Open Code Review – An AI-powered code review CLI tool
https://github.com/alibaba/open-code-review- very good recall (~74%, e.g. found a lot of the golden issues)
- not so good precision (~12%, e.g. lots of false positives)
- the precision causes the F1 to tank (~20%, if this stays the same on the full 50 sample it would puts it almost last, even less than Kilo+Grok)
Surprisingly not as big of a difference as one would hope. It turns out that smarter models are more conservative. Smarter model / More thinking = slightly worse recall sometimes.
I think it says more about the benchmark itself perhaps. Reviews are highly opinionated. And it could be that the smarter models are actually better, just the “golden” state is very opinionated.
False positives are easy to ignore.
The idea of a PR is for others to find things that you have a blind spot to, and also leave some paper trail on the thought process. E.g. if something was not fixed, there is a history of a comment and a reason on WHY it wasn't fixed. If you do all that only locally, that context is lost.
We noticed that even after doing this self review loop multiple times, we still find issues (either via other models / tools or via humans that have the "tribal knowledge")
Maybe one day AI will write perfect code and can review itself, but even if it's 0.1% chance it has a bug, or 1 in a million it will do something a bit sinister (like open a backdoor just in case you try to shut it down) - then I really think there is always going to be a need for humans to review something.
You are likely to get better results if you do not use the same model for review that wrote the code. I typically use Opus for code editing and GPT 5.5 for peer review using an automation with skills.
Training set is different between models. If there are gaps in coverage in one model, you want a different model reviewing the work. The second model will its own gaps, but the gap list is not identical.
There’s no evidence of this. I guess you are anthropomorphising models (i.e., it’s good that - different human reviews your code)
However, using two models to generate two reviews easily beats doing one model and one review, as some models seem to "care" more about certain things, but you'll just miss different things if you change the model rather than add more.
Or if you make it "be a security engineer" with particular focus points.
Or make it a grammar nazi, it will find way more typos than without such focus.
Of course all of those "focuses" needs to be in a separate context (agent/subagent) to make it work.
And if you put the review effort into polishing an impl plan, then it doesn't matter which model implements it either.
Like with "SKILL" files in general, it's got to do with Prompt Engineering: https://en.wikipedia.org/wiki/Prompt_engineering#Rationale
They do open source a fair bit of internal tooling, so it’s always interesting to see their approach
We built something similar, it looks for new PRs where the bot is added and does reviews. Makes the code more tuned toward similar rules. I can't assume that a developer run a code review tool himself (just as I don't assume he/she run a build - so we run builds also).
It is just another perspective for code review, besides human. Unfortunately it uses a lot of tokens, and considering that Anthropic, OpenAI and Github Copilot all moved to token based pricing, it is quite a money burner.
Done that way mainly to see how the Google Translate version compared with a ChatGPT translation (revision: https://gist.github.com/embedding-shapes/7a51d565214bd676890...)
At $work we built a thorough workflow to do security reviews, which is a pure skill to simplify adoption https://www.synthesia.io/post/automating-code-security-revie...
But the user experience is tricky because if we aim for very low false positives the run time for this kind of workflows is too long, it's then hard to justify blocking PRs.
We have our own internal automated review which has shown positive results, but I would love to drop it if I find something better.
Code review is currently our bottleneck, so any possibility of better automating it is welcome.
Some of them are about general coding guidelines and code quality, not necessarily vetting your current PR against specs! There's AbsolutelySkilled with clean-code and clean-architecture. Linking to older version of repo because they seem to be no longer on trunk: https://github.com/AbsolutelySkilled/AbsolutelySkilled/tree/...
I've been creating some rules to help with my Java coding: https://github.com/bitkentech/shipsmooth/tree/main/skills/ex.... These are assembled into a SKILL file when this skill file template is built: https://github.com/bitkentech/shipsmooth/blob/main/skills/ex...
uses a node image installs claude code runs a /review-like command puts inline comments to PR deletes old comments when rerunning
OCR seems cool, but overkill, and I'm definitely not using Code Rabbit after their CEO was on here acting snobbish a while back.
Point being AI code review in Git** itself isn't hard to do and can add a lot of value quickly.
It's very easy to build a basic code review tool. It's hard to build one that developers won't ask you to turn off because of false positives (or one that will miss your next escaped bug)
I think if all the tool does is run a claude code level /review skill (which all developers should definitely run before they even open a PR) then isn't this a bit of a review theater? Just a guardrail to those developers who don't run a /review-triage-fix skill in /loop before they take the PR out of draft?
I wonder how many PRs in the world got to production where several developers commented on each other's code, and none of them read anything, just used their gh cli / MCP to post / answer comments / fix issues on their behalf.
There is going to be an exponential growth of code generated, and you can't escape AI code review, but also there is no real difference between having Claude Code write the code and review itself locally, vs communicating with itself via a slow and downtime prone medium of "PR comments"
tl;dr - without any human in the loop reviewing the AI code review, or skimming to see what the AI code review missed, there is no real reason to use a "code review" you can just run it as part of the CI/CD and hope AI won't miss anything (according to my linkedin feed, there are people out there who really thing this way...)
https://gitlab.com/redhat/edge/ci-cd/ai-code-review
Has anyone experience with that one?
