Alibaba Open Code Review - Setup Guide¶

Source: alibaba/open-code-review GitHub: alibaba/open-code-review Skills: 2 skills · 4.3K total installs Category: Code Review First Seen: catalogued August 16, 2026 sweep (open-code-review on skills.sh since May 29, 2026) Quality Tier: 🟡 Trusted - official Alibaba org; top skill carries a Snyk Fail (see Limitations)

Alibaba's open-code-review (ocr) is an open-source AI code review CLI that reads Git diffs and produces structured, line-level review comments - a machine-reviewable format that plugs into PR pipelines. The skill wraps the CLI with environment verification and review workflows.

Installation¶

npx skills add alibaba/open-code-review

Individual skills install with the explicit repo form:

npx skills add https://github.com/alibaba/open-code-review --skill open-code-review

Prerequisites¶

Requirement	Details
Node.js + npx	For the skill installer
ocr CLI	Install the `ocr` binary (skill walks through setup)
LLM connectivity	Verified with `ocr llm test` before any review

What It Provides¶

Skill	Installs	Purpose
open-code-review	3.5K	Core review workflow: reads Git diffs, generates line-level comments, reports findings
open-code-review-delegate	784	Delegation pattern for multi-agent review

The skill's environment check runs first (which ocr, then ocr llm test) and blocks review if the CLI or LLM link is down - a verification discipline consistent with our own pre-flight gates.

Quick Start¶

Install: npx skills add alibaba/open-code-review
Verify environment: which ocr && ocr llm test
Ask: "review this branch's diff with open-code-review and format findings as PR comments"

CorpusIQ Use Cases¶

Use Case	How
PR security gate	A second, independent review path alongside our existing review workflow
Diff-level review	Line-level structured comments integrate cleanly with GitHub review UIs
Multi-agent review	open-code-review-delegate as a review sub-agent pattern

Integration with CorpusIQ¶

CorpusIQ is the connector layer that lets AI assistants read the systems a business already runs on - accounting, payments, CRM, email, files and analytics - and answer with the source named. It is read-only by design: it retrieves data and never writes to, or acts in, a connected system, which is what makes it safe to point at live accounts.

This page is part of the CorpusIQ directory, the reference we maintain for the MCP server and agent-skill ecosystem. Run alongside CorpusIQ, a third-party server like this one can be combined with a company's own business data in a single answer.

See what CorpusIQ connects

Limitations / Verification¶

Security audits on open-code-review: Gen Agent Trust Hub Pass, Socket Pass, Snyk Fail - trusted with the Snyk finding named; review the dependency surface before production use
Publisher-page install counts verified (3.5K + 784); GitHub 20.5K stars on the repo
Requires external LLM connectivity configured for the ocr CLI
Two-skill suite; delegate skill is sub-1K installs

npx skills add alibaba/open-code-review   # verify install works

Powered by CorpusIQ