5 ms·

Open Code Review – An AI-powered code review CLI tool

284 points by geoffbp 4mo ago

hanspagel 4mo ago
Did it review the landing page for it? Because it looks broken on iOS.
singiamtel 4mo ago
Not to be confused with Opencode the harness
singingtoday 4mo ago
I'm interested in trying this. We have our own internal automated review which has shown positive results, but I would love to drop it if I find something better. Code review is currently our bottleneck, so any possibility of better automating it is welcome.
- Supermancho 4mo ago
  [flagged]
- sergeym 4mo ago
  I've been liking this code review skill lately, it has pointed out some good improvements. https://github.com/cursor/plugins/blob/main/cursor-team-kit/skills/thermo-nuclear-code-quality-review/SKILL.md https://github.com/cursor/plugins/blob/main/cursor-team-kit/...
- pramodbiligiri 4mo ago
  Thermonuclear suggested by someone below is good. Matt Poccock did a demo/breakdown of that: https://www.youtube.com/watch?v=mh5XZ-L5SFQ https://www.youtube.com/watch?v=mh5XZ-L5SFQ. He has his own "improve-codebase-architecture" skill: https://github.com/mattpocock/skills/blob/main/skills/engineering/improve-codebase-architecture/SKILL.md https://github.com/mattpocock/skills/blob/main/skills/engine... Some of them are about general coding guidelines and code quality, not necessarily vetting your current PR against specs! There's AbsolutelySkilled with clean-code and clean-architecture. Linking to older version of repo because they seem to be no longer on trunk: https://github.com/AbsolutelySkilled/AbsolutelySkilled/tree/8f704b39e2c652ab199d3c4d6b6cb709426f692c/skills https://github.com/AbsolutelySkilled/AbsolutelySkilled/tree/... I've been creating some rules to help with my Java coding: https://github.com/bitkentech/shipsmooth/tree/main/skills/experimental/refine/rules https://github.com/bitkentech/shipsmooth/tree/main/skills/ex.... These are assembled into a SKILL file when this skill file template is built: https://github.com/bitkentech/shipsmooth/blob/main/skills/experimental/refine/SKILL.jte.md https://github.com/bitkentech/shipsmooth/blob/main/skills/ex...
atestu 4mo ago
We've been using Coderabbit, great deal ($30/mo/dev flat) and finds a lot. I also built a skill I call `/meta-review` that asks Codex, Cursor, and Gemini to review the code (I use Claude Code). It always finds little things claude & I missed. Coderabbit just came out with their own PR review UI that's great for big PRs, it groups files together etc. https://www.coderabbit.ai/blog/introducing-atlas-the-first-ai-native-code-review-interface https://www.coderabbit.ai/blog/introducing-atlas-the-first-a...
- causal 4mo ago
  Is it actually flat fee? I loved Cursor bugbot which was flat fee but they moved to per-run and that killed it for me, but a lot of others are doing the same.
  - atestu 4mo ago
    Yes! They just have a rate limit but we never run into it (we’re just 3 people though). Yea I liked bugbot too but it became pretty pricey.
- eranation 4mo ago
  Not sure why you got downvoted, and I have nothing against CodeRabbit, but this comment feels a bit like a paid ad :) How do you see CodeRabbit against other AI code review solutions? E.g. cubic.dev, Qodo, Graphite, Greptile, Baz, Augment Code... An alternative UI to GitHub is well overdue. But once someone will get it right, everyone will copy them...
  - atestu 4mo ago
    That’s exactly why I’m getting downvoted, and I get it tbh. I knew people would ask for recommendations. It’s ok. I haven’t used any of the tools you mentioned. We started using coderabbit just this year. The new PR review UI just came out. It’s made for big AI reviews which internally we’re trying to rein in. I like the direction they’re moving in with that, it uses AI to help you rather than bypass you. So you have the automated review that catches a bunch, and then they have a tool for you to step in and do your own review faster. It’s funny there’s someone replying to me saying coderabbit is the best they’ve ever seen and in another thread someone else says it’s the worst. If that’s not AI for you… you just gotta try it
faangguyindia 4mo ago
If you've codex what does it add over codex's default app? I am confused. Can't you simply ask codex in another tab to just do a code review?
- esafak 4mo ago
  We'd need a benchmark to tell.
- eyeris 4mo ago
  Presumably nothing. Do note the publisher—Alibaba presumably would rather their own tools and models instead of licensing. They do open source a fair bit of internal tooling, so it’s always interesting to see their approach
- cheema33 4mo ago
  > Can't you simply ask codex in another tab to just do a code review? You are likely to get better results if you do not use the same model for review that wrote the code. I typically use Opus for code editing and GPT 5.5 for peer review using an automation with skills. Training set is different between models. If there are gaps in coverage in one model, you want a different model reviewing the work. The second model will its own gaps, but the gap list is not identical.
  - Art9681 4mo ago
