Alibaba Open Sourced the Code Review Tool It Ran Internally for Two Years

Open Code Review is Alibaba's internal AI review assistant, now Apache-2.0 and free, doing the job teams currently rent from CodeRabbit and Greptile at 24 to 30 dollars per developer per month.

Every engineering team that ships more than a handful of pull requests a week has quietly acquired a new line item: AI code review. CodeRabbit lists its Pro plan at 24 dollars per user per month billed annually, and 48 for Pro Plus. Greptile lists 30 dollars per seat per month, with 50 reviews included and a dollar per review after that. On a 25-developer team, that is roughly 7,000 to 9,000 dollars a year for a machine to read diffs and leave comments. Alibaba just published the tool it has been using internally for exactly that job, for two years, under Apache-2.0. Open Code Review sits at about 14,600 stars and gained close to a thousand of them today.

What it actually does

This is not a weekend project that happened to trend. The README describes it as Alibaba Group's internal official AI code review assistant, serving tens of thousands of developers over two years and finding what the project claims are millions of defects before it was spun out to the community.

Mechanically, it is a command-line tool called ocr. It reads your Git diffs, hands changed files to a model through an agent that can search the codebase and pull in surrounding context, and returns line-level comments. A second mode, ocr scan, reviews whole files rather than diffs, which is the useful one when you inherit a repository nobody wants to explain to you. It plugs into GitHub Actions, GitLab CI, and Gerrit, and ships a built-in rule pack aimed at the failure classes that actually cause incidents: null pointer exceptions, thread safety, XSS, SQL injection.

You bring your own model. It speaks both OpenAI-compatible and Anthropic-compatible endpoints. There is also a delegation mode where the tool does the file selection and rule matching but hands the actual reviewing to a coding agent you already pay for, whether that is Claude Code, Codex, or Cursor. No separate API key, no second bill.

The part that matters beyond code review

Here is the interesting bit, and it has very little to do with engineering.

Alibaba is explicit about why they did not just write a good prompt and point a general-purpose agent at the diff. They tried that. The README names three failures: on large changesets the agent cuts corners and silently reviews only some of the files, reported issues drift off their actual line numbers, and quality swings noticeably when someone tweaks the prompt. Their diagnosis is that a purely language-driven process has no hard constraints in it.

So they took the process apart. Deterministic code, not the model, decides which files get reviewed and which get filtered. Deterministic code bundles related files into review units and runs each as a sub-agent with its own isolated context, which is what keeps the thing stable when the changeset is enormous. Deterministic code matches rules to files, and separate positioning and reflection modules check where a comment landed and whether it holds up. The model is left to do the two things it is genuinely better at: deciding what to look at next, and judging the code in front of it.

The results they publish are worth the attention of anyone deploying AI on bulk review work of any kind. Against a benchmark of 200 real pull requests across 50 repositories and 10 languages, with 1,505 ground-truth issues annotated by more than 80 senior engineers, they report higher precision and F1 than a general-purpose agent running the same underlying model, while burning roughly one ninth of the tokens.

Swap "code" for "vendor contracts" or "insurance claims" or "support tickets" and the lesson survives intact. If you have handed an agent a folder of 400 documents and gotten back a confident summary of the nine it felt like reading, this is the same problem, and the fix is not a better prompt.

Who should pick this up

Realistically, whoever owns your CI pipeline. This is a CLI and a set of YAML-configured rules, not a GitHub app you authorize in a browser. That is the honest dividing line between this and the paid products: CodeRabbit and Greptile sell you the wiring, and here the wiring is your afternoon.

Worth it for a team of 20 or more developers already paying per-seat, for anyone whose compliance posture makes "our diffs go to a third-party SaaS" a difficult sentence, and for platform teams who want the review rules to be a file in a repository that they can argue about in a pull request rather than settings in someone else's dashboard.

The honest caveats

Free tool, not free operation. You pay for the tokens, and one ninth of a general agent's consumption is still consumption. Delegation mode does not make that disappear either, it just moves the cost onto a subscription you are already burning.

Recall is lower than a general-purpose agent, and the project says so out loud rather than hiding it in a footnote. It is a deliberate trade: fewer false alarms in exchange for letting more real defects through. If your problem is that things slip past review, you are buying the wrong end of that trade.

The rule pack is the actual product, and it was written for Alibaba's codebase. It shipped in Chinese at first, which the Hacker News thread spent a good chunk of its 73 comments working around before the maintainers merged an English version, and today all 27 language rule files read cleanly in English. That is fixed. What is not fixed is that those rules encode one company's sense of what deserves a comment. The Java rules care a great deal about null pointer exceptions and database queries inside loops. Read them before you point this at a stack that looks nothing like Alibaba's, because that file is where your review standards now live.

The repository was created in May of this year and is already on v1.7.17, tagged yesterday, with feature commits landing today. That velocity says good things about the maintainers and bad things about pinning a version and walking away.

Two years in production did not produce a cleverer prompt. It produced an architecture where the model is the smallest replaceable part, and the measurable win was one ninth the tokens at higher precision using the same intelligence as everyone else. The gains were never in the model. They were in everything built around it.