Alibaba Open-Sources Its Internal Code Review Tool

Alibaba spent years running an internal code scanning tool that caught millions of vulnerabilities for tens of thousands of its developers. That tool, Open Code Review, is now fully open source.

The interesting part is how it splits the work. A benchmark on 200 pull requests says it beats Claude Code on accuracy while using about a ninth of the tokens.

What Happened

Open Code Review does not hand the whole review over to a language model. Ordinary code handles the mechanical parts: coverage, file assembly, rule matching, and working out where a comment should sit. The agent is left to do the deep part, reading and understanding the context of the repository it is reviewing.

The comparison ran across 200 pull requests taken from 50 open-source repositories. Using the same underlying model, Open Code Review scored higher on precision and F1 than Claude Code, and it got there with roughly one ninth of the token consumption.

Why It Matters

Token count is the bill, and accuracy is whether anyone trusts the result. Cutting consumption that hard while going up in accuracy is the argument for wiring the deterministic work into the tool itself and saving the model for the parts that genuinely need judgment.

That is a pattern you can copy even if you never run Alibaba's version of it.