Airsc miễn phí cho tất cả. Nếu nó giúp bạn, hãy ủng hộ $2–$20.

Ủng hộ
PluginCẩn thậnReview & chất lượng codeCần cài đặt chút

open-code-review

alibaba · alibaba/open-code-review

Plugin này cho phép AI agent của bạn thực hiện đánh giá code chính xác, được hỗ trợ bởi AI với bình luận cấp dòng và phát hiện các lỗ hổng bảo mật phổ biến.

Công cụ đánh giá mã code an toàn, nhanh chóng, hiệu quả, đã được thử nghiệm ở quy mô của Alibaba. Công cụ đánh giá mã code kiến trúc lai: pipelines xác định + LLM Agent, nhận xét chính xác ở cấp độ dòng, bộ quy tắc đa ngôn ngữ tích hợp (NPE, an toàn luồng, XSS, SQL injection), tương thích với OpenAI & Anthropic.

47k sao3.5kGiấy phép: Apache-2.0Cập nhật 3 ngày trước0 lượt mở

Xem trước

▍

Bạn có thể làm gì với nó

  • Nhận đánh giá code tự động cho các pull request trước khi merge.
  • Xác định các lỗ hổng bảo mật như XSS và SQL injection trong codebase của bạn.
  • Quét một codebase không quen thuộc để tìm các lỗi tiềm ẩn và vấn đề chất lượng.

Thử hỏi agent của bạn

  • “Thực hiện đánh giá code toàn diện cho các thay đổi mới nhất trong branch hiện tại, tập trung vào các lỗi tiềm ẩn và chất lượng code.”
  • “Quét thư mục `src/auth` để tìm bất kỳ lỗ hổng bảo mật nào, đặc biệt là XSS và SQL injection.”
  • “Đánh giá toàn bộ branch `new_feature` để tìm bất kỳ lỗi tiềm ẩn nào và đề xuất cải tiến.”

Kiểm tra an toàn

Cẩn thận

Dùng được, nhưng nên đọc ghi chú trước.

  • ●Gói npm tự chạy script khi cài đặt.package.json
  • ●Trình cài đặt tải script từ xa và chạy thẳng bằng shell.install.sh
  • ●Yêu cầu quyền quản trị (sudo).install.sh

Quét tự động các file trong repo. Luôn xem lại code trước khi chạy.

Trích từ README

OpenCodeReview

English | 简体中文 | 日本語 | 한국어 | Русский


What is Open Code Review?

Open Code Review is an AI-powered code review CLI tool. It originated as Alibaba Group's internal official AI code review assistant — over the past two years, it has served tens of thousands of developers and identified millions of code defects. After thorough validation at massive scale, we incubated it into an open source project for the community. Simply configure a model endpoint to get started.

It reads Git diffs, sends changed files to a configurable LLM via an agent with tool-use capabilities, and generates structured review comments with line-level precision. The agent can read full file contents, search the codebase, inspect other changed files for context, and produce deep reviews — not just surface-level diff feedback. Beyond diff review, ocr scan reviews entire files for auditing unfamiliar codebases or directories that have no meaningful diff.

Visit the official website for more details.

Benchmark

Compared to general-purpose agents (Claude Code), Open Code Review achieves significantly higher Precision and F1 with the same underlying model, while consuming only ~1/9 of the tokens and completing reviews faster. Note that its Recall is lower than general-purpose agents — a deliberate trade-off favoring precision over noise.

A real-world code review benchmark built from 50 popular open-source repositories, 200 real Pull Requests, and 10 programming languages — cross-validated by 80+ senior engineers (1,505 annotated ground-truth issues).

Explore the AACR-Bench dataset on Hugging Face.

MetricWhat it measuresWhy it matters
F1Harmonic mean of precision and recallBest single number for overall review quality
PrecisionProportion of reported issues that are real defectsHigher = fewer false alarms to triage
RecallProportion of real defects that are foundHigher = fewer issues slip through review
Avg TimeWall-clock time per reviewMatters for CI pipeline latency
Avg TokenTotal tokens consumed per reviewDirectly impacts API cost

Why Open Code Review?

The Problem with General-Purpose Agents

If you've used general-purpose agents like Claude Code with Skills for code review, you've likely encountered these pain points:

  • Incomplete coverage — On larger changesets, agents tend to "cut corners," selectively reviewing only some files and missing others.
  • Position drift — Reported issues frequently don't match the actual code location, with line numbers or file references drifting off target.
  • Unstable quality — Natural-language-driven Skills are hard to debug, and review quality fluctuates significantly with minor prompt variations.

The root cause: a purely language-driven architecture lacks hard constraints on the review process.

Core Design: Deterministic Engineering × Agent Hybrid

Open Code Review's core philosophy is to combine deterministic engineering with an agent, each handling what it does best.

Deterministic Engineering — Hard Constraints

For review steps that must not go wrong, engineering logic — not the language model — guarantees correctness:

  • Precise file selection — Determines exactly which files need review and which should be filtered, ensuring no important change is missed.
  • Smart file bundling — Groups related files into a single review unit (e.g., message_en.properties and message_zh.properties are bundled together). Each bundle runs as a sub-agent with isolated context — a divide-and-conquer strategy that stays stable on very large changesets and naturally supports concurrent review.
  • Fine-grained rule matching — Matches review rules to each file's characteristics, keeping the model's attention sharply focused and eliminating information noise at the source. Compared to purely language-driven rule guidance, template-engine-based rule matching is more stable and predictable.
  • External positioning and reflection modules — Independent comment-positioning and comment-reflection modules systematically improve both the location accuracy and content accuracy of AI feedback.

Agent — Dynamic Decision-Making

The agent's strengths are concentrated where they matter most — dynamic decisions and dynamic context retrieval:

  • Scenario-tuned prompts — Prompt templates deeply optimized for code review, improving effectiveness while reducing token consumption.
  • Scenario-tuned toolset — Distilled from deep analysis of tool-call traces in large-scale production data — including call frequency distributions, per-tool repetition rates, and the impact of new tools on the overall call chain — resulting in a purpose-built toolset that is more stable and predictable for code review than a generic agent toolkit.

How to Use

Prerequisites

  • Git >= 2.41 — Open Code Review relies on Git for diff generation, code search, and repository operations.

CLI

Install

npm install -g @alibaba-group/open-code-review

After installation, the ocr command is available globally.

For other installation methods (install script, GitHub Release binary, from source), see Installation.

Quick Start

1. Configure LLM

You must configure an LLM before reviewing code, unless you use Delegation Mode.

ocr config provider          # Select a built-in provider or add a custom one
ocr config model             # Pick a model for the active provider

The interactive UI guides you through provider selection, API key entry, and model configuration, then automatically tests connectivity.

For CLI setup, environment variables, custom providers, and ot

Xem mã nguồn trên GitHub