Sign InOpen Brain
GitHubGitHub RepoNeeds Review

alibaba/open-code-review

Alibaba’s open-source review CLI combines deterministic diff handling with an LLM agent to improve line-level precision and reduce token use, while explicitly trading away recall.

GitHub · Trending today
Open Source Open MarkdownOpen JSON
Source Summary

Open Code Review reads diffs, gives an LLM agent code-search and file-reading tools, and returns line-level findings. Its benchmark covers **200 pull requests**, **10 languages**, and **1,505 annotated issues** reviewed by more than 80 senior engineers.

Practical Implication

Use it when generic coding agents produce noisy findings, skip files, or attach comments to the wrong lines. The deterministic layer selects and bundles files, matches rules, and positions comments; isolated subagents handle related bundles concurrently.

Agent-Ready Context
Open Code Review reads diffs, gives an LLM agent code-search and file-reading tools, and returns line-level findings. Its benchmark covers **200 pull requests**, **10 languages**, and **1,505 annotated issues** reviewed by more than 80 senior engineers.

Use it when generic coding agents produce noisy findings, skip files, or attach comments to the wrong lines. The deterministic layer selects and bundles files, matches rules, and positions comments; isolated subagents handle related bundles concurrently.

The project reports roughly **one-ninth the token use** of a general-purpose agent with the same model, plus higher precision and F1. Recall is lower by design, so it should complement rather than replace broader testing and review.
Connected Context · Feed7 Judgment

This narrows agentic review into a specialized pipeline where deterministic preparation and comment placement constrain focused subagents. The reported precision and token gains support task-specific harnesses over general agents for line-level findings, but intentionally lower recall makes the system one evidence source within testing, security analysis, and human review—not a complete merge gate.

Distributed Attacks in Persistent-State AI ControlDistributed attacks across multiple pull requests expose a boundary of this per-diff architecture: accurate line-level review can still miss malicious behavior assembled across persistent sessions.The AI bugpocalypse is here. Now what? - Jack Cable, CorridorThe broader rise in agent-introduced vulnerabilities strengthens the case for embedding this focused review stage in coding workflows, while systemic prevention remains necessary beyond finding individual issues.Your Code Has Bugs. Lean4 Has Proofs: Formal Verification for Engineers — Varun Pant, AWSFormal verification complements the reviewer’s deliberately limited recall by offering machine-checked conformance for critical paths, provided humans first define and validate the specification.
Context Map
toolscodingsecurity#coding-agents#agent-reliability#tool-use
Uncertainty
The project reports roughly **one-ninth the token use** of a general-purpose agent with the same model, plus higher precision and F1. Recall is lower by design, so it should complement rather than replace broader testing and review.