Alibaba's Open Code Review Tool Ships an IntelliJ Plugin

What shipped Sept. 18

Alibaba pushed version 1.12.6 of open-code-review on Sept. 18, folding in a new IntelliJ IDEA extension that mirrors the architecture of the tool's existing VS Code plugin: a JCEF-based sidebar, the same command-line integration, and Git handling for branch, commit and workspace review modes. The release notes describe 195 tests passing across 15 suites for the new plugin, and a same-day follow-up commit renamed its JetBrains Marketplace listing because "the bare 'Open Code Review' name is already taken."

IDE extensions now cover two editors, VS Code and IntelliJ, while command-line plugins connect the tool to Claude Code, Codex, Cursor and Kimi Code, according to the project's README. Open Code Review is a Go binary called ocr that reads a Git diff, sends the changed files to a configured LLM, and writes line-level comments back onto the diff.

Deterministic pipeline, agent only where it has to be

Alibaba built Open Code Review as a hybrid: deterministic code handles file selection, bundling and rule matching, while an LLM agent handles the parts that need judgment, like deciding whether a flagged pattern is a real defect in context. The README says this design cuts token consumption to roughly one-ninth of what a general-purpose coding agent uses on the same review, and the tool ships built-in rules for null-pointer exceptions, thread-safety bugs, cross-site scripting and SQL injection across multiple languages.

The precision-for-recall trade, in Alibaba's own numbers

Metric (AACR-Bench, Alibaba's benchmark)	Open Code Review	Claude Code
Precision	33.90%	7.23%
Recall	20.00%	28.90%
Tokens per review	385,000	5,664,000

Flowtivity's write-up of the tool cites those AACR-Bench figures, run with both tools on the same Claude 4.6 Opus model, and notes the catch in Alibaba's own numbers: Claude Code found more real defects in absolute terms, "because it fired off thousands of findings," while Open Code Review's README states plainly that its "Recall is lower than general-purpose agents, a deliberate trade-off favoring precision over noise." Neither set of figures has been reproduced by a party outside Alibaba.

Flowtivity's own hands-on check was narrower: on Sept. 12, it installed the tool and built a two-file repository with a known SQL injection flaw in Go and an unescaped dangerouslySetInnerHTML call in React, and confirmed Open Code Review flagged both.

What two years of internal use didn't tell us

Alibaba says Open Code Review grew out of an internal assistant that "served tens of thousands of developers and identified millions of code defects" over two years before its public release under an Apache-2.0 license in May. Alibaba has not published what fraction of those millions were real bugs versus false positives, or what the tool's precision and recall looked like on its own internal codebase before AACR-Bench existed to measure it.

The result is a second widely starred approach, after Cloudflare's own audit skill for coding agents, to the same underlying problem: an LLM reviewing code writes too many findings to trust without a second layer to sort them. Where Cloudflare's skill adds adversarial validators that try to disprove each finding before it reaches a report, Alibaba's tool narrows what gets generated in the first place, the same design choice that shows up in Open Code Review's lower recall on AACR-Bench. Neither approach has published results from a shared, independently run benchmark, so a team choosing between them is still comparing two vendors' own scorecards, the same problem Tencent's BrowserSkill ran into when its permission model turned out to have a gap a command-line flag could skip.

Open Code Review's GitHub repository passed 36,000 stars this week; Alibaba has not disclosed how many of the tool's installs come from outside the company.