alibaba/open-code-review in Claude Code: two ways to review

What Flowy indexes here

alibaba/open-code-review is the open source release of Alibaba's internal AI code review tool, OpenCodeReview (OCR for short), which ships as the ocr binary. The full repository also carries a GitHub Action, a VS Code extension, and a documentation site, none of which Flowy indexes. What Flowy indexes is the slice built to run inside Claude Code: 2 skills and 5 commands, 7 components in total, out of a repository carrying 19,790 GitHub stars.

Two ways to review: OCR's model, or yours

Both skills point an agent at the same CLI, but they split on who supplies the reasoning that reads the diff.

open-code-review runs the CLI's own review mode. It calls a separately configured LLM (Anthropic or an OpenAI-compatible endpoint), reads the diff, and returns comments tagged with a severity (critical, high, medium, low) and a category such as bug, security, or performance. Claude Code then keeps the medium-and-up comments, drops the low ones as likely noise, and applies fixes when asked.

open-code-review-delegate flips that around. Nothing on the CLI side calls an LLM at all: it only handles the deterministic part, working out which files changed and which review rule applies to each one, then hands that back as a preview and a rule list. Claude itself reads every diff and writes the actual review. It suits a team that does not want to configure or pay for a second model, since all the reasoning runs on whichever model is already driving the session.

What the five commands actually do

Two of the five commands, open-code-review and review, run the identical workflow: start a review, keep the High and Medium comments, drop the Low ones, and auto-apply the fixes worth adopting. That is not accidental duplication: the repository's own documentation explains the plugin ships this once, as review, registered through a plugin marketplace, while copying the same command file directly into a project's command folder instead registers it as open-code-review. delegate-review is the command form of the delegation skill above, run as a one-off slash command rather than a standing skill.

The remaining two commands are not review tooling. commit summarizes the working changes, writes an English commit message, and commits. tag reads the latest tag, auto-increments the patch number unless a version is given, and creates an annotated tag summarizing every commit since.

One default worth knowing: the commands apply High and Medium fixes automatically, with no confirmation step. The two skills hold back and only fix when a request explicitly says review and fix; a plain review request gets you the comments, and nothing changes until you say so.

What the review actually checks

Both review paths resolve custom rules in the same order: a path on the command line first, then a rule file committed to the repository, then a fallback in the user's home directory, and only once all three are absent does OCR fall back to its own built-in defaults, which Alibaba's project description lists as covering null-pointer dereferences, thread-safety issues, cross-site scripting, and SQL injection.

Reviews can also take a short paragraph of business context describing what the change is supposed to accomplish, which both skills pass straight through, so a review can flag a requirement that was never implemented, not only a syntax problem. Past fifty changed lines, OCR runs an extra risk-analysis pass before the main review, trading latency for depth. On the delegate side, coverage is enforced rather than left to judgment: every previewed file must end up marked reviewed or explicitly skipped with a stated reason.

Who this is actually useful for

Anyone who has, or will install, the CLI, and would rather have Claude Code drive a run and act on the output than read a terminal or CI report by hand. Which review path to reach for comes down to one question: configure and pay for a second LLM endpoint, or let the model already driving the session reason through it directly. commit and tag stand on their own: plain git helpers that happen to live in the same repository. The same CLI also ships as a GitHub Action, with CI examples for GitHub Actions, GitLab CI, and a few other platforms, so a team already running it in CI can layer these skills and commands on top for interactive review during development.

How do I install it

Install from the listing page linked at the top of this guide. Flowy indexes what alibaba/open-code-review ships here; it does not own, bundle, or host it. commit and tag need nothing beyond git. Every other skill or command drives the CLI itself, installing it on first run if missing, and every path except open-code-review-delegate and delegate-review additionally needs an LLM endpoint configured before it can produce a review.