    I would suggest that you reverse those roles. gpt-5.5 as the implementer and Opus as the reviewer.
    - pluralmonad 4mo ago
      How come? I find Opus to have better taste and GPT to have more rigor.
    - hombre_fatal 4mo ago
      They find different things, and there's no reason to use one model for review. You want to review it until there's nothing left to be unearth. And if you put the review effort into polishing an impl plan, then it doesn't matter which model implements it either.
elpakal 4mo ago
At a kill s@@s hackathon at work, I was able to build something that uses a node image installs claude code runs a /review-like command puts inline comments to PR deletes old comments when rerunning OCR seems cool, but overkill, and I'm definitely not using Code Rabbit after their CEO was on here acting snobbish a while back. Point being AI code review in Git** itself isn't hard to do and can add a lot of value quickly.
- gardnr 4mo ago
  How snobbish was the CEO acting?
- eranation 4mo ago
  Nothing against coderabbit or SaaS specifically, but this was one of the reasons I stopped using it https://kudelskisecurity.com/research/how-we-exploited-coderabbit-from-a-simple-pr-to-rce-and-write-access-on-1m-repositories https://kudelskisecurity.com/research/how-we-exploited-coder... It's very easy to build a basic code review tool. It's hard to build one that developers won't ask you to turn off because of false positives (or one that will miss your next escaped bug) I think if all the tool does is run a claude code level /review skill (which all developers should definitely run before they even open a PR) then isn't this a bit of a review theater? Just a guardrail to those developers who don't run a /review-triage-fix skill in /loop before they take the PR out of draft? I wonder how many PRs in the world got to production where several developers commented on each other's code, and none of them read anything, just used their gh cli / MCP to post / answer comments / fix issues on their behalf. There is going to be an exponential growth of code generated, and you can't escape AI code review, but also there is no real difference between having Claude Code write the code and review itself locally, vs communicating with itself via a slow and downtime prone medium of "PR comments" tl;dr - without any human in the loop reviewing the AI code review, or skimming to see what the AI code review missed, there is no real reason to use a "code review" you can just run it as part of the CI/CD and hope AI won't miss anything (according to my linkedin feed, there are people out there who really thing this way...)
  - s900mhz 4mo ago
causal 4mo ago
I recently moved off Cursor's BugBot because it's no longer a flat $40, and I feel a little lost trying to find a viable alternative because there are so many and the pricing kind of sucks for all of them. Curious if anyone has a recommendation.
- lukeasrodgers 4mo ago
  My team tried coderabbit and qodo and they are both trash compared to a tool we quickly built in-house that is more or less a thin wrapper around claude/codex, along with per-repo skills. PR review is triggered by webhooks from github to the review tool's web app. The tool shared by OP from alibaba certainly does some things ours does not and appears more sophisticated, but we have never had the problems they mention. "The agent can read full file contents, search the codebase, inspect other changed files for context, and produce deep reviews — not just surface-level diff feedback." our tool does all this too. It catches dumb typos as well as more complicated bugs. Not to mention it is great as a ratchet (https://qntm.org/ratchet https://qntm.org/ratchet). It is not a substitute for reviews from other engineers though, since obviously it does nothing to achieve one of the main goals of code review, which is to socialize knowledge of the codebase. Alibaba's work here is almost certainly more advanced than what we've done, but ours has been perfectly satisfactory and better than the paid offerings we've tried. I think most teams should not be paying SaaS fees for AI code review, that is the kind of business that mostly should not exist any more.
  - mrklol 4mo ago
    In which areas do you feel like the mentioned are bad? Do they find less and your own solution has more success? If the latter, do you know why?
- kageiit 4mo ago
  gitar.ai is flat with no limits
xuanlin314 4mo ago
[flagged]
eranation 4mo ago
I wonder how they do against this benchmark (not that I vetted this benchmark... but still interesting to know...) https://codereview.withmartian.com https://codereview.withmartian.com
lizhengfeng101 4mo ago
