Open Code Review
An open-source, Alibaba-built code review tool that reads your Git diffs and leaves precise, line-by-line comments — combining hard-coded security checks with an LLM for the judgment calls.
🔗 Visit Open Code Review
Description
Human code review doesn't scale well when a team ships dozens of pull requests a day, and generic AI review bots tend to either miss real vulnerabilities or bury useful feedback in vague generalities. Open Code Review, built and open-sourced by Alibaba, tries to split the difference: it runs deterministic, rule-based checks for well-known vulnerability classes (null pointer exceptions, thread-safety bugs, XSS, SQL injection) and only hands the harder judgment calls to an LLM agent, which then produces precise, line-level comments instead of a wall of generic advice.
It's a CLI tool that works directly against Git diffs — full workspace changes, branch comparisons, single commits, or full-file scans — and is compatible with both OpenAI and Anthropic APIs, so teams aren't locked into one provider. Because the deterministic ruleset handles the mechanical vulnerability checks upfront, the project reports meaningfully lower token usage than review agents that send everything to the LLM (roughly a ninth of the tokens in their own benchmarks). It's Apache 2.0 licensed, has 16,563 GitHub stars, and was pushed as recently as 24 hours before this listing was written — genuinely active, not an abandoned corporate open-source drop.
💬 Our review
The short version: this is a serious, battle-tested-at-Alibaba-scale alternative to CodeRabbit or Codium AI for teams that want automated review without paying a SaaS subscription — you bring your own OpenAI or Anthropic API key instead.
The hybrid deterministic-plus-LLM architecture is the real differentiator versus most AI code review tools, which just throw a diff at an LLM and hope for useful output; here the built-in vulnerability ruleset (NPE, thread-safety, XSS, SQL injection) gives you consistent, non-hallucinated baseline coverage, with the LLM reserved for nuance. The catch is that it's CLI-first, so teams used to a web dashboard or native GitHub PR-comment integration will need to do some wiring themselves, and you're still on the hook for LLM API costs even though the tool itself is free. For a team already comfortable with CLI-based Git tooling and looking to cut both review latency and token spend, it's a strong pick; for a team that wants a zero-setup, point-and-click reviewer bolted onto GitHub PRs, a hosted competitor will get you there faster.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Gratuit et open source sous licence Apache 2.0 ; nécessite ses propres identifiants API OpenAI ou Anthropic (coûts d'usage séparés).
Pros
Architecture hybride : règles déterministes + agent LLM pour les cas ambigus
Commentaires précis ligne par ligne, pas de généralités
Éprouvé à l'échelle d'Alibaba, actif (push il y a moins de 24h)
Cons
Outil CLI d'abord — intégration web/PR GitHub à construire soi-même
Coûts d'API LLM (OpenAI/Anthropic) à la charge de l'utilisateur
Optimisations par langage de programmation peu détaillées publiquement