Skip to main content
Glama
Sign In
open-code-review

open-code-review

by raye-deng
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

Open Code Review

The first open-source CI/CD quality gate built specifically for AI-generated code. Detects hallucinated imports, stale APIs, over-engineering, and security anti-patterns — powered by local LLMs and any OpenAI-compatible provider. Free. Self-hostable. 6 languages.

Open Code Review

npm version npm version npm downloads License: BUSL-1.1 CI GitHub Stars PRs Welcome

Works With

Cursor GitHub Copilot Claude Code Windsurf Codex Augment Code Supermaven Aider

Any AI tool that generates code — if it writes it, OCR reviews it.

Related MCP server: guardvibe

What AI Linters Miss

AI coding assistants (Copilot, Cursor, Claude) generate code with defects that traditional tools miss entirely:

Defect

Example

ESLint / SonarQube

Hallucinated imports

import { x } from 'non-existent-pkg'

❌ Miss

Stale APIs

Using deprecated APIs from training data

❌ Miss

Context window artifacts

Logic contradictions across files

❌ Miss

Over-engineered patterns

Unnecessary abstractions, dead code

❌ Miss

Security anti-patterns

Hardcoded example secrets, eval()

❌ Partial

Open Code Review detects all of them — across 6 languages, for free.

Demo

L2 HTML Report Screenshot

📄 View full interactive HTML report

Quick Preview

$ ocr scan src/ --sla L3

╔══════════════════════════════════════════════════════════════╗
║           Open Code Review — Deep Scan Report               ║
╚══════════════════════════════════════════════════════════════╝

  Project: packages/core/src
  SLA: L3 Deep — Structural + Embedding + LLM Analysis

  112 issues found in 110 files

  Overall Score: 67/100  D
  Threshold: 70  |  Status: FAILED
  Files Scanned: 110  |  Languages: typescript  |  Duration: 12.3s

Deep Scan (L3) — How It Works

L3 combines three analysis layers for maximum coverage:

Layer 1: Structural Detection         Layer 2: Semantic Analysis        Layer 3: LLM Deep Scan
├── Hallucinated imports (npm/PyPI)   ├── Embedding similarity recall   ├── Cross-file coherence check
├── Stale API detection               ├── Risk scoring                  ├── Logic bug detection
├── Security patterns                 ├── Context window artifacts      ├── Confidence scoring
├── Over-engineering metrics          └── Enhanced severity ranking     └── AI-powered fix suggestions
└── A+ → F quality scoring

Powered by local LLMs or any OpenAI-compatible API. Run Ollama for 100% local analysis, or connect to any remote LLM provider — the interface is the same.

# Local analysis (Ollama)
ocr scan src/ --sla L3 --provider ollama --model qwen3-coder

# Any OpenAI-compatible provider
ocr scan src/ --sla L3 --provider openai-compatible \
  --api-base https://your-llm-endpoint/v1 --model your-model --api-key YOUR_KEY

AI Auto-Fix — ocr heal

Let AI automatically fix the issues it finds. Review changes before applying.

# Preview fixes without changing files
ocr heal src/ --dry-run

# Apply fixes + generate IDE rules
ocr heal src/ --provider ollama --model qwen3-coder --setup-ide

# Only generate IDE rules (Cursor, Copilot, Augment)
ocr setup src/

Multi-Language Detection

Language-specific detectors for 6 languages, plus hallucinated package databases (npm, PyPI, Maven, Go modules):

Language

Specific Detectors

TypeScript / JavaScript

Hallucinated imports (npm), stale APIs, over-engineering

Python

Bare except, eval(), mutable default args, hallucinated imports (PyPI)

Java

System.out.println leaks, deprecated Date/Calendar, hallucinated imports (Maven)

Go

Unhandled errors, deprecated ioutil, panic in library code

Kotlin

!! abuse, println leaks, null-safety anti-patterns

How It Compares

Open Code Review

Claude Code Review

CodeRabbit

GitHub Copilot

Price

Free

$15–25/PR

$24/mo/seat

$10–39/mo

Open Source

✅

❌

❌

❌

Self-hosted

✅

❌

Enterprise

❌

AI Hallucination Detection

✅

❌

❌

❌

Stale API Detection

✅

❌

❌

❌

Deep LLM Analysis

✅

❌

❌

❌

AI Auto-Fix

✅

❌

❌

❌

Multi-Language

✅ 6 langs

❌

JS/TS

JS/TS

Registry Verification

✅ npm/PyPI/Maven

❌

❌

❌

Unicode Security Detection

✅

❌

❌

❌

SARIF Output

✅

❌

❌

❌

GitHub + GitLab

✅ Both

GitHub only

Both

GitHub only

Data Privacy

✅ 100% local

❌ Cloud

❌ Cloud

❌ Cloud

Quick Start

# Install
npm install -g @opencodereview/cli

# Fast scan — no AI needed
ocr scan src/

# Deep scan — with local LLM (Ollama)
ocr scan src/ --sla L3 --provider ollama --model qwen3-coder

# Deep scan — with any OpenAI-compatible provider
ocr scan src/ --sla L3 --provider openai-compatible \
  --api-base https://your-provider/v1 --model your-model --api-key YOUR_KEY

CI/CD Integration

GitHub Actions (30 seconds)

name: Code Review
on: [pull_request]

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: raye-deng/open-code-review@v1
        with:
          sla: L1
          threshold: 60
          github-token: ${{ secrets.GITHUB_TOKEN }}

GitLab CI

code-review:
  script:
    - npx @opencodereview/cli scan src/ --sla L1 --threshold 60 --format json --output ocr-report.json
  artifacts:
    reports:
      codequality: ocr-report.json

