Alibaba Open-Sources a Code Reviewer That Isn't Just an Agent

Alibaba released open-code-review under Apache 2.0 after two years of internal use — a Go tool that pairs a deterministic pipeline for file selection, bundling and rule matching with LLM agents for the judgement calls. It produces line-level comments, runs in GitHub Actions, GitLab CI and Gerrit, and ships security rules for NPE, thread-safety, XSS and SQL injection. The project’s own benchmarks claim better precision and F1 than general-purpose coding agents at roughly one-ninth the tokens; those are vendor numbers and unreproduced. The architecture is the transferable idea: let deterministic code decide what to look at, and the model decide only what it means.