Alibaba Open Code Review

1. What is Open Code Review?

Open Code Review (the command is ocr) is an AI code reviewer. After you change some code you run one command; it reads what changed, sends it to an AI model and returns a list of comments pinned to exact lines: likely bugs, security risks and similar problems. It began as Alibaba's internal review assistant and was later released as open source under the Apache-2.0 license.

To be direct: this is a command-line tool for programmers. It has no graphical window, and it is only useful if you have code stored in Git (a version-control tool). The software is free. Any cost comes from the AI model you connect it to. One exception: "Delegation Mode" lets it reuse the subscription of a coding assistant you already pay for (Claude Code, Codex, Cursor and others), so no separate API key is needed.

A good fit if:

• You write code and want a second pair of eyes before sharing it with your team.
• You use Claude Code, Codex, Cursor or Kimi Code and want a stricter review step.
• You need automatic reviews in a CI/CD pipeline (the system that checks code when it is pushed).

Not a good fit if:

• You do not program. It will not build an app for you and does nothing without code.
• Your project does not use Git. The docs state that other systems such as SVN and Mercurial are not supported.
• You expect it to catch everything. The project says openly that it favours fewer false alarms over finding every issue.

2. What you need first

Operating system: Windows, macOS and Linux all work, on both Intel/AMD and ARM processors.

Software to install beforehand:

• Git 2.41 or newer: version control; Open Code Review relies on it to see what you changed. Download from https://git-scm.com.
• Node.js 18 or newer: a JavaScript runtime that includes the npm command used for installation. Download from https://nodejs.org. If you would rather not install Node.js, use the script method in Step 2B.

An API key for an AI model: a secret string that lets the tool call a model. Open Code Review ships with presets for many providers, including Anthropic, OpenAI, OpenRouter, Gemini, DeepSeek and DashScope, so you only paste the key. API keys are usually billed by usage at the provider's rates. You do not need one if:

• you use Delegation Mode inside a coding assistant that already has a subscription, or
• you run a model on your own machine through Ollama (see section 7).

3. Step-by-step installation

Step 1: Check Git and Node.js

git --version
node --version

What success looks like: Git reports 2.41 or higher and Node.js reports v18 or higher. If either command is not found, install it from the links in section 2 and open a new terminal window.

Step 2A: Install with npm (recommended)

The command is the same on Windows, macOS and Linux:

npm install -g @alibaba-group/open-code-review

What success looks like: npm finishes without red error lines. The ocr command is now available from any folder.

Step 2B: Install without Node.js (optional)

If you prefer not to install Node.js, use the official install script. It downloads the binary from the Releases page and verifies its checksum.

Windows (PowerShell 5.1 or newer):

irm https://open-codereview.ai/install.ps1 | iex

On Windows the program is placed in %LOCALAPPDATA%\Programs\ocr.

macOS and Linux:

curl -fsSL https://open-codereview.ai/install.sh | sh

On macOS and Linux the default location is /usr/local/bin. If you use Homebrew you can run this instead:

brew install open-code-review

Step 3: Confirm the install

ocr version

What success looks like: a version number, commit and build date. The latest release when this guide was written is v1.12.11, published on 29 September 2026.

Step 4: Connect an AI model

Skip this step if you use Delegation Mode.

ocr config provider

An arrow-key menu appears: pick a provider, paste your API key, pick a model. The tool saves the settings and tests the connection once. To change models later:

ocr config model

Step 5: Test the connection

ocr llm test

What success looks like: a line saying the connection test succeeded. A 401 or 403 means the key is wrong or expired.

4. First use

Step 1: Go to a project folder that uses Git

cd path/to/your-project

Replace the path with your real folder. It must be a Git repository, ideally with a few uncommitted changes.

Step 2: Preview what would be reviewed (costs nothing)

ocr review --preview

This does not call the AI model. It lists the files that would be reviewed and gives a reason for each file that is skipped.

Step 3: Run a real review

ocr review

By default it reviews every change in your working folder: staged changes, unstaged changes and new files. The result is a list of comments, each tied to a file and line.

Two other common forms:

ocr review --from main --to feature-branch
ocr review --commit abc123

The first compares a branch against main. The second reviews a single commit (replace abc123 with a real commit id). There is also ocr scan, which reviews whole files rather than just the changes, for auditing code you do not know.

Step 4: Read the results in a browser

ocr viewer

A local web page opens at localhost:5483 listing past reviews. On each comment you can click Fixed or Ignored to mark it as handled. Press Ctrl+C in the terminal to stop it.

Optional: change the comment language

The language setting decides which language the comments are written in. The example from the docs:

ocr config set language English

5. Common errors and fixes

Symptom	Cause	Fix
ocr gives "command not found" or "not recognized"	The install folder is not on your PATH (the list of places the system looks for commands)	Close and reopen the terminal. If it persists, check that the install folder is on PATH
no valid LLM endpoint configured	The address, key and model name are not all set	Run ocr config provider, then ocr llm test
ocr llm test returns 401 or 403	The API key is wrong, expired, or belongs to a different provider	Create a new key and run ocr config provider again
not a git repository	You are in a folder that is not a Git repository	cd into the project folder, or pass --repo with its path
Repeated "No tool calls parsed" then "Max tool requests reached", with no comments	The model (usually a local one) does not support tool calling	Switch to a model that does. The docs name deepseek-r1 as one that fails and qwen3 as one that works
A file is not reviewed	The filter dropped it: binary file, inside node_modules or vendor, or too large	Run ocr review --preview to read the reason for each file
Warning "prompt tokens exceed 80% of max_tokens"	The changes in one group of files are too large	Split the work into smaller commits, or exclude generated files

More cases are covered in the official FAQ: https://open-codereview.ai/docs/faq

6. Uninstalling and updating

Updating

With the npm install, ocr checks for a newer version each time it runs and upgrades itself in the background, so there is nothing to do. To switch that off, set the OCR_NO_UPDATE environment variable to any value, for example on macOS/Linux:

export OCR_NO_UPDATE=1

With the script install, run the Step 2B command again to get the latest release. With Homebrew:

brew upgrade open-code-review

Uninstalling

npm install:

npm uninstall -g @alibaba-group/open-code-review

Script install on macOS/Linux:

sudo rm /usr/local/bin/ocr

Script install on Windows: delete the folder %LOCALAPPDATA%\Programs\ocr.

Finally, to remove your settings, stored API key and review history, delete the .opencodereview folder in your user folder. On macOS/Linux:

rm -rf ~/.opencodereview

According to the docs the tool writes nothing outside that folder, so deleting it leaves a clean system.

7. Frequently asked questions

Does it cost money?

The tool is free and open source. What costs money is calling an AI model with your API key. To spend less, add --effort low when you run a review: it does one review round instead of the default two.

Is my code sent anywhere?

Yes, but only to the place you configured. According to the docs, the tool sends your code changes (and snippets of files it needs to read) to the AI model you set up. Review history and rule files stay on your machine.

Can it run entirely on my machine?

Yes, by pointing it at a local model served by Ollama as a custom provider. The model must support tool calling. Setup is described at https://open-codereview.ai/docs/configuration.

I already pay for Claude Code or Cursor. Do I need a separate API key?

Not necessarily. In Delegation Mode your coding assistant does the reasoning with its own model, while ocr only handles file selection and rules. Guide: https://open-codereview.ai/docs/delegate.

Does it find every bug?

No. The project states that it deliberately favours precision (fewer false alarms) and accepts missing more issues than a general-purpose agent would. Treat it as an extra reviewer, not a replacement for your own checks.