38.1k stars · Apache-2.0 · v1.12.7, read from /releases/latest, shown as '19 Sep' with no year and therefore 19 September 2026, with 3 commits to main since; ungh.cc confirms the release date as 2026-09-19 with the year present · Track this in Scout
A command-line code reviewer from Alibaba that mixes fixed rules with an AI model and leaves line-level comments on the change you just made.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A command-line tool from Alibaba that combines fixed rules with an AI model. The fixed rules catch known classes of mistake in several languages, and the model reads the rest of the change and comments on it.What it is good for. Anyone who writes code without a colleague to review it. That is most solo builders. The fixed rules alone cover null-pointer mistakes, thread-safety problems, cross-site scripting and SQL injection, which are the four that cost the most when they get through. The project says plainly that it aims to report fewer things and be right more often, rather than list everything it suspects. You build Grasppy and ScalpingMate with Claude Code, so code arrives faster than you can read it; this is a second pair of eyes on exactly that.
- Apache-2.0, which is a permissive licence: you can use it in a commercial product with no conditions beyond keeping the notice.
- It works with OpenAI and Anthropic models, and with your own endpoint, so you are not tied to one supplier.
- It ships as a plugin for Claude Code, Codex, Cursor and OpenCode, so it sits inside the tool you already use.
- Every review costs money at the AI provider. The project says it uses about one ninth of the words a general-purpose assistant would, but one ninth of something is not nothing.
- It needs Git version 2.41 or newer, and Node.js, before anything else.
- Choosing precision over coverage means it will miss real problems. It is a second reader, not a safety net.
- qodo-ai/pr-agent
It also reviews changes with a model and posts the comments, and it is built around pull requests on a hosting service rather than around your local working copy.
Track this in Scout - reviewdog/reviewdog
It posts review comments too, but it uses ordinary code-checking tools instead of a model, so it costs nothing to run and finds only what those tools find.
Track this in Scout
npm install -g @alibaba-group/open-code-review ocr config provider # choose OpenAI, Anthropic or a custom endpoint ocr config model cd /path/to/your/project ocr review # review what you have changed but not committed