Thank you all for the interest in Open Code Review! This project was incubated from an AI code review tool that has been widely used by developers inside Alibaba at scale. The reason we decided to open-source it is simple — we noticed that many developers in the community are either paying for similar tools or using skills to perform AI code reviews. As someone who has done deep research in this space, I think skills are actually a great approach, and running them as sub-agents is an elegant way to reduce context pollution. That said, skills do come with inherent limitations from general-purpose agents — they can be hard to debug, hard to evaluate, and difficult to tune. That's why we rewrote our internal tool in Go as a CLI and open-sourced it. Our goal is simple: free, token-efficient, and better results — while being easy to integrate into agent frameworks like Claude Code and Codex. Our Design Philosophy: Deterministic Engineering × Agent Hybrid We believe the best code review system combines the reliability of engineering with the flexibility of AI. Deterministic Engineering — for hard constraints We use engineering logic (not LLMs) to handle the parts of code review that simply cannot go wrong: Precise file filtering — Clearly defines which files need review and which should be excluded, ensuring no critical change is ever missed. Intelligent file bundling — Groups related files into the same review unit (e.g., message_en.properties and message_zh.properties are packed together). Each bundle is handled as an independent sub-agent with isolated context — this divide-and-conquer strategy performs exceptionally well on large changesets and naturally supports concurrent review. Fine-grained rule matching — Matches review rules based on file characteristics, keeping the model's attention focused and eliminating information noise from the start. Compared to pure LLM-driven rule guidance, template-engine-based rule matching produces more stable and predictable behavior. Standalone location & reflection components — Independent comment localization and comment reflection modules systematically improve both the positional accuracy and content quality of AI feedback. Agent — for dynamic decision making We let the Agent shine where it truly excels — dynamic reasoning and context retrieval: Scenario-optimized prompts — Deeply tuned prompt templates for code review scenarios, improving output quality while significantly reducing token consumption. Curated scenario-specific toolset — Based on in-depth analysis of tool call traces from large-scale production data — including call frequency distribution, repeated invocation rates per tool, and the impact of adding new tools on overall call chains — we carefully selected and restructured the general-purpose agent toolset into a specialized toolkit that is more stable and predictable in code review scenarios. Due to some internal dependencies and compliance requirements, a few features haven't been released publicly yet. But I believe as more external developers show interest in this tool, we'll accelerate the alignment between our internal and external versions. Finally, a huge thank you to everyone following this project. We want it to keep getting better, and we hope to see more free, high-quality tools like this emerge from the community.
weird-eye-issue 4mo ago
> After installation, the ocr command is available globally. Wish they chose a different acronym...
- altmanaltman 4mo ago
  [dead]
eranation 4mo ago
Ran it on a subset of 10 of the 50 PRs in this benchmark https://codereview.withmartian.com https://codereview.withmartian.com - very good recall (~74%, e.g. found a lot of the golden issues) - not so good precision (~12%, e.g. lots of false positives) - the precision causes the F1 to tank (~20%, if this stays the same on the full 50 sample it would puts it almost last, even less than Kilo+Grok)
- bobkb 4mo ago
  False positives from the deterministic audits a very difficult problem to address. Comparing and deduplicating across different methods or LLM audits seems to the only way.
- akie 4mo ago
  I would say that recall is the most important metric here though. I'd want it to catch all the issues. False positives are easy to ignore.
  - witx 4mo ago
    What, no they're not. You still need to analyze them to understand they are false positives. It's time wasted
    - onion2k 4mo ago
      Finding problems is optimizing for the customer. Avoiding false positives is optimizing for the developer. Which is right depends on your org's culture.
      - evolve-maz 4mo ago
        If I flag every line in your PR as a potential security bug then I have 100% recall. Obviously you need a mixture of high recall and low false positive rate. If 7/8 flagged items are fine its much more likely people will ignore the warnings, much like they would any security tool with a 90% false positive rate. That is not optimized for the customer.
Aegis_01 4mo ago
[flagged]
AashmanShukla 4mo ago
[flagged]
pi-victor 4mo ago
i did something like this, but somewhat in reverse. you are the one that reviews the code and you instruct AI what to do through code review comments: https://parley.cloudflavor.io https://parley.cloudflavor.io. thinking about it, it would be funny to first run alibaba's tool and then run parley after. posted it here a few days ago: https://news.ycombinator.com/item?id=48369782 https://news.ycombinator.com/item?id=48369782 i guess with AI there are too many Show HN now, and i never got any type of feedback.
- viblo 4mo ago
  Just a small note, the font on your site is very annoying to read, the characters are not aligned horizontally (Windows w Chrome). Looks to be a scaling issue, if I zoom to 200% it shows fine.
