What it actually does
This started as Alibaba Group's internal AI code review assistant. Over two years it served tens of thousands of developers and identified millions of defects before being open sourced, which is a rather different provenance from most tools in this category.
The architecture is hybrid on purpose. Deterministic pipelines catch the things rules catch reliably — null pointer exceptions, thread-safety problems, XSS, SQL injection — across a built-in multi-language ruleset. An LLM agent with tool use handles everything that needs judgement: it reads full file contents, searches the codebase, and inspects other changed files for context rather than reviewing a diff in isolation.
Output is structured review comments with line-level precision. Beyond diff review, `ocr scan` reviews entire files, which is how you audit an unfamiliar codebase or a directory that has no meaningful diff.
It is a Go CLI, Apache 2.0, and works with any OpenAI or Anthropic compatible endpoint. Notably it has a low open-issue count relative to its size, which suggests active maintenance.
Who it's for
- 01
Teams where review is the bottleneck and PRs sit for days
- 02
Engineering leaders who want a consistent security baseline enforced on every change
- 03
Anyone inheriting an unfamiliar codebase who needs a map of where the risk is
- 04
Teams that want deterministic rules for known bug classes rather than an LLM guessing
Where it earns its keep
- Automated first-pass review on every pull request before a human looks
- Auditing a codebase you just acquired or inherited with a full-file scan
- Enforcing a security ruleset consistently rather than depending on who reviews
- Giving junior engineers fast feedback without occupying a senior reviewer
- Catching injection and thread-safety classes that reviewers routinely miss
Use it, or skip it
Reach for it when
- Review latency is slowing your delivery more than review quality is
- You want deterministic checks and LLM judgement, not one or the other
- Multi-language repos need one consistent reviewer
- You need repository-level context, not isolated diff commentary
Skip it when
- You expect it to replace human review entirely — it is a first pass, not a sign-off
- Your codebase is in a language outside its built-in ruleset, where value drops sharply
- You cannot send code to a model endpoint for policy reasons and have no local option
- Your team is two people who already review everything within the hour
10 automations
Ideas, not tutorials. Each one is work a team does by hand today.
- 01Engineering
Pre-human PR pass
Run on every pull request so the human reviewer starts from a triaged list instead of a raw diff.
- 02Engineering
Inherited codebase audit
Run a full scan across an acquired repo and produce a prioritised risk register before anyone commits to a rewrite.
- 03Engineering
Security regression gate
Fail CI when a change introduces an injection or thread-safety finding above your severity threshold.
- 04Operations
Reviewer load report
Track how many findings were caught automatically versus by humans, and rebalance who reviews what.
- 05Operations
Onboarding feedback loop
Give new engineers immediate structured review on their first PRs without tying up a senior for a week.
- 06Engineering
Weekly code health digest
Summarise recurring defect classes across the week and turn the top pattern into a team-wide lint rule.
- 07Sales
Customer security evidence
Produce a summary of automated review coverage to attach to enterprise security questionnaires.
- 08Engineering
Legacy directory triage
Scan directories nobody has touched in a year to decide what to refactor, document, or delete.
- 09Operations
Release readiness check
Before a release branch is cut, scan the accumulated diff and post a go/no-go summary to the release channel.
- 10Engineering
Ruleset tuning loop
Track which findings engineers dismiss as false positives and tune the ruleset so signal stays high.
Want one of these running by Friday?
LimeDock builds these as real workflows inside your stack — deployed to your cloud, wired into your Slack and CRM, with the code in your repo. You pay a build fee and your own API keys, nothing else.
Source
Repository stats were read from the GitHub API and reflect the last time we refreshed this entry. The editorial breakdown above is LimeDock’s own analysis — we are not affiliated with alibaba.
https://github.com/alibaba/open-code-review