I found the code review tool Alibaba has been using internally for 2 years before open-sourcing it.
It's called Open Code Review. 3.9K GitHub stars and climbing.
Here's the part that got my attention:
Most AI code review tools send your diff to an LLM and let the model figure everything out. File selection, line matching, coverage, all of it.
The problem is LLMs cut corners on large changesets. They report wrong line numbers. Their output quality changes with minor prompt variations.
Alibaba's approach splits the work:
→ Deterministic pipelines handle file selection, bundling related files together, line-number positioning, and rule routing
→ The LLM agent handles risk detection, context exploration, and issue classification
→ Each file bundle runs as a sub-agent with isolated context
The agent can read full file contents, search the codebase, and inspect other changed files. But it never decides which files to review. That's handled by engineering logic that doesn't hallucinate.
Built-in rulesets catch NPE, thread-safety issues, XSS, and SQL injection out of the box.
Install globally with npm, or add it as a Claude Code / Codex skill.
Open source. Free.