  - pi-victor 4mo ago
    ah, sorry about that - will try to see what is going on. thanks for letting me know!
hrpnk 4mo ago
Rule files are in https://github.com/alibaba/open-code-review/tree/main/internal/config/rules/rule_docs https://github.com/alibaba/open-code-review/tree/main/intern... (in Chinese)
- pramodbiligiri 4mo ago
  An English rendering of the Java.md (Google Translate): https://github-com.translate.goog/alibaba/open-code-review/blob/main/internal/config/rules/rule_docs/java.md?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp https://github-com.translate.goog/alibaba/open-code-review/b...
  - embedding-shape 4mo ago
    And for comparison, here's a GitHub gist with three versions, first the original Chinese one, then the Google Translate version you put and finally a translated done with ChatGPT Pro: https://gist.github.com/embedding-shapes/7a51d565214bd676890729cba4154dd8 https://gist.github.com/embedding-shapes/7a51d565214bd676890... Done that way mainly to see how the Google Translate version compared with a ChatGPT translation (revision: https://gist.github.com/embedding-shapes/7a51d565214bd676890729cba4154dd8/revisions?short_path=cf7680d#diff-cf7680dd4298c1c968b4f4ee68ecde49f70925564d9490c01b1c9dd7947fde87 https://gist.github.com/embedding-shapes/7a51d565214bd676890...)
sfortis 4mo ago
Is not working with gpt5.x models (Unsupported parameter: 'max_tokens' is not supported with this model. Use 'max_completion_tokens' instead.) which is hardcoded. I dont know why this is on the front page. My review-with-codex skill is working just fine, consuming my usage and not API tokens.
- lizhengfeng101 4mo ago
  I'm sorry — we didn't expect to receive so much attention from the developer community so soon after open-sourcing the project. Some parts of the codebase are not yet fully polished. We are currently refactoring the LLM module and will address this as soon as possible. Once again, I sincerely apologize for the inconvenience.
- eranation 4mo ago
  Managed to get it to work with those actually. (Had to change the code of course)
  - lizhengfeng101 4mo ago
    This issue has been fixed. Welcome to use the latest version.
gbrindisi 4mo ago
I like the pattern of making a dedicated cli/harness and just build a skill to teach coding agents to use it. At $work we built a thorough workflow to do security reviews, which is a pure skill to simplify adoption https://www.synthesia.io/post/automating-code-security-reviews-with-claude-mythos-level-capabilities https://www.synthesia.io/post/automating-code-security-revie... But the user experience is tricky because if we aim for very low false positives the run time for this kind of workflows is too long, it's then hard to justify blocking PRs.
nutifafa 4mo ago
this is a great tool, until you try reading the rule files, I had find a translator to make heads of it. given that it is CLI tool is great dev the tinker with it at no additional cost.
songting591 4mo ago
[flagged]
pramodbiligiri 4mo ago
A repo with the English translation of each of the rules files, using Google Translate: https://github.com/pramodbiligiri/open-code-review-rules https://github.com/pramodbiligiri/open-code-review-rules. The original rules files (in Chinese): https://github.com/alibaba/open-code-review/tree/main/internal/config/rules/rule_docs https://github.com/alibaba/open-code-review/tree/main/intern...
- embedding-shape 4mo ago
  I guess since you copy-pasted your comment here, yet didn't include a more proper and correct translation (again), here is my other comment again: And for comparison, here's a GitHub gist with three versions, first the original Chinese one, then the Google Translate version you put and finally a translated done with ChatGPT Pro: https://gist.github.com/embedding-shapes/7a51d565214bd676890729cba4154dd8 https://gist.github.com/embedding-shapes/7a51d565214bd676890... Done that way mainly to see how the Google Translate version compared with a ChatGPT translation (revision: https://gist.github.com/embedding-shapes/7a51d565214bd676890729cba4154dd8/revisions?short_path=cf7680d#diff-cf7680dd4298c1c968b4f4ee68ecde49f70925564d9490c01b1c9dd7947fde87 https://gist.github.com/embedding-shapes/7a51d565214bd676890...)
- ignoramous 4mo ago
  The project lead has since mainlined the translation: https://github.com/alibaba/open-code-review/commit/8c4463f65729618d01828a5c52ccd7161f64ffc9 https://github.com/alibaba/open-code-review/commit/8c4463f65... I wonder what it means for prompts to go from Mandarin / Cantonese to English...
aos_architect 4mo ago
[flagged]
eddysir 4mo ago
[flagged]
Luker88 4mo ago
how does it compare to the red hat ai code review? https://gitlab.com/redhat/edge/ci-cd/ai-code-review https://gitlab.com/redhat/edge/ci-cd/ai-code-review Has anyone experience with that one?
shine320 4mo ago
[dead]
panavm 4mo ago
[flagged]
jimmysongio 4mo ago
[dead]
firemelt 4mo ago
even on ultracode and workflow my code teview always return something that I find just trivial and not a real issue
piyush24rai 4mo ago
[flagged]
deleted 4mo ago
[deleted]

