Deterministic file coverage sits around an LLM reviewer
OpenCodeReview reads Git state, decides which files belong in the review, groups related files, matches rules, and then gives an agent tools to retrieve context. Separate logic positions comments and reflects on their content. The model still decides whether code looks wrong, but ordinary software controls which changes it sees and where feedback lands. That split is the project's most interesting idea.
The CLI covers staged, unstaged, and untracked work, branch ranges based on a merge base, individual commits, and full-file scans. Sessions can resume after interruption, and JSON output lets another agent or CI job consume findings without scraping terminal text. This is more purposeful than asking a general coding assistant to review everything and hoping its context budget reaches every file.
What happened when we ran it
Our sandbox cloned commit 0c44f10 with 3 CPUs and 8 GB of RAM. The 10.7 MB repository contained 749 files and about 115,817 lines of source. npm started the project's install script, but installation failed with exit code 1 after 12 seconds. We did not reach a build or test command.
The installer detected Linux on amd64 and read version 0.0.0 from package.json. It constructed a GitHub URL for release v0.0.0 and asset opencodereview-linux-amd64; GitHub returned HTTP 404. That sequence is explicit in the log. It does not show a network outage, missing compiler, or incompatible dependency, so none of those explanations belongs in the finding.
Our scan found 8 CI workflow files, no Dockerfile, and no top-level tests directory. The current GitHub release is v1.10.1 and contains platform binaries, but that does not rewrite the measured commit's failed source install. A prospective user should test the published npm package or download a checksummed release asset rather than assume npm install in a checkout follows the same path.
Normal mode sends repository context to a model endpoint
OpenCodeReview needs a configured LLM unless delegation mode hands model work to an existing coding agent. The interactive configuration selects a provider and model, records an API key, and tests connectivity. During review, the agent can read full files, search the codebase, and inspect related changes. That context improves findings and may also include proprietary source, secrets committed by mistake, or regulated material.
Provider approval should cover more than the diff shown in a pull request. Check the endpoint, retention terms, regional processing, model logging, and which repository paths the agent may read. A custom compatible endpoint can keep traffic inside an approved environment. Delegation avoids a separate OCR provider key, but the host agent's model and permissions still decide where code goes.
MCP can extend the reviewer with external tools. This warrants its own allowlist because a code review rarely needs every service available to a developer's general agent. Restrict tools to read-only operations where possible, keep production credentials out of the review process, and preserve the final JSON so a human can see what evidence supported each comment.
Lower recall makes human review part of the design
Alibaba publishes AACR-Bench, built from real pull requests across several languages and annotated issues. The README says OpenCodeReview improves precision and F1 over a general-purpose Claude Code setup with the same underlying model, while using fewer tokens and finishing faster. It also states that recall is lower, described as a deliberate preference for fewer noisy findings.
We did not reproduce that benchmark, so its performance claims should be read as project-reported results, not MrKeyoor measurements. The disclosed recall tradeoff is still useful. Higher precision can make developers pay attention because fewer comments waste their time. Lower recall means a quiet report cannot certify that the change is safe. Human review, tests, type checks, security scanners, and linters keep their jobs.
Custom rules can focus model attention on null handling, concurrency, injection risks, project conventions, or path-specific concerns. They can also fossilize outdated assumptions. Treat rules like code: assign owners, test them against examples, review changes, and remove guidance that the language or framework already enforces more reliably.
Integrations make it portable across agents and CI
The project supplies a Claude Code plugin, Codex and Cursor skills, OpenCode tools, a portable agent skill, and delegation commands. In delegated mode, OpenCodeReview resolves files and rules while the host agent performs the reasoning. That lets a team retain deterministic selection without buying another model route, though results will follow the host model and its context behavior.
CI guides cover GitHub Actions, GitLab CI, GitFlic CI, and Gerrit. Automated posting needs careful permissions: read repository contents, publish only to the intended change, and avoid allowing untrusted pull-request code to capture tokens. Start by saving JSON as an artifact or advisory check. Make comments blocking only after the false-positive and missed-defect rates are known on your repositories.
Version 1.10.1 is active despite the broken source path
GitHub recorded 21,462 stars, 148 combined open issues and pull requests, and a last push on August 26, 2026. The public repository was created May 18, 2026, while the README says the tool grew from two years of internal Alibaba use. Public governance and compatibility history are therefore young even if the underlying review approach predates the repository.
Release v1.10.1 shipped August 26 with Objective-C rules, MATLAB allowlisting, model-session fixes, delegation compatibility work, timeout forwarding, GPT-5.6 support through the Responses API, signal exit behavior, and a separate contract workflow. That same-day release and issue activity show active maintenance. They also show how quickly models, agents, platforms, and rule catalogs can change under a review pipeline.
OpenCodeReview deserves a controlled evaluation for teams frustrated by generic agents skipping files or drifting comment positions. Use a real v1.10.1 distribution, point it at an approved model, and score it against already-reviewed changes before CI enforcement. Our 12-second install failure blocks a recommendation for source checkout setup, while the deterministic shell around the model remains worth testing.