raye-deng/open-code-review

> **The first open-source CI/CD quality gate built specifically for AI-generated code.**
> Detects hallucinated imports, stale APIs, over-engineering, and security anti-patterns — powered by local LLMs and any OpenAI-compatible provider.
> Free. Self-hostable. 6 languages.
Works With
> Any AI tool that generates code — if it writes it, OCR reviews it.
What AI Linters Miss
AI coding assistants (Copilot, Cursor, Claude) generate code with **defects that traditional tools miss entirely**:
| Defect | Example | ESLint / SonarQube |
|--------|---------|-------------------|
| **Hallucinated imports** | import { x } from 'non-existent-pkg' | ❌ Miss |
| **Stale APIs** | Using deprecated APIs from training data | ❌ Miss |
| **Context window artifacts** | Logic contradictions across files | ❌ Miss |
| **Over-engineered patterns** | Unnecessary abstractions, dead code | ❌ Miss |
| **Security anti-patterns** | Hardcoded example secrets, eval() | ❌ Partial |
Open Code Review detects all of them — across **6 languages**, for **free**.
Demo
📄 View full interactive HTML report
Quick Preview
Deep Scan (L3) — How It Works
L3 combines three analysis layers for maximum coverage:
**Powered by local LLMs or any OpenAI-compatible API.** Run Ollama for 100% local analysis, or connect to any remote LLM provider — the interface is the same.
AI Auto-Fix — ocr heal
Let AI automatically fix the issues it finds. Review changes before applying.
Multi-Language Detection
Language-specific detectors for **6 languages**, plus hallucinated package databases (npm, PyPI, Maven, Go modules):
| Language | Specific Detectors |
|----------|-------------------|
| **TypeScript / JavaScript** | Hallucinated imports (npm), stale APIs, over-engineering |
| **Python** | Bare except, eval(), mutable default args, hallucinated imports (PyPI) |
| **Java** | System.out.println leaks, deprecated Date/Calendar, hallucinated imports (Maven) |
| **Go** | Unhandled errors, deprecated ioutil, panic in library code |
| **Kotlin** | !! abuse, println leaks, null-safety anti-patterns |
How It Compares
| | Open Code Review | Claude Code Review | CodeRabbit | GitHub Copilot |
|---|---|---|---|---|
| **Price** | **Free** | $15–25/PR | $24/mo/seat | $10–39/mo |
| **Open Source** | ✅ | ❌ | ❌ | ❌ |
| **Self-hosted** | ✅ | ❌ | Enterprise | ❌ |
| **AI Hallucination Detection** | ✅ | ❌ | ❌ | ❌ |
| **Stale API Detection** | ✅ | ❌ | ❌ | ❌ |
| **Deep LLM Analysis** | ✅ | ❌ | ❌ | ❌ |
| **AI Auto-Fix** | ✅ | ❌ | ❌ | ❌ |
| **Multi-Language** | ✅ 6 langs | ❌ | JS/TS | JS/TS |
| **Registry Verification** | ✅ npm/PyPI/Maven | ❌ | ❌ | ❌ |
| **Unicode Security Detection** | ✅ | ❌ | ❌ | ❌ |
| **SARIF Output** | ✅ | ❌ | ❌ | ❌ |
| **GitHub + GitLab** | ✅ Both | GitHub only | Both | GitHub only |
| **Data Privacy** | ✅ 100% local | ❌ Cloud | ❌ Cloud | ❌ Cloud |
Quick Start
CI/CD Integration
GitHub Actions (30 seconds)
GitLab CI
Output Formats
Configuration
MCP Server — Use in Claude Desktop, Cursor, Windsurf