Alibaba’s Open Code Review: installation and your first review
MarkdownSet up a model for Open Code Review, check Git changes, and review the findings. Delegation mode uses your agent’s model.
Read full article
Ailoot documentation: API, keys and integration.
What does Alibaba’s Open Code Review do?
Key takeaway
Open Code Review, or OCR, is a command-line tool for reviewing code. It reads Git changes, sends files to the configured language model and returns comments tied to specific lines. It is an additional review, not proof that the code has no errors.
The project is published in Alibaba's official repository under the Apache-2.0 licence. In the README, the developers describe combining programmatic file selection and rules with an agent that analyses the code. There is also ocr scan for entire files when there is no meaningful diff—a set of Git changes.
Start with your first review and assess the comments on your own code. Token savings on your project have not been measured here. Why it is useful to check an agent's results separately is explained in the article on false claims of “done”.
Prepare the repository and install OCR
You will need Git 2.41 or later and npm for this installation method. Start with a test repository that contains no secrets. The agent can read entire files and search the codebase, and working-directory mode also includes untracked files. Check the entire repository, including new files: it must not contain keys or data that cannot be sent to your chosen model.
git --version
npm install -g @alibaba-group/open-code-review
After installation, the ocr command is available. Check the installation options and the package itself against the official README, rather than a random package with a similar name.
Configure the model and run a review
In the terminal, run:
ocr config provider
ocr config model
The interactive interface asks you to choose a provider, enter an API key and configure the model, then checks the connection. Enter the key in the designated interface, not in project files or commit messages. Before running a review, find out how your chosen provider charges: OCR's free licence does not mean free model calls.
Go to your project directory and run a review. Replace your-project with the path to your project:
cd your-project
ocr review
In this mode, ocr review checks staged, unstaged and new untracked changes. To save the comments as JSON, you can use:
ocr review --format json --output result.json
Do not automatically add the report to a commit: first check that it contains no sensitive code or data. There is a separate command for reviewing entire files in a directory, regardless of changes:
ocr scan --path internal/agent
internal/agent is an example from the README; replace it with an existing path in your project. Start with a small directory to assess how useful the comments are and the actual cost before scanning everything.
How to tell whether a review is useful
Open each comment, find the line and check whether the problem can be reproduced. Confirm the fix with a test, and record false positives separately. Having no comments does not replace functional tests and access-control checks.
In their comparison, the developers note in the README that OCR detects a smaller proportion of issues than general-purpose agents. This is the developers' claim under the conditions of their study, not a measurement of your project's quality. No independent measurement of OCR's accuracy was carried out here.
How delegation differs
Normal mode uses the model configured in OCR. In delegation mode, OCR selects files and determines rules, while your AI agent reviews the code using its own model. Separate model configuration and an API key for OCR are not required in this mode.
Preparation commands from the README:
ocr delegate preview
ocr delegate rule src/main.go src/handler.go
Replace the paths with your own. After these commands, hand the analysis over to the connected agent: preparing files is not yet a code review. Its payment terms and limits still apply, so “no separate key required” does not mean “free review”.
The repository describes integrations with Claude Code, Codex and other agents. If you use Codex, first familiarise yourself with how Codex skills work; for another supported tool, there is an introduction to Kimi Code. Connect the integration after you understand the normal report, not instead of reading it.
If the run produces no result
Check that the required Git version is installed, that you are in the correct project directory and that the connection to the model works. If there are no changes to review, do not call an empty result a review of the entire codebase: scan is used for entire files. Do not add automatic commit blocking based on a single unfamiliar report.
The commands were checked against the official README at the pinned repository revision. No paid run on a user's project was performed. The criterion for a successful first attempt is clear comments that you were able to confirm or reject with justification.
Sources
If you need access to AI models through Ailoot, take a look at Ailoot.
More details
Questions about Alibaba’s Open Code Review: installation and your first review
Does an OCR report with no comments prove the code is correct?
No. Check that the intended Git changes were actually reviewed and keep functional and access-control tests. For each reported issue, inspect the referenced line and reproduce it; track false positives separately.
Does delegation mode make the review free?
No. It avoids separate OCR model configuration by handing the analysis to your connected agent, whose own payment terms and limits still apply. The preview and rule commands prepare the handoff; they are not a completed review.