Open Code Review
The first open-source CI/CD quality gate built specifically for AI-generated code. Detects hallucinated imports, stale APIs, over-engineering, and security anti-patterns — powered by local LLMs and any OpenAI-compatible provider. Free. Self-hostable. 6 languages.
Works With
Any AI tool that generates code — if it writes it, OCR reviews it.
What AI Linters Miss
AI coding assistants (Copilot, Cursor, Claude) generate code with defects that traditional tools miss entirely:
| Defect | Example | ESLint / SonarQube |
|---|---|---|
| Hallucinated imports | import { x } from 'non-existent-pkg' | ❌ Miss |
| Stale APIs | Using deprecated APIs from training data | ❌ Miss |
| Context window artifacts | Logic contradictions across files | ❌ Miss |
| Over-engineered patterns | Unnecessary abstractions, dead code | ❌ Miss |
| Security anti-patterns | Hardcoded example secrets, eval() | ❌ Partial |
Open Code Review detects all of them — across 6 languages, for free.
Demo
📄 View full interactive HTML report
Quick Preview
$ ocr scan src/ --sla L3
╔══════════════════════════════════════════════════════════════╗
║ Open Code Review — Deep Scan Report ║
╚══════════════════════════════════════════════════════════════╝
Project: packages/core/src
SLA: L3 Deep — Structural + Embedding + LLM Analysis
112 issues found in 110 files
Overall Score: 67/100 D
Threshold: 70 | Status: FAILED
Files Scanned: 110 | Languages: typescript | Duration: 12.3s
Deep Scan (L3) — How It Works
L3 combines three analysis layers for maximum coverage:
Layer 1: Structural Detection Layer 2: Semantic Analysis Layer 3: LLM Deep Scan
├── Hallucinated imports (npm/PyPI) ├── Embedding similarity recall ├── Cross-file coherence check
├── Stale API detection ├── Risk scoring ├── Logic bug detection
├── Security patterns ├── Context window artifacts ├── Confidence scoring
├── Over-engineering metrics └── Enhanced severity ranking └── AI-powered fix suggestions
└── A+ → F quality scoring
Powered by local LLMs or any OpenAI-compatible API. Run Ollama for 100% local analysis, or connect to any remote LLM provider — the interface is the same.
# Local analysis (Ollama)
ocr scan src/ --sla L3 --provider ollama --model qwen3-coder
# Any OpenAI-compatible provider
ocr scan src/ --sla L3 --provider openai-compatible \
--api-base https://your-llm-endpoint/v1 --model your-model --api-key YOUR_KEY
AI Auto-Fix — ocr heal
Let AI automatically fix the issues it finds. Review changes before applying.
# Preview fixes without changing files
ocr heal src/ --dry-run
# Apply fixes + generate IDE rules
ocr heal src/ --provider ollama --model qwen3-coder --setup-ide
# Only generate IDE rules (Cursor, Copilot, Augment)
ocr setup src/
Multi-Language Detection
Language-specific detectors for 6 languages, plus hallucinated package databases (npm, PyPI, Maven, Go modules):
| Language | Specific Detectors |
|---|---|
| TypeScript / JavaScript | Hallucinated imports (npm), stale APIs, over-engineering |
| Python | Bare except, eval(), mutable default args, hallucinated imports (PyPI) |
| Java | System.out.println leaks, deprecated Date/Calendar, hallucinated imports (Maven) |
| Go | Unhandled errors, deprecated ioutil, panic in library code |
| Kotlin | !! abuse, println leaks, null-safety anti-patterns |
How It Compares
| Open Code Review | Claude Code Review | CodeRabbit | GitHub Copilot | |
|---|---|---|---|---|
| Price | Free | $15–25/PR | $24/mo/seat | $10–39/mo |
| Open Source | ✅ | ❌ | ❌ | ❌ |
| Self-hosted | ✅ | ❌ | Enterprise | ❌ |
| AI Hallucination Detection | ✅ | ❌ | ❌ | ❌ |
| Stale API Detection | ✅ | ❌ | ❌ | ❌ |
