# Alibaba’s Open Code Review: installation and your first review
> Set up a model for Open Code Review, check Git changes, and review the findings. Delegation mode uses your agent’s model.
Source: https://ailoot.ai/blog/en/alibaba-open-code-review/
Canonical: https://ailoot.ai/blog/en/alibaba-open-code-review/
Language: en
Publisher: Ailoot (https://ailoot.ai/)
Translation: guide-187
Revision: sha256-83e1947f4517aec54bab4547cc937feca369b7228f740390e5b4828000a35c53
[Ailoot documentation: API, keys and integration](https://ailoot.ai/docs/).
## What does Alibaba’s Open Code Review do?
Key takeaway
Open Code Review, or OCR, is a command-line tool for reviewing code. It reads Git changes, sends files to the configured language model and returns comments tied to specific lines. It is an additional review, not proof that the code has no errors.
The project is published in Alibaba's official repository under the Apache-2.0 licence. In the README, the developers describe combining programmatic file selection and rules with an agent that analyses the code. There is also `ocr scan` for entire files when there is no meaningful diff—a set of Git changes.
Start with your first review and assess the comments on your own code. Token savings on your project have not been measured here. Why it is useful to check an agent's results separately is explained in [the article on false claims of “done”](https://ailoot.ai/blog/en/ai-agent-says-done/).
## Prepare the repository and install OCR
You will need Git 2.41 or later and npm for this installation method. Start with a test repository that contains no secrets. The agent can read entire files and search the codebase, and working-directory mode also includes untracked files. Check the entire repository, including new files: it must not contain keys or data that cannot be sent to your chosen model.
```bash
git --version
npm install -g @alibaba-group/open-code-review
```
After installation, the `ocr` command is available. Check the installation options and the package itself against the official README, rather than a random package with a similar name.
## Configure the model and run a review
In the terminal, run:
```bash
ocr config provider
ocr config model
```
The interactive interface asks you to choose a provider, enter an API key and configure the model, then checks the connection. Enter the key in the designated interface, not in project files or commit messages. Before running a review, find out how your chosen provider charges: OCR's free licence does not mean free model calls.
Go to your project directory and run a review. Replace `your-project` with the path to your project:
```bash
cd your-project
ocr review
```
In this mode, `ocr review` checks staged, unstaged and new untracked changes. To save the comments as JSON, you can use:
```bash
ocr review --format json --output result.json
```
Do not automatically add the report to a commit: first check that it contains no sensitive code or data. There is a separate command for reviewing entire files in a directory, regardless of changes:
```bash
ocr scan --path internal/agent
```
`internal/agent` is an example from the README; replace it with an existing path in your project. Start with a small directory to assess how useful the comments are and the actual cost before scanning everything.
## How to tell whether a review is useful
Open each comment, find the line and check whether the problem can be reproduced. Confirm the fix with a test, and record false positives separately. Having no comments does not replace functional tests and access-control checks.
In their comparison, the developers note in the README that OCR detects a smaller proportion of issues than general-purpose agents. This is the developers' claim under the conditions of their study, not a measurement of your project's quality. No independent measurement of OCR's accuracy was carried out here.
## How delegation differs
Normal mode uses the model configured in OCR. In delegation mode, OCR selects files and determines rules, while your AI agent reviews the code using its own model. Separate model configuration and an API key for OCR are not required in this mode.
Preparation commands from the README:
```bash
ocr delegate preview
ocr delegate rule src/main.go src/handler.go
```
Replace the paths with your own. After these commands, hand the analysis over to the connected agent: preparing files is not yet a code review. Its payment terms and limits still apply, so “no separate key required” does not mean “free review”.
The repository describes integrations with Claude Code, Codex and other agents. If you use Codex, first familiarise yourself with [how Codex skills work](https://ailoot.ai/blog/en/codex-skills/); for another supported tool, there is [an introduction to Kimi Code](https://ailoot.ai/blog/en/kimi-code-install/). Connect the integration after you understand the normal report, not instead of reading it.
## If the run produces no result
Check that the required Git version is installed, that you are in the correct project directory and that the connection to the model works. If there are no changes to review, do not call an empty result a review of the entire codebase: scan is used for entire files. Do not add automatic commit blocking based on a single unfamiliar report.
The commands were checked against the official README at the pinned repository revision. No paid run on a user's project was performed. The criterion for a successful first attempt is clear comments that you were able to confirm or reject with justification.
### Sources
- [Official documentation](https://raw.githubusercontent.com/alibaba/open-code-review/486022daaf14f7142275eddb9b3cacc3cc5dadfa/README.md)
If you need access to AI models through Ailoot, take a look at [Ailoot](https://ailoot.ai/).
## Questions about Alibaba’s Open Code Review: installation and your first review
### Does an OCR report with no comments prove the code is correct?
No. Check that the intended Git changes were actually reviewed and keep functional and access-control tests. For each reported issue, inspect the referenced line and reproduce it; track false positives separately.
### Does delegation mode make the review free?
No. It avoids separate OCR model configuration by handing the analysis to your connected agent, whose own payment terms and limits still apply. The preview and rule commands prepare the handoff; they are not a completed review.
## Ailoot · The company and its project portfolio
Ailoot combines established operating experience, a large client base, stable service and ongoing KPI control.
The company and its project portfolio: millions of customers; monthly sales in the billions.
Ailoot brings that operating experience to API access for AI features in customer products, agents, applications and automations.