Open-Code-Review: Alibaba’s LLM‑Powered, Rule‑Based Line‑Level Inspection

Architecture Design

Open‑Code‑Review uses a mixed architecture. The outer layer is a deterministic pipeline written in Go that provides exact scheduling and guarantees that known vulnerability patterns such as null‑pointer exceptions (NPE) and SQL injection are always detected. The inner layer wraps a large language model (LLM) as a tool‑calling Agent that can perform deep‑understanding tasks, e.g., evaluating method design or suggesting architectural alternatives.

Core Features

Precise line‑level annotations

The tool annotates specific code lines with concrete issues instead of giving vague PR‑level feedback. Example output for a Python file:

─── src/cve_mcp/api/shodan_client.py:55-60 ───
当前异常处理逻辑在捕获错误后直接 `raise` 向上抛出。作为 MCP 服务的一个情报查询工具，直接抛出未捕获的异常可能导致整个工具调用中断并返回内部错误。参考项目中 `ip_intel.py` 的容错设计，建议捕获异常并返回包含错误信息的字典，以保证服务的鲁棒性并让调用方能优雅处理失败情况。

    except httpx.HTTPStatusError as exc:
        logger.error("Shodan error for %s: HTTP %d", ip, exc.response.status_code)
-        raise
+        return {"error": f"Shodan API error (HTTP {exc.response.status_code})"}
    except Exception as exc:
        logger.error("Shodan error for %s: %s", ip, exc)
-        raise
+        return {"error": f"Shodan lookup failed: {exc}"}

Built‑in fine‑tuned rule library

The repository ships with a rule set validated in Alibaba’s large‑scale production environment. Highlights per file type: *.java – Null‑pointer risk, dead loops, switch fall‑through, N+1 queries, thread safety. *.{ts,js,tsx,jsx} – Code quality, React best practices, async conventions, XSS/security. *.kt – Null safety, coroutine usage, idiomatic patterns. *.{go,py,ets,lua,dart,swift,groovy} – Logical bugs, spelling errors. *.{cpp,cc,hpp} – Smart pointers, RAII, STL usage, const correctness. *.c – malloc/free pairing, buffer overflows. pom.xml / build.gradle – Prevent SNAPSHOT version leakage. package.json – Latest version / wildcard version, dependency conflicts. *mapper*.xml / *dao*.xml – SQL injection, performance issues, logical errors. *.properties – Spelling checks, duplicate keys, security issues.

Four‑level rule priority chain

--rule parameter (highest) – User‑specified rule file.

Project configuration – <repoDir>/.opencodereview/rule.json committed to Git.

Global configuration – ~/.opencodereview/rule.json for personal preferences.

System defaults – system_rules.json built‑in fallback.

Custom rule example:

{
  "rules": [
    {"path": "force-api/**/*.java", "rule": "所有新增方法必须对必填参数进行 null 校验"},
    {"path": "**/*mapper*.xml", "rule": "检查 SQL 是否存在注入风险、参数错误和缺失闭合标签"}
  ]
}

LLM Agent toolchain

The Agent can invoke the following tools to achieve cross‑file, context‑aware review: file_read – Read specified line ranges from a file. code_search – Search text or regex across the repository. code_comment – Post line‑level review comments. file_find – Find files by name keyword. file_read_diff – Read diff content of other changed files.

Three‑stage review process

Phase 1: Plan
  └─ If change > 50 lines, perform risk analysis first
  └─ If < 50 lines, go directly to main review

Phase 2: Main Task
  └─ Each changed file processed in its own goroutine
  └─ LLM engages in multi‑turn dialogue via tool calls
  └─ Loop ends when task_done is invoked

Phase 3: Memory Compression
  └─ Automatic compression when context exceeds limits
  └─ Three zones: frozen, compressed, active

Concurrency handling

Default: 8 concurrent workers process files in parallel.

Per‑file timeout protection (default 10 minutes) prevents a single file from blocking the whole workflow.

Adjustable via --concurrency flag.

Installation

Option 1 – npm (recommended)

npm install -g @alibaba-group/open-code-review

Installs the ocr command globally.

Option 2 – Binary download

Supported on Linux and macOS (Intel & M series). Download the appropriate asset from https://github.com/alibaba/open-code-review/releases.

Option 3 – Build from source

git clone https://github.com/alibaba/open-code-review.git
cd open-code-review
make build
sudo cp dist/opencodereview /usr/local/bin/ocr

LLM Configuration

Configure an LLM before using review features. Example for OpenAI:

ocr config set llm.url https://api.openai.com/v1/chat/completions
ocr config set llm.auth_token sk-xxxxxxx
ocr config set llm.model gpt-4o
ocr config set llm.use_anthropic false
ocr config set language Chinese

The tool also supports Claude (Anthropic Messages API) and normalizes URLs automatically.

Usage

Run the review in a project directory:

# Review all changes (staged, unstaged, untracked)
ocr review

# Review a branch diff
ocr review --from main --to dev

# Review a single commit
ocr review --commit 9daad85265c0e082c460a77f5a723cf12fc23f0a

# Preview mode (no LLM calls)
ocr review --preview

# JSON output for Agent audience
ocr review --commit 9daad85265c0e082c460a77f5a723cf12fc23f0a --format json --audience agent

# Increase concurrency
ocr review --from main --to dev --concurrency 4

Aliases: ocr r for ocr review, ocr v for ocr viewer (Web UI).

OpenTelemetry Integration

Observability via OpenTelemetry (spans, metrics) is supported but disabled by default. Enable it with:

ocr config set telemetry.enabled true
ocr config set telemetry.exporter otlp
ocr config set telemetry.otlp_endpoint localhost:4317
ocr config set telemetry.content_logging true  # export LLM prompts/responses

Comparison with other tools

Deterministic rules : open‑code‑review ✅, GitHub Copilot Review ❌, ReviewDog ✅

LLM Agent tool calls : open‑code‑review ✅, others ❌

Cross‑file context awareness : open‑code‑review ✅, GitHub Copilot Review ⚠️ limited, ReviewDog ❌

Precise line‑level comments : all three ✅

Multi‑model support : open‑code‑review ✅, others ❌

Local CLI : open‑code‑review ✅, GitHub Copilot Review ❌, ReviewDog ✅

CI/CD integration : all three ✅

Open source : open‑code‑review ✅, GitHub Copilot Review ❌, ReviewDog ✅

Summary

Open‑Code‑Review combines deterministic rule enforcement with LLM‑driven contextual analysis, providing precise line‑level feedback, a fine‑tuned multi‑language rule set, and cross‑file awareness. It is suitable for engineering teams that already have a code‑review process, work on multi‑language projects, need CI/CD automation, and want to catch bugs such as NPE, SQL injection, and thread‑safety issues.

Reference resources:

GitHub repository: https://github.com/alibaba/open-code-review
Official documentation: https://alibaba.github.io/open-code-review/