284 points by geoffbp 4mo ago

hanspagel 4mo ago

Did it review the landing page for it? Because it looks broken on iOS.

singiamtel 4mo ago

Not to be confused with Opencode the harness

singingtoday 4mo ago

I'm interested in trying this. We have our own internal automated review which has shown positive results, but I would love to drop it if I find something better. Code review is currently our bottleneck, so any possibility of better automating it is welcome.

Supermancho 4mo ago
[flagged]
sergeym 4mo ago
I've been liking this code review skill lately, it has pointed out some good improvements. https://github.com/cursor/plugins/blob/main/cursor-team-kit/skills/thermo-nuclear-code-quality-review/SKILL.md https://github.com/cursor/plugins/blob/main/cursor-team-kit/...
pramodbiligiri 4mo ago
Thermonuclear suggested by someone below is good. Matt Poccock did a demo/breakdown of that: https://www.youtube.com/watch?v=mh5XZ-L5SFQ https://www.youtube.com/watch?v=mh5XZ-L5SFQ. He has his own "improve-codebase-architecture" skill: https://github.com/mattpocock/skills/blob/main/skills/engineering/improve-codebase-architecture/SKILL.md https://github.com/mattpocock/skills/blob/main/skills/engine... Some of them are about general coding guidelines and code quality, not necessarily vetting your current PR against specs! There's AbsolutelySkilled with clean-code and clean-architecture. Linking to older version of repo because they seem to be no longer on trunk: https://github.com/AbsolutelySkilled/AbsolutelySkilled/tree/8f704b39e2c652ab199d3c4d6b6cb709426f692c/skills https://github.com/AbsolutelySkilled/AbsolutelySkilled/tree/... I've been creating some rules to help with my Java coding: https://github.com/bitkentech/shipsmooth/tree/main/skills/experimental/refine/rules https://github.com/bitkentech/shipsmooth/tree/main/skills/ex.... These are assembled into a SKILL file when this skill file template is built: https://github.com/bitkentech/shipsmooth/blob/main/skills/experimental/refine/SKILL.jte.md https://github.com/bitkentech/shipsmooth/blob/main/skills/ex...

atestu 4mo ago

We've been using Coderabbit, great deal ($30/mo/dev flat) and finds a lot. I also built a skill I call `/meta-review` that asks Codex, Cursor, and Gemini to review the code (I use Claude Code). It always finds little things claude & I missed. Coderabbit just came out with their own PR review UI that's great for big PRs, it groups files together etc. https://www.coderabbit.ai/blog/introducing-atlas-the-first-ai-native-code-review-interface https://www.coderabbit.ai/blog/introducing-atlas-the-first-a...

causal 4mo ago
Is it actually flat fee? I loved Cursor bugbot which was flat fee but they moved to per-run and that killed it for me, but a lot of others are doing the same.
- atestu 4mo ago
  Yes! They just have a rate limit but we never run into it (we’re just 3 people though). Yea I liked bugbot too but it became pretty pricey.
eranation 4mo ago
Not sure why you got downvoted, and I have nothing against CodeRabbit, but this comment feels a bit like a paid ad :) How do you see CodeRabbit against other AI code review solutions? E.g. cubic.dev, Qodo, Graphite, Greptile, Baz, Augment Code... An alternative UI to GitHub is well overdue. But once someone will get it right, everyone will copy them...
- atestu 4mo ago
  That’s exactly why I’m getting downvoted, and I get it tbh. I knew people would ask for recommendations. It’s ok. I haven’t used any of the tools you mentioned. We started using coderabbit just this year. The new PR review UI just came out. It’s made for big AI reviews which internally we’re trying to rein in. I like the direction they’re moving in with that, it uses AI to help you rather than bypass you. So you have the automated review that catches a bunch, and then they have a tool for you to step in and do your own review faster. It’s funny there’s someone replying to me saying coderabbit is the best they’ve ever seen and in another thread someone else says it’s the worst. If that’s not AI for you… you just gotta try it

faangguyindia 4mo ago

If you've codex what does it add over codex's default app? I am confused. Can't you simply ask codex in another tab to just do a code review?