Output Formats

ocr scan src/ --format terminal    # Pretty terminal output
ocr scan src/ --format json        # JSON for CI pipelines
ocr scan src/ --format sarif       # SARIF for GitHub Code Scanning
ocr scan src/ --format html        # Interactive HTML report

Configuration

# .ocrrc.yml
sla: L3
ai:
  embedding:
    provider: ollama
    model: nomic-embed-text
    baseUrl: http://localhost:11434
  llm:
    provider: ollama
    model: qwen3-coder
    endpoint: http://localhost:11434

  # Or use any OpenAI-compatible provider:
  # provider: openai-compatible
  # apiBase: https://your-llm-endpoint/v1
  # model: your-model

MCP Server — Use in Claude Desktop, Cursor, Windsurf

Integrate Open Code Review directly into your AI IDE via the Model Context Protocol:

npx @opencodereview/mcp-server

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "open-code-review": {
      "command": "npx",
      "args": ["-y", "@opencodereview/mcp-server"]
    }
  }
}

Cursor / Windsurf / VS Code Copilot: Add the same configuration in your MCP settings.

Available MCP Tools: ocr_scan (quality gate scan), ocr_heal (AI auto-fix), ocr_explain (issue explanation).

💡 Chrome DevTools MCP Compatible: The OCR MCP Server follows the standard Model Context Protocol. Pair it with Google's Chrome DevTools MCP Server for a complete AI-native dev workflow — one inspects your running app, the other inspects your source code.

Project Structure

packages/
  core/              # Detection engine + scoring (@opencodereview/core)
  cli/               # CLI tool — ocr command (@opencodereview/cli)
  mcp-server/        # MCP Server for AI IDEs (@opencodereview/mcp-server)
  github-action/     # GitHub Action wrapper

Who Is This For?

  • Teams using AI coding assistants — Copilot, Cursor, Claude Code, Codex, or any LLM-based tool that generates production code

  • Open-source maintainers — Review AI-generated PRs for hallucinated imports, stale APIs, and security anti-patterns before merging

  • DevOps / Platform engineers — Add a quality gate to CI/CD pipelines without sending code to cloud services

  • Security-conscious teams — Run everything locally (Ollama), keep your code on your machines

  • Solo developers — Free, fast, and works with zero configuration (npx @opencodereview/cli scan src/)

Featured On

License

BSL-1.1 — Free for personal and non-commercial use. Converts to Apache 2.0 on 2030-03-11. Commercial use requires a Team or Enterprise license.

Star this repo if you find it useful — it helps more than you think!

Available Tools

4 tools
explain_issueC

Explain a code quality issue detected by OCR. Returns detailed explanation, category context, and fix guidance for the AI agent to act on.

Inputs: issue (required), file, line, severity, +2 more.

heal_codeC

Load a file's source code and prepare a repair prompt for the AI agent. The agent (you) should then apply the fix based on the issue description and suggestion. Returns the file content along with the repair context.

Inputs: path (required), issue (required), suggestion.

scan_diffA

Scan git diff between two branches for code quality issues. Ideal for PR/MR review — only analyzes changed files and lines.

Inputs: base (required), head (required), path (required), level.

scan_directoryB

Scan a directory for AI-generated code quality issues. Detects hallucinated imports, phantom packages, stale APIs, security anti-patterns, and more. Supports TypeScript, JavaScript, Python, Java, Go, and Kotlin.

Inputs: path (required), level, languages.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

    TDQS

    A3.5/5.0

    Scored across 4 tools

    Disambiguation5/5

    Each tool has a clearly distinct purpose with no overlap: explain_issue provides explanations, heal_code prepares repair prompts, scan_diff analyzes git diffs, and scan_directory scans directories. The descriptions clearly differentiate their functions, making misselection unlikely.

    Naming Consistency5/5

    All tool names follow a consistent verb_noun pattern (explain_issue, heal_code, scan_diff, scan_directory) with clear, descriptive verbs that match their actions. There are no deviations in naming conventions.

    Tool Count4/5

    Four tools are reasonable for a code review server, covering explanation, repair, diff scanning, and directory scanning. It's slightly lean but well-scoped, as each tool serves a distinct function without redundancy.

    Completeness4/5

    The tool set covers key code review workflows: scanning (diff and directory), explaining issues, and preparing repairs. Minor gaps might include tools for applying fixes directly or managing review states, but the core functionality is well-covered for the domain.

    Maintenance

    ActivityInactive
    ResponsivenessOutdated data

    Resources

    Related MCP Connectors

    Related MCP Servers

    • mcp-skylos

      duriantaco
      A
      license
      A
      quality
      A
      maintenance
      Skylos MCP server exposes static analysis as tools for AI coding agents — scan any Python, TypeScript, or Go codebase for dead code, security vulnerabilities, and quality issues directly from Claude, Cursor, or any MCP-compatible client. Returns findings with file paths, line numbers, and severity so agents can auto-fix issues in context.
      17
      15,924 PyPI
      895
      Apache 2.0

    • guardvibe

      goklab
      A
      license
      B
      quality
      B
      maintenance
      Security MCP server with 300+ rules for AI-generated code. Scans Next.js, Supabase, Clerk, Stripe, Prisma, Hono, GraphQL and 20+ modules. Zero config, runs locally.
      39
      2,157 npm
      6
      Apache 2.0

    • Argus MCP

      lokafinnsw
      A
      license
      Not graded
      quality
      C
      maintenance
      Enables AI-powered, zero-trust code review with multiple models, supporting single files, git diffs, and multiple files, with security, performance, and architecture checks across 10+ languages.
      15
      MIT