| Deep LLM Analysis | ✅ | ❌ | ❌ | ❌ |
| AI Auto-Fix | ✅ | ❌ | ❌ | ❌ |
| Multi-Language | ✅ 6 langs | ❌ | JS/TS | JS/TS |
| Registry Verification | ✅ npm/PyPI/Maven | ❌ | ❌ | ❌ |
| Unicode Security Detection | ✅ | ❌ | ❌ | ❌ |
| SARIF Output | ✅ | ❌ | ❌ | ❌ |
| GitHub + GitLab | ✅ Both | GitHub only | Both | GitHub only |
| Data Privacy | ✅ 100% local | ❌ Cloud | ❌ Cloud | ❌ Cloud |
Quick Start
# Install
npm install -g @opencodereview/cli
# Fast scan — no AI needed
ocr scan src/
# Deep scan — with local LLM (Ollama)
ocr scan src/ --sla L3 --provider ollama --model qwen3-coder
# Deep scan — with any OpenAI-compatible provider
ocr scan src/ --sla L3 --provider openai-compatible \
--api-base https://your-provider/v1 --model your-model --api-key YOUR_KEY
CI/CD Integration
GitHub Actions (30 seconds)
name: Code Review
on: [pull_request]
jobs:
review:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: raye-deng/open-code-review@v1
with:
sla: L1
threshold: 60
github-token: ${{ secrets.GITHUB_TOKEN }}
GitLab CI
code-review:
script:
- npx @opencodereview/cli scan src/ --sla L1 --threshold 60 --format json --output ocr-report.json
artifacts:
reports:
codequality: ocr-report.json
Output Formats
ocr scan src/ --format terminal # Pretty terminal output
ocr scan src/ --format json # JSON for CI pipelines
ocr scan src/ --format sarif # SARIF for GitHub Code Scanning
ocr scan src/ --format html # Interactive HTML report
Configuration
# .ocrrc.yml
sla: L3
ai:
embedding:
provider: ollama
model: nomic-embed-text
baseUrl: http://localhost:11434
llm:
provider: ollama
model: qwen3-coder
endpoint: http://localhost:11434
# Or use any OpenAI-compatible provider:
# provider: openai-compatible
# apiBase: https://your-llm-endpoint/v1
# model: your-model
MCP Server — Use in Claude Desktop, Cursor, Windsurf
Integrate Open Code Review directly into your AI IDE via the Model Context Protocol:
npx @opencodereview/mcp-server
Claude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"open-code-review": {
"command": "npx",
"args": ["-y", "@opencodereview/mcp-server"]
}
}
}
Cursor / Windsurf / VS Code Copilot: Add the same configuration in your MCP settings.
Available MCP Tools: ocr_scan (quality gate scan), ocr_heal (AI auto-fix), ocr_explain (issue explanation).
💡 Chrome DevTools MCP Compatible: The OCR MCP Server follows the standard Model Context Protocol. Pair it with Google's Chrome DevTools MCP Server for a complete AI-native dev workflow — one inspects your running app, the other inspects your source code.
Project Structure
packages/
core/ # Detection engine + scoring (@opencodereview/core)
cli/ # CLI tool — ocr command (@opencodereview/cli)
mcp-server/ # MCP Server for AI IDEs (@opencodereview/mcp-server)
github-action/ # GitHub Action wrapper
Who Is This For?
- Teams using AI coding assistants — Copilot, Cursor, Claude Code, Codex, or any LLM-based tool that generates production code
- Open-source maintainers — Review AI-generated PRs for hallucinated imports, stale APIs, and security anti-patterns before merging
- DevOps / Platform engineers — Add a quality gate to CI/CD pipelines without sending code to cloud services
- Security-conscious teams — Run everything locally (Ollama), keep your code on your machines
- Solo developers — Free, fast, and works with zero configuration (
npx @opencodereview/cli scan src/)
Featured On
License
BSL-1.1 — Free for personal and non-commercial use. Converts to Apache 2.0 on 2030-03-11. Commercial use requires a Team or Enterprise license.
Star this repo if you find it useful — it helps more than you think!