esafak 4mo ago
We'd need a benchmark to tell.
eyeris 4mo ago
Presumably nothing. Do note the publisher—Alibaba presumably would rather their own tools and models instead of licensing. They do open source a fair bit of internal tooling, so it’s always interesting to see their approach
cheema33 4mo ago
> Can't you simply ask codex in another tab to just do a code review? You are likely to get better results if you do not use the same model for review that wrote the code. I typically use Opus for code editing and GPT 5.5 for peer review using an automation with skills. Training set is different between models. If there are gaps in coverage in one model, you want a different model reviewing the work. The second model will its own gaps, but the gap list is not identical.
- Art9681 4mo ago
  I would suggest that you reverse those roles. gpt-5.5 as the implementer and Opus as the reviewer.
  - pluralmonad 4mo ago
    How come? I find Opus to have better taste and GPT to have more rigor.
  - hombre_fatal 4mo ago
    They find different things, and there's no reason to use one model for review. You want to review it until there's nothing left to be unearth. And if you put the review effort into polishing an impl plan, then it doesn't matter which model implements it either.

elpakal 4mo ago

At a kill s@@s hackathon at work, I was able to build something that uses a node image installs claude code runs a /review-like command puts inline comments to PR deletes old comments when rerunning OCR seems cool, but overkill, and I'm definitely not using Code Rabbit after their CEO was on here acting snobbish a while back. Point being AI code review in Git** itself isn't hard to do and can add a lot of value quickly.

gardnr 4mo ago
How snobbish was the CEO acting?
eranation 4mo ago
Nothing against coderabbit or SaaS specifically, but this was one of the reasons I stopped using it https://kudelskisecurity.com/research/how-we-exploited-coderabbit-from-a-simple-pr-to-rce-and-write-access-on-1m-repositories https://kudelskisecurity.com/research/how-we-exploited-coder... It's very easy to build a basic code review tool. It's hard to build one that developers won't ask you to turn off because of false positives (or one that will miss your next escaped bug) I think if all the tool does is run a claude code level /review skill (which all developers should definitely run before they even open a PR) then isn't this a bit of a review theater? Just a guardrail to those developers who don't run a /review-triage-fix skill in /loop before they take the PR out of draft? I wonder how many PRs in the world got to production where several developers commented on each other's code, and none of them read anything, just used their gh cli / MCP to post / answer comments / fix issues on their behalf. There is going to be an exponential growth of code generated, and you can't escape AI code review, but also there is no real difference between having Claude Code write the code and review itself locally, vs communicating with itself via a slow and downtime prone medium of "PR comments" tl;dr - without any human in the loop reviewing the AI code review, or skimming to see what the AI code review missed, there is no real reason to use a "code review" you can just run it as part of the CI/CD and hope AI won't miss anything (according to my linkedin feed, there are people out there who really thing this way...)
- s900mhz 4mo ago

causal 4mo ago

I recently moved off Cursor's BugBot because it's no longer a flat $40, and I feel a little lost trying to find a viable alternative because there are so many and the pricing kind of sucks for all of them. Curious if anyone has a recommendation.

lukeasrodgers 4mo ago
My team tried coderabbit and qodo and they are both trash compared to a tool we quickly built in-house that is more or less a thin wrapper around claude/codex, along with per-repo skills. PR review is triggered by webhooks from github to the review tool's web app. The tool shared by OP from alibaba certainly does some things ours does not and appears more sophisticated, but we have never had the problems they mention. "The agent can read full file contents, search the codebase, inspect other changed files for context, and produce deep reviews — not just surface-level diff feedback." our tool does all this too. It catches dumb typos as well as more complicated bugs. Not to mention it is great as a ratchet (https://qntm.org/ratchet https://qntm.org/ratchet). It is not a substitute for reviews from other engineers though, since obviously it does nothing to achieve one of the main goals of code review, which is to socialize knowledge of the codebase. Alibaba's work here is almost certainly more advanced than what we've done, but ours has been perfectly satisfactory and better than the paid offerings we've tried. I think most teams should not be paying SaaS fees for AI code review, that is the kind of business that mostly should not exist any more.
- mrklol 4mo ago
  In which areas do you feel like the mentioned are bad? Do they find less and your own solution has more success? If the latter, do you know why?
kageiit 4mo ago
gitar.ai is flat with no limits

xuanlin314 4mo ago

[flagged]

eranation 4mo ago

I wonder how they do against this benchmark (not that I vetted this benchmark... but still interesting to know...) https://codereview.withmartian.com https://codereview.withmartian.com

