Ask a general-purpose coding agent to review a pull request and you will see the same complaints in every thread: it skips files when the changeset is big, the comments drift off the actual lines, and the results wobble when you reword the prompt. Alibaba's Open Code Review is built against exactly those failure modes, and the timing is good. The repo is at the top of GitHub's daily trending list this morning, having pulled in more than 3,000 stars in a day and passing roughly 35.8k stars, four months after its first public release.
What ocr is
Open Code Review is an Apache-2.0, Go-powered CLI that goes by ocr. It reads your Git diff, sends the changed files to whatever LLM you configure through an agent with tool-use, and comes back with structured comments pinned to specific lines. The agent can read whole files, search the codebase, and look at sibling files in the changeset, which the README frames as deep reviews rather than surface-level diff feedback. A second mode, ocr scan, skips git history entirely and reviews whole files, aimed at unfamiliar codebases or directories that have no meaningful diff.
The tool is not a greenfield project. It started as Alibaba Group's internal official AI code review assistant, which the team says served tens of thousands of developers and caught millions of code defects over two years before it was open sourced in May. The release cadence since then is aggressive. v1.12.5 landed September 17, ten days after v1.11.6 (September 7), with 728 commits on main since v1.0.0. Recent patches added Rego policy review support, an OCaml/ReasonML allowlist, and a Kimi Code plugin.
Installing it is one line:
npm install -g @alibaba-group/open-code-reviewnpm install -g @alibaba-group/open-code-reviewAfter that, ocr is on your PATH. The only system prerequisite is git >= 2.41, which the tool uses for diff generation, code search, and repository operations.
Why a harness, not a prompt
The README's diagnosis of skill-based review is blunt: a "purely language-driven architecture lacks hard constraints on the review process." Skills are easy to bolt on and hard to debug, and their quality swings with prompt variations. So the tool splits the job between deterministic engineering and the model.
Deterministic code owns the steps that must not go wrong:
- Precise file selection decides which files get reviewed and which get filtered out, so nothing important is skipped.
- Smart file bundling groups related files into one review unit, with the README's example being
message_en.propertiesandmessage_zh.propertiesreviewed together. Each bundle runs as a sub-agent with isolated context, which keeps huge changesets tractable and makes concurrent review natural. - Rule matching is done by a template engine that pairs review rules to file characteristics, instead of trusting the model to follow prose instructions.
- Separate positioning and reflection modules fix both the line-level accuracy and the content accuracy of the model's output.
The LLM is left with the parts that actually need judgment: dynamic decisions and context retrieval, using prompt templates and a toolset tuned by mining tool-call traces from large-scale production use. Same model, but the harness does the work a prompt cannot be trusted to do.
The benchmark, with its asterisks
The project ships its own evaluation, AACR-Bench, built from 50 popular open-source repositories, 200 real pull requests, and 10 programming languages, cross-validated by more than 80 senior engineers against 1,505 annotated ground-truth issues. There is also an arXiv paper from January describing the benchmark's "AI-assisted, Expert-verified" annotation pipeline, which the authors say covers 285% more defects than raw pull request comments.
On that benchmark, the README reports that Open Code Review gets significantly higher precision and F1 than a general-purpose agent using the same model, while consuming roughly a ninth of the tokens and finishing faster. Independent write-ups have put numbers on it: with Claude-4.6-Opus as the underlying model, ocr scored 33.90% precision against 7.23% for Claude Code on the same model, a 4.7x gap, using 385K tokens per review rather than 5,664K.
The asterisk is recall. The README says it outright: Open Code Review's recall is lower than general-purpose agents, on purpose. Precision over noise is the right trade for a bot that comments on pull requests, but it means this is a filter for obvious defects, not a guarantee that nothing slipped through.
Delegation mode: let your agent run the review
The default flow has ocr run the review itself with your configured provider, and both OpenAI-compatible and Anthropic-compatible endpoints work. Delegation mode flips the arrangement: your coding agent, meaning Claude Code, Codex, Cursor, Kimi Code, or another supported harness, performs the review with its own LLM while ocr handles file selection and rule resolution.
ocr delegate preview
ocr delegate rule src/main.go src/handler.goocr delegate preview
ocr delegate rule src/main.go src/handler.goNo OCR API key is needed in delegation mode. This is a different product posture from most AI review tools. Instead of competing with your agent, it acts as the deterministic layer underneath it, which is also how it plugs into CI: GitHub Actions, GitLab CI, and Gerrit integrations are documented, along with a session viewer for marking comments fixed or ignored, an MCP server to extend the review agent with external tools, and OpenTelemetry hooks for observability.
What to make of it
The caveats first. AACR-Bench is Alibaba's own benchmark, built and cross-validated by the same team that ships the tool, so treat the headline numbers as the vendor's claims until independent evaluations pile up. The recall trade-off is real, and the star count, while large, belongs to a four-month-old repo that lit up suddenly. The more telling signal is the near-daily release schedule and the 700-odd commits since May.
The argument underneath the tool is worth taking seriously, especially a day after the Cloudflare security-audit skill we covered, which is the same fight from the verification side: agents whose output nobody double-checked. Open Code Review bets that the harness around the model matters more than the model itself, that hard constraints on file selection, bundling, and positioning beat a cleverer prompt bolted onto a general-purpose agent. On its own benchmark, that bet is paying off. Cheap, fast, precise, and honest about what it misses is a good place for automated review to land.