The original rules files (in Chinese): https://github.com/alibaba/open-code-review/tree/main/intern...
And for comparison, here's a GitHub gist with three versions, first the original Chinese one, then the Google Translate version you put and finally a translated done with ChatGPT Pro: https://gist.github.com/embedding-shapes/7a51d565214bd676890...
Done that way mainly to see how the Google Translate version compared with a ChatGPT translation (revision: https://gist.github.com/embedding-shapes/7a51d565214bd676890...)
thinking about it, it would be funny to first run alibaba's tool and then run parley after.
posted it here a few days ago: https://news.ycombinator.com/item?id=48369782 i guess with AI there are too many Show HN now, and i never got any type of feedback.
I also built a skill I call `/meta-review` that asks Codex, Cursor, and Gemini to review the code (I use Claude Code). It always finds little things claude & I missed.
Coderabbit just came out with their own PR review UI that's great for big PRs, it groups files together etc. https://www.coderabbit.ai/blog/introducing-atlas-the-first-a...
How do you see CodeRabbit against other AI code review solutions? E.g. cubic.dev, Qodo, Graphite, Greptile, Baz, Augment Code...
An alternative UI to GitHub is well overdue. But once someone will get it right, everyone will copy them...
I haven’t used any of the tools you mentioned. We started using coderabbit just this year. The new PR review UI just came out. It’s made for big AI reviews which internally we’re trying to rein in. I like the direction they’re moving in with that, it uses AI to help you rather than bypass you. So you have the automated review that catches a bunch, and then they have a tool for you to step in and do your own review faster.
It’s funny there’s someone replying to me saying coderabbit is the best they’ve ever seen and in another thread someone else says it’s the worst. If that’s not AI for you… you just gotta try it
Yea I liked bugbot too but it became pretty pricey.
"The agent can read full file contents, search the codebase, inspect other changed files for context, and produce deep reviews — not just surface-level diff feedback." our tool does all this too. It catches dumb typos as well as more complicated bugs. Not to mention it is great as a ratchet (https://qntm.org/ratchet). It is not a substitute for reviews from other engineers though, since obviously it does nothing to achieve one of the main goals of code review, which is to socialize knowledge of the codebase.
Alibaba's work here is almost certainly more advanced than what we've done, but ours has been perfectly satisfactory and better than the paid offerings we've tried. I think most teams should not be paying SaaS fees for AI code review, that is the kind of business that mostly should not exist any more.
If the latter, do you know why?
This project was incubated from an AI code review tool that has been widely used by developers inside Alibaba at scale. The reason we decided to open-source it is simple — we noticed that many developers in the community are either paying for similar tools or using skills to perform AI code reviews.
As someone who has done deep research in this space, I think skills are actually a great approach, and running them as sub-agents is an elegant way to reduce context pollution. That said, skills do come with inherent limitations from general-purpose agents — they can be hard to debug, hard to evaluate, and difficult to tune. That's why we rewrote our internal tool in Go as a CLI and open-sourced it. Our goal is simple: free, token-efficient, and better results — while being easy to integrate into agent frameworks like Claude Code and Codex.
Our Design Philosophy: Deterministic Engineering × Agent Hybrid We believe the best code review system combines the reliability of engineering with the flexibility of AI.
Deterministic Engineering — for hard constraints
We use engineering logic (not LLMs) to handle the parts of code review that simply cannot go wrong:
Precise file filtering — Clearly defines which files need review and which should be excluded, ensuring no critical change is ever missed. Intelligent file bundling — Groups related files into the same review unit (e.g., message_en.properties and message_zh.properties are packed together). Each bundle is handled as an independent sub-agent with isolated context — this divide-and-conquer strategy performs exceptionally well on large changesets and naturally supports concurrent review. Fine-grained rule matching — Matches review rules based on file characteristics, keeping the model's attention focused and eliminating information noise from the start. Compared to pure LLM-driven rule guidance, template-engine-based rule matching produces more stable and predictable behavior. Standalone location & reflection components — Independent comment localization and comment reflection modules systematically improve both the positional accuracy and content quality of AI feedback. Agent — for dynamic decision making
We let the Agent shine where it truly excels — dynamic reasoning and context retrieval:
Scenario-optimized prompts — Deeply tuned prompt templates for code review scenarios, improving output quality while significantly reducing token consumption. Curated scenario-specific toolset — Based on in-depth analysis of tool call traces from large-scale production data — including call frequency distribution, repeated invocation rates per tool, and the impact of adding new tools on overall call chains — we carefully selected and restructured the general-purpose agent toolset into a specialized toolkit that is more stable and predictable in code review scenarios. Due to some internal dependencies and compliance requirements, a few features haven't been released publicly yet. But I believe as more external developers show interest in this tool, we'll accelerate the alignment between our internal and external versions.
Finally, a huge thank you to everyone following this project. We want it to keep getting better, and we hope to see more free, high-quality tools like this emerge from the community.