Open Code Review Tutorial: Alibaba Open-Sourced Their Internal Code Reviewer

Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.

Original language: English

Original video: Open Code Review Tutorial: Alibaba Open-Sourced Their Internal Code Reviewer · Channel: Fahd Mirza · 08:26 · Watch on YouTube

Topics: AI agents, Software engineering with AI, AI developer tools, Markets and economy

Summary

Alibaba’s Open Code Review (OCR) is an AI code-review tool that the video presents as having been used internally for two years and now being publicly available. The tutorial explains its hybrid architecture: deterministic engineering selects files, bundles context, matches rules, and positions comments, while an AI agent reasons about the code. The presenter installs and configures OCR, tests it on a FastAPI app with an intentionally introduced SQL bug, and walks through its review output. He also demonstrates integrating OCR with Open Code and notes that it can work with other coding harnesses.

Key points

OCR is described as an internal Alibaba tool that has reviewed code for tens of thousands of developers and found millions of defects.
Its hybrid architecture uses deterministic steps for file selection, bundling, rule matching, and comment positioning, leaving reasoning to the agent.
The presenter cites Alibaba’s shared benchmark of 200 PRs across 50 repositories, where OCR reportedly beat Claude Code on precision and F1 using the same model and about one ninth of the tokens, with lower recall as a trade-off.
The installation requires Node.js; the presenter installs OCR through NPM and configures a model provider.
In preview mode, OCR identifies changed files and confirms they are in scope without making an LLM call.
For a small change, OCR skips the planning phase and searches the codebase for surrounding context rather than reviewing only the diff.
The demo review finds multiple SQL-related issues and provides a suggested fix as a diff.
The presenter integrates OCR with Open Code using a plugin, installs runtime dependencies, and verifies the connection with a health check.
The video says OCR can also be used with other harnesses, including Code X and Claude Code.

Chapters

Start	Chapter	Summary
00:01	Introduction and OCR architecture	The presenter introduces Alibaba’s Open Code Review and explains its hybrid approach and claimed benchmark results.
02:09	Installation and model setup	He installs OCR on Ubuntu and configures it with a model provider, switching from Alibaba’s API to DeepSeek.
03:10	Testing OCR on a SQL bug	The presenter runs a preview and full review on a FastAPI app, explaining how OCR gathers context and reports issues.
06:51	Open Code integration and wrap-up	He installs the Open Code plugin, checks the model connection, and describes running OCR on a workspace.

Quotes

The fix is a hybrid. — 01:05

Lower recall is the trade-off, by the way. — 01:37

This is a deterministic layer. Um no LLM call yet. — 04:14

It is not just staring at diff in isolation. — 05:49

Concepts and entities

Open Code Review, Alibaba, Claude Code, OpenCode, DeepSeek, Node.js, Fahd Mirza, Engenharia determinística

Full transcript (original language)

00:01 Lately, Alibaba has become very generous. They have been open-sourcing their internal tooling like a rain in the desert. Alibaba just open-sourced their internal AI code review tool, Open Code Review. This thing has been running inside Alibaba for 2 years, reviewing the code for tens of thousands of their own developers, and it’s found millions of defects. Now, it’s public. You can use it today under two license. In this

00:33 video, we are going to install it. I’m going to do a hands-on demo on a real repo, plus how to get it integrated with Open Code. This is Fahad Mirza, and I welcome you to the channel. Recently, I also have started this free weekly AI newsletter, which you can subscribe at fahadmirza.substack.com. Coming back to this tool, first, let’s try to understand what exactly is happening under the hood. What makes this tool different from just pointing Claude Code at a diff is the

01:05 architecture, as you can see on your screen. Most general-purpose agents doing code review hit three major problems. They skip files on large change sets, the line numbers drift from the actual issue, and quality swings depending on how the prompts worded. Open Code Review, or OCR in short, the fix is a hybrid. Deterministic engineering handles file selection, bundling, rule matching, and comment

01:37 positioning, while the agent only handles the reasoning part. On their own benchmark, which they have shared, 200 PRs across 50 repos, they are beating Claude Code on precision and F1 with the same underlying model using about a ninth of of tokens. Lower recall is the trade-off, by the way. Let’s get it installed and then we will go from there. And if you want to help out the channel, please become a member. So, this is my Ubuntu system where I

02:09 already have a node installed because that is one of the prerequisites. Let me get it installed through NPM and then we will also display its version. It is quite a lightweight tool, so it shouldn’t take too long to get installed. Installation is done in a few seconds. Now, let’s configure the model. So, I’m just going to configure provider with this command, OCR config provider, and then you can select provider of your choice.

