Alibaba continues to actively share its internal developments, making them accessible to the general public. Recently, Open Code Review (OCR) was introduced – an AI-based tool for code inspection that has been used internally at Alibaba for two years to analyze the code of tens of thousands of developers and has identified millions of defects. This tool is now available for use under two licenses.

Architecture and Benefits of Open Code Review

Unlike general-purpose AI agents that perform code reviews, Open Code Review has a hybrid architecture designed to address three main problems: skipping files in large change sets, discrepancies in line numbers with actual issues, and inconsistent quality of results depending on the prompt's wording.

OCR uses a deterministic engineering approach to select files, group them, match rules, and determine comment positions. The AI agent is solely responsible for the logical part of the analysis.

According to the developers, in their own benchmark, which includes 200 pull requests from 50 repositories, OCR outperforms Claude Code in accuracy and F1 score, using the same underlying model but consuming approximately nine times fewer tokens. A decrease in recall is a trade-off.

Installation and Configuration

To install OCR on Ubuntu, you need to have Node.js pre-installed. The tool is installed via npm.

npm install -g open-code-review

After installation, you need to configure the model provider. For example, to use the Alibaba DashScope API:

ocr config provider dashscope --model qwen:23.8b

Next, you will need to enter the API key. In case of issues with the Alibaba DashScope key, as noted by the author, you can use alternative providers, such as DeepSeek.

Tool Demonstration

A small FastAPI application for validating iron ore shipping prices was used for the demonstration. An SQL bug was intentionally introduced into the code.

Initially, the tool operates in preview mode, identifying changed files and confirming their inclusion in the review scope. This stage does not require calling an LLM.

Then, a full review cycle is initiated. The tool processes files sequentially, taking approximately 25 seconds and utilizing around 53,000 tokens.

During its operation, the OCR performs a series of tool calls, such as code search, file reading, and commit analysis. This allows the agent not only to analyze changes in isolation but also to understand the context of the surrounding code, including reading documentation and analyzing adjacent code sections. The tool can perform up to two passes, stopping if the second pass does not reveal new issues.

As a result of the review, the OCR not only discovered the intentional bug but also identified two additional defects: incorrect usage of the column name data_text and the replacement of LEFT JOIN with INNER JOIN. The tool provided an accurate fix in diff format.

Integration with Open Code

Open Code Review can be integrated with various platforms, including Open Code, CodeX, and Cloud Code. Integration with Open Code requires the installation of the corresponding plugin.

After installing the plugin and dependencies, Open Code is launched. You can check the integration's functionality with the command {slash}ocr health, which will confirm a successful connection to the model (e.g., DeepSeek).

If a workspace or Git repository is present, Open Code can initiate a review of the current workspace or a specified repository, providing results similar to those shown previously.

It is noted that Chinese characters may appear in the interface, which is explained by the internal origin of the tool.