# Open Code Review

> Updated 2026-09-16 · type: tool · category: mcp-agents · status: active · rev 1

Open Code Review runs a deterministic-plus-LLM pass over your git diff to post line-level comments, using Alibaba's internal ruleset and your own model key.

- Open source: yes (Apache-2.0)
- Self-hostable: yes
- Pricing model: free
- Best for: A team that wants an automated first-pass reviewer wired into its git flow — line-level flags on real defects before a human looks — without paying per-seat for a hosted code-review SaaS, and without sending diffs anywhere but the model provider it already uses.
- Last verified: 2026-09-16

- **Canonical:** https://gtmstacker.com/registry/tool/open-code-review/
- **Source:** [github · alibaba/open-code-review](https://github.com/alibaba/open-code-review)
- **Tags:** mcp-agents, code-review, developer-tooling, self-hostable, byo-key
- **Repository:** https://github.com/alibaba/open-code-review

## Is Open Code Review open source?

Yes, Open Code Review is open source under the Apache-2.0 license.

## How much does Open Code Review cost?

Open Code Review is free to use.

## Can I self-host Open Code Review?

Yes, Open Code Review can be self-hosted (the source is available under the Apache-2.0 license).

## Alternatives & related

- [DeepSeek Harness (dsh)](https://gtmstacker.com/registry/tool/deepseek-harness/)


---

Apache-2.0 AI code-review CLI that Alibaba ran as its internal official reviewer for roughly two years before releasing it. It reads a git diff, sends the changed files through a hybrid deterministic-pipeline-plus-LLM-agent pass with a built-in multi-language ruleset (null-pointer, thread-safety, XSS, SQL injection), and returns structured, line-level comments. You supply your own OpenAI- or Anthropic-compatible model key, or run a delegation mode that hands the review to a coding agent's own model so no extra key is required. It installs from npm.

## Provenance

- Apache-2.0, the deterministic + LLM-agent architecture, the built-in security ruleset, BYO-key / delegation modes and npm distribution independently verified via the repo and README (WebFetch + search 2026-09-16, github.com/alibaba/open-code-review). Stars read north of 30k on 2026-09-16, up from a reported ~11.8k two months after the May 2026 release — treat as approximate.
- Surfaced via the 2026-09-16 viral-posts brief (a post reframing it as "just open sourced"); the provenance here corrects that — it has been public since May 2026 and is catalogued as an existing gap, not a new drop.
- Curated from the GTM Stacker signal registry (2026-09-16 pass); license independently verified 2026-09-16.

## Why it matters for a GTM stack

A lot of the GTM stack is now code someone on the team vibe-shipped with an agent, and the review step is where that either gets caught or ships. Open Code Review is a self-hostable, bring-your-own-key first-pass reviewer that plugs into the git diff and flags real defect classes at the line level — the kind of thing teams usually rent from a per-seat SaaS. Two honest caveats keep it in proportion: it has been public since May, so it is not the fresh launch some posts imply, and the eye-catching precision numbers are the project's own benchmark, not an independent one. As an Apache-2.0 reviewer with a serious operational history behind it, it is worth wiring in and measuring on your own repo.