lizhengfeng101 4mo ago

Thank you all for the interest in Open Code Review! This project was incubated from an AI code review tool that has been widely used by developers inside Alibaba at scale. The reason we decided to open-source it is simple — we noticed that many developers in the community are either paying for similar tools or using skills to perform AI code reviews. As someone who has done deep research in this space, I think skills are actually a great approach, and running them as sub-agents is an elegant way to reduce context pollution. That said, skills do come with inherent limitations from general-purpose agents — they can be hard to debug, hard to evaluate, and difficult to tune. That's why we rewrote our internal tool in Go as a CLI and open-sourced it. Our goal is simple: free, token-efficient, and better results — while being easy to integrate into agent frameworks like Claude Code and Codex. Our Design Philosophy: Deterministic Engineering × Agent Hybrid We believe the best code review system combines the reliability of engineering with the flexibility of AI. Deterministic Engineering — for hard constraints We use engineering logic (not LLMs) to handle the parts of code review that simply cannot go wrong: Precise file filtering — Clearly defines which files need review and which should be excluded, ensuring no critical change is ever missed. Intelligent file bundling — Groups related files into the same review unit (e.g., message_en.properties and message_zh.properties are packed together). Each bundle is handled as an independent sub-agent with isolated context — this divide-and-conquer strategy performs exceptionally well on large changesets and naturally supports concurrent review. Fine-grained rule matching — Matches review rules based on file characteristics, keeping the model's attention focused and eliminating information noise from the start. Compared to pure LLM-driven rule guidance, template-engine-based rule matching produces more stable and predictable behavior. Standalone location & reflection components — Independent comment localization and comment reflection modules systematically improve both the positional accuracy and content quality of AI feedback. Agent — for dynamic decision making We let the Agent shine where it truly excels — dynamic reasoning and context retrieval: Scenario-optimized prompts — Deeply tuned prompt templates for code review scenarios, improving output quality while significantly reducing token consumption. Curated scenario-specific toolset — Based on in-depth analysis of tool call traces from large-scale production data — including call frequency distribution, repeated invocation rates per tool, and the impact of adding new tools on overall call chains — we carefully selected and restructured the general-purpose agent toolset into a specialized toolkit that is more stable and predictable in code review scenarios. Due to some internal dependencies and compliance requirements, a few features haven't been released publicly yet. But I believe as more external developers show interest in this tool, we'll accelerate the alignment between our internal and external versions. Finally, a huge thank you to everyone following this project. We want it to keep getting better, and we hope to see more free, high-quality tools like this emerge from the community.

weird-eye-issue 4mo ago

> After installation, the ocr command is available globally. Wish they chose a different acronym...

altmanaltman 4mo ago
[dead]

eranation 4mo ago

Ran it on a subset of 10 of the 50 PRs in this benchmark https://codereview.withmartian.com https://codereview.withmartian.com - very good recall (~74%, e.g. found a lot of the golden issues) - not so good precision (~12%, e.g. lots of false positives) - the precision causes the F1 to tank (~20%, if this stays the same on the full 50 sample it would puts it almost last, even less than Kilo+Grok)

bobkb 4mo ago
False positives from the deterministic audits a very difficult problem to address. Comparing and deduplicating across different methods or LLM audits seems to the only way.
akie 4mo ago
I would say that recall is the most important metric here though. I'd want it to catch all the issues. False positives are easy to ignore.
- witx 4mo ago
  What, no they're not. You still need to analyze them to understand they are false positives. It's time wasted
  - onion2k 4mo ago
    Finding problems is optimizing for the customer. Avoiding false positives is optimizing for the developer. Which is right depends on your org's culture.
    - evolve-maz 4mo ago
      If I flag every line in your PR as a potential security bug then I have 100% recall. Obviously you need a mixture of high recall and low false positive rate. If 7/8 flagged items are fine its much more likely people will ignore the warnings, much like they would any security tool with a 90% false positive rate. That is not optimized for the customer.

Aegis_01 4mo ago

[flagged]

AashmanShukla 4mo ago

[flagged]

pi-victor 4mo ago

i did something like this, but somewhat in reverse. you are the one that reviews the code and you instruct AI what to do through code review comments: https://parley.cloudflavor.io https://parley.cloudflavor.io. thinking about it, it would be funny to first run alibaba's tool and then run parley after. posted it here a few days ago: https://news.ycombinator.com/item?id=48369782 https://news.ycombinator.com/item?id=48369782 i guess with AI there are too many Show HN now, and i never got any type of feedback.

viblo 4mo ago
Just a small note, the font on your site is very annoying to read, the characters are not aligned horizontally (Windows w Chrome). Looks to be a scaling issue, if I zoom to 200% it shows fine.
- pi-victor 4mo ago
  ah, sorry about that - will try to see what is going on. thanks for letting me know!