02:40 So, for this one, I’ll just go with Alibaba’s own dash scope API. So, I have just selected it. Let’s go with 23.8 max. And that is also done. Let me paste my API key. My dash scope Alibaba key was not working, so I have just gone with DeepSeek. And by the way, just a digression, I think Alibaba really needs to improve this API key fiasco. They have Quan Cloud, they have dash scope API, they have some AliYun, and

03:10 then they have token plan. There are, you know, heaps of options. It’s so confusing, and the keys are really not compatible. Anyway, so now our OCR is configured with the model. Let’s move forward. And now it’s the time to test this tool. I have got this small fast API app for validating iron ore shipment prices. So, if you look at the line 123, I I have just introduced a subtle SQL bug into it, and I’m going to let open code

03:42 review catch this. There are no, um, you know, sort of comments or anything. I’m just even going to remove this line. It doesn’t tell us anything, but I’ll just remove it. Saved it, so there are no comments whatsoever. And this is a bug now on line 120. So, I’ll just go here. First, I will show you the Git diff, and then I will use this OCR review in preview mode. There you go. You see, it has got the bug, and then it has

04:14 given me the information because it is also checking the last commit. So, this is a deterministic layer. Um no LLM call yet. It It is just showing which files it detected as changed, and confirming they’re in scope for review. Now, let’s let me do the actual review without any preview. So, let’s wait for it to come back, and I will explain what is happening. You see, it is reading file by file.

04:47 And this is the whole output. Allow me 2 minutes while I go line by line in very short and simple words to explain what is happening because this is very crucial. So, look. Just check out from the top. You can see that it says one file changed, reviewing it. So, it found our one edit, and confirmed it’s in scope. That’s the deterministic file selection layer doing its job before any AI gets involved. Then it says skipping plan phase because for tiny changes like a seven-line diff,

05:18 OCR doesn’t bother with a whole planning step. It just gets straight to reviewing, which saves time and tokens on small stuff, and that is one intelligence of this tool. And then comes the tool calls. You see, there are a lot of tool calls like code search, file read, code commit. This is the agent actually working. It is searching the code base for price bands, reading chunks of main.py at different line ranges, even pulling in the readme for context. This is the agent handling reasoning and repo context part from our

05:49 article architecture diagram. It is not just staring at diff in isolation. It is going and understanding the surrounding code and that is the flagship feature in my humble opinion. If I just keep coming down, if you look at this around two by two, it does up to two passes by default and stopped early once the second pass didn’t find anything in new. So, very efficient. And then it has given us this summary line which you know, you can see that it says one

06:20 file reviewed, one comment, about 53,000 tokens used, 25 seconds and that is the real cost of review like this. And then it has given us this actual finding where it didn’t just catch the typo we obviously planted. It caught also two separate problems like you know, column name data text exists then then it also noticed that we stuck in inner join instead of left join and reason from docstring. So, look, this is a real logic bug, not just a typo and it has

06:51 given us the exact fix as a diff at the bottom. There you go. So, how good is that? Very very nifty tool. I think I’m definitely going to make it my usual stuff. Let me now quickly show you how to integrate it with open code. So, I already have open code installed and by the way, you can also do it with code X and cloud code and few other harnesses. Next up, I’m just going to get the plugin for OCR for open code. Everything works as a plugin or external stuff. So, you can

07:23 see it is already downloaded. Next up, I’m just going to install some dependencies for the runtime. And that should take a second. That’s done. And now you can launch your open code. And this is my open code currently configured with DeepSeek. And you can do a quick health check like I just gave {slash} OCR health and it is telling me that open code review is running this with a successful connection to the DeepSeek model.

07:55 And if you have any workspace or something, you can simply just go and say, “Okay, just go and review the current workspace.” And whatever is in your current workspace, you can go uh and it is going to check it out. And of course, I’m not in the Git repo where I could check it out. So, but if you have open code in pointing to your GitHub repo or Git repo or whatever, it is going to check it out and give you the same result which I showed you earlier. Something like this as you can see, I have just given it um that repo and then

08:26 it has given me this result which is similar to what we saw earlier. One interesting point is that you might see these Chinese characters creeping in here and there. Remember, this is their internal tool which they have shared with us. So, look, that’s it. Let me know what do you think about this tool. I will drop the link to it in video’s description. Again, if you want to help out the channel, please become a member and don’t forget to subscribe to this newsletter. Thank you for all the support.