// the find
alibaba/open-code-review
Secure, fast, efficient, battle-tested at Alibaba's scale. Hybrid architecture code review tool: deterministic pipelines + LLM Agent, precise line-level comments, built-in multi-language ruleset (NPE, thread-safety, XSS, SQL injection), OpenAI & Anthropic compatible.
A Go CLI that runs AI code review against git diffs or whole files, built by Alibaba's internal tooling team and open-sourced after two years of internal use. It splits work between deterministic engineering (file selection, bundling, rule matching) and an LLM agent for the parts that need judgment, and plugs into GitHub Actions, GitLab CI, Gerrit, VSCode, IntelliJ, and several coding-agent plugins.
The precision-over-recall tradeoff is a real architectural choice, not just prompt tuning: file bundling runs each group as an isolated sub-agent so large diffs don't blow context, and template-based rule matching keeps the model focused on relevant rules per file instead of dumping the whole ruleset into every call. Delegation mode is a genuinely useful escape hatch — if you already pay for Claude Code or Cursor, you can let that agent do the review without configuring a separate LLM key for OCR. The integration surface is actually implemented, not just promised in docs: real VSCode/IntelliJ extensions with their own test suites, MCP server, and working CI examples for five different platforms. Two years of production use at Alibaba before release is a different quality bar than most review tools.
Lower recall than general-purpose agents is the explicit design tradeoff, which means teams will miss real bugs that a broader review would catch — a clean OCR run should not be read as 'no issues'. The benchmark is self-reported: the authors built the dataset, ran the comparison, and published the numbers themselves; no independent replication exists yet despite the Hugging Face dataset being public. The built-in ruleset (NPE, thread-safety) reads like it was shaped by Alibaba's Java-heavy backend codebases, so multi-language support may be uneven in practice even though it's advertised broadly. The project now carries a CLI, two IDE extensions, an MCP server, and plugins for four different coding agents simultaneously — a lot of surface area for a freshly open-sourced project to keep in sync, and it's worth watching which pieces get maintained versus quietly stall.