hrpnk 4mo ago

Rule files are in https://github.com/alibaba/open-code-review/tree/main/internal/config/rules/rule_docs https://github.com/alibaba/open-code-review/tree/main/intern... (in Chinese)

pramodbiligiri 4mo ago
An English rendering of the Java.md (Google Translate): https://github-com.translate.goog/alibaba/open-code-review/blob/main/internal/config/rules/rule_docs/java.md?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp https://github-com.translate.goog/alibaba/open-code-review/b...
- embedding-shape 4mo ago
  And for comparison, here's a GitHub gist with three versions, first the original Chinese one, then the Google Translate version you put and finally a translated done with ChatGPT Pro: https://gist.github.com/embedding-shapes/7a51d565214bd676890729cba4154dd8 https://gist.github.com/embedding-shapes/7a51d565214bd676890... Done that way mainly to see how the Google Translate version compared with a ChatGPT translation (revision: https://gist.github.com/embedding-shapes/7a51d565214bd676890729cba4154dd8/revisions?short_path=cf7680d#diff-cf7680dd4298c1c968b4f4ee68ecde49f70925564d9490c01b1c9dd7947fde87 https://gist.github.com/embedding-shapes/7a51d565214bd676890...)

sfortis 4mo ago

Is not working with gpt5.x models (Unsupported parameter: 'max_tokens' is not supported with this model. Use 'max_completion_tokens' instead.) which is hardcoded. I dont know why this is on the front page. My review-with-codex skill is working just fine, consuming my usage and not API tokens.

lizhengfeng101 4mo ago
I'm sorry — we didn't expect to receive so much attention from the developer community so soon after open-sourcing the project. Some parts of the codebase are not yet fully polished. We are currently refactoring the LLM module and will address this as soon as possible. Once again, I sincerely apologize for the inconvenience.
eranation 4mo ago
Managed to get it to work with those actually. (Had to change the code of course)
- lizhengfeng101 4mo ago
  This issue has been fixed. Welcome to use the latest version.

gbrindisi 4mo ago

I like the pattern of making a dedicated cli/harness and just build a skill to teach coding agents to use it. At $work we built a thorough workflow to do security reviews, which is a pure skill to simplify adoption https://www.synthesia.io/post/automating-code-security-reviews-with-claude-mythos-level-capabilities https://www.synthesia.io/post/automating-code-security-revie... But the user experience is tricky because if we aim for very low false positives the run time for this kind of workflows is too long, it's then hard to justify blocking PRs.

nutifafa 4mo ago

this is a great tool, until you try reading the rule files, I had find a translator to make heads of it. given that it is CLI tool is great dev the tinker with it at no additional cost.

songting591 4mo ago

[flagged]

pramodbiligiri 4mo ago

A repo with the English translation of each of the rules files, using Google Translate: https://github.com/pramodbiligiri/open-code-review-rules https://github.com/pramodbiligiri/open-code-review-rules. The original rules files (in Chinese): https://github.com/alibaba/open-code-review/tree/main/internal/config/rules/rule_docs https://github.com/alibaba/open-code-review/tree/main/intern...

embedding-shape 4mo ago
I guess since you copy-pasted your comment here, yet didn't include a more proper and correct translation (again), here is my other comment again: And for comparison, here's a GitHub gist with three versions, first the original Chinese one, then the Google Translate version you put and finally a translated done with ChatGPT Pro: https://gist.github.com/embedding-shapes/7a51d565214bd676890729cba4154dd8 https://gist.github.com/embedding-shapes/7a51d565214bd676890... Done that way mainly to see how the Google Translate version compared with a ChatGPT translation (revision: https://gist.github.com/embedding-shapes/7a51d565214bd676890729cba4154dd8/revisions?short_path=cf7680d#diff-cf7680dd4298c1c968b4f4ee68ecde49f70925564d9490c01b1c9dd7947fde87 https://gist.github.com/embedding-shapes/7a51d565214bd676890...)
ignoramous 4mo ago
The project lead has since mainlined the translation: https://github.com/alibaba/open-code-review/commit/8c4463f65729618d01828a5c52ccd7161f64ffc9 https://github.com/alibaba/open-code-review/commit/8c4463f65... I wonder what it means for prompts to go from Mandarin / Cantonese to English...

aos_architect 4mo ago

[flagged]

eddysir 4mo ago

[flagged]

Luker88 4mo ago

how does it compare to the red hat ai code review? https://gitlab.com/redhat/edge/ci-cd/ai-code-review https://gitlab.com/redhat/edge/ci-cd/ai-code-review Has anyone experience with that one?

shine320 4mo ago

[dead]

panavm 4mo ago

[flagged]

jimmysongio 4mo ago

[dead]

firemelt 4mo ago

even on ultracode and workflow my code teview always return something that I find just trivial and not a real issue

piyush24rai 4mo ago

[flagged]

deleted 4mo ago

[deleted]