, GitFlic CI, and Gerrit if you want the review on every PR, plus a session viewer that replays a review in the browser and lets you mark comments fixed or ignored as you triage.

What you built

A working AI code-review loop on your own repository: ocr review for daily changes, --from/--to for branch diffs, ocr scan for whole files, and delegation mode when you'd rather spend your agent's context than an API key.

Honest limitations

The headline numbers are the project's own. The 1/9 token cost vs. Claude Code, the 25.10% SEM.F1 on AACR-Bench, the 20K+ internal users and 3M+ tasks — all from Alibaba's README, measured on their benchmark and their workload. Treat them as a claim to verify on your codebase, not a guarantee.
Deterministic plumbing doesn't end hallucinations. File selection, bundling, and comment positioning are engineered to be exact; the judgment inside each comment is still a language model. Skim the findings before acting on them.
It's Git-centric. Everything except ocr scan assumes a Git repo with real history; monorepo-scale diffs may need the session resume commands from Step 4.
Default mode costs tokens. Real reviews on real diffs burn real API spend — which is exactly why the 1/9 token claim matters, and why delegation mode exists.
Rules are only as good as the model you pick. A weak model with great file selection still writes weak reviews. Give the model choice in Step 2 some thought.