{
  "markdown": "# Open Code Review\n\n> **The first open-source CI/CD quality gate built specifically for AI-generated code.**\n> Detects hallucinated imports, stale APIs, over-engineering, and security anti-patterns — powered by local LLMs and any OpenAI-compatible provider.\n> Free. Self-hostable. 6 languages.\n\n![Open Code Review](.github/social-preview.png)\n\n[![npm version](https://img.shields.io/npm/v/@opencodereview/cli?style=flat-square&label=v2.1.0)](https://www.npmjs.com/package/@opencodereview/cli)\n[![npm version](https://img.shields.io/npm/v/@opencodereview/mcp-server?style=flat-square&label=mcp-server)](https://www.npmjs.com/package/@opencodereview/mcp-server)\n[![npm downloads](https://img.shields.io/npm/dw/@opencodereview/cli?style=flat-square)](https://www.npmjs.com/package/@opencodereview/cli)\n[![License: BUSL-1.1](https://img.shields.io/badge/License-BUSL--1.1-blue.svg)](LICENSE)\n[![CI](https://github.com/raye-deng/open-code-review/actions/workflows/ci.yml/badge.svg)](https://github.com/raye-deng/open-code-review/actions/workflows/ci.yml)\n[![GitHub Stars](https://img.shields.io/github/stars/raye-deng/open-code-review?style=social)](https://github.com/raye-deng/open-code-review)\n[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](http://makeapullrequest.com)\n\n## Works With\n\n![Cursor](https://img.shields.io/badge/Cursor-000?logo=cursor&logoColor=white&style=flat-square)\n![GitHub Copilot](https://img.shields.io/badge/GitHub_Copilot-181717?logo=githubcopilot&logoColor=white&style=flat-square)\n![Claude Code](https://img.shields.io/badge/Claude_Code-D97757?logo=anthropic&logoColor=white&style=flat-square)\n![Windsurf](https://img.shields.io/badge/Windsurf-38bdf8?style=flat-square)\n![Codex](https://img.shields.io/badge/Codex-10a37f?logo=openai&logoColor=white&style=flat-square)\n![Augment Code](https://img.shields.io/badge/Augment_Code-6C5CE7?style=flat-square)\n![Supermaven](https://img.shields.io/badge/Supermaven-F24E1E?style=flat-square)\n![Aider](https://img.shields.io/badge/Aider-333333?style=flat-square)\n\n> Any AI tool that generates code — if it writes it, OCR reviews it.\n\n## What AI Linters Miss\n\nAI coding assistants (Copilot, Cursor, Claude) generate code with **defects that traditional tools miss entirely**:\n\n| Defect | Example | ESLint / SonarQube |\n|--------|---------|-------------------|\n| **Hallucinated imports** | `import { x } from 'non-existent-pkg'` | ❌ Miss |\n| **Stale APIs** | Using deprecated APIs from training data | ❌ Miss |\n| **Context window artifacts** | Logic contradictions across files | ❌ Miss |\n| **Over-engineered patterns** | Unnecessary abstractions, dead code | ❌ Miss |\n| **Security anti-patterns** | Hardcoded example secrets, `eval()` | ❌ Partial |\n\nOpen Code Review detects all of them — across **6 languages**, for **free**.\n\n## Demo\n\n![L2 HTML Report Screenshot](docs/images/l2-html-report-screenshot.png)\n\n📄 [View full interactive HTML report](docs/demo-reports/v4-l2/self-scan.html)\n\n### Quick Preview\n\n```bash\n$ ocr scan src/ --sla L3\n\n╔══════════════════════════════════════════════════════════════╗\n║           Open Code Review — Deep Scan Report               ║\n╚══════════════════════════════════════════════════════════════╝\n\n  Project: packages/core/src\n  SLA: L3 Deep — Structural + Embedding + LLM Analysis\n\n  112 issues found in 110 files\n\n  Overall Score: 67/100  D\n  Threshold: 70  |  Status: FAILED\n  Files Scanned: 110  |  Languages: typescript  |  Duration: 12.3s\n```\n\n## Deep Scan (L3) — How It Works\n\nL3 combines three analysis layers for maximum coverage:\n\n```\nLayer 1: Structural Detection         Layer 2: Semantic Analysis        Layer 3: LLM Deep Scan\n├── Hallucinated imports (npm/PyPI)   ├── Embedding similarity recall   ├── Cross-file coherence check\n├── Stale API detection               ├── Risk scoring                  ├── Logic bug detection\n├── Security patterns                 ├── Context window artifacts      ├── Confidence scoring\n├── Over-engineering metrics          └── Enhanced severity ranking     └── AI-powered fix suggestions\n└── A+ → F quality scoring\n```\n\n**Powered by local LLMs or any OpenAI-compatible API.** Run Ollama for 100% local analysis, or connect to any remote LLM provider — the interface is the same.\n\n```bash\n# Local analysis (Ollama)\nocr scan src/ --sla L3 --provider ollama --model qwen3-coder\n\n# Any OpenAI-compatible provider\nocr scan src/ --sla L3 --provider openai-compatible \\\n  --api-base https://your-llm-endpoint/v1 --model your-model --api-key YOUR_KEY\n```\n\n## AI Auto-Fix — `ocr heal`\n\nLet AI automatically fix the issues it finds. Review changes before applying.\n\n```bash\n# Preview fixes without changing files\nocr heal src/ --dry-run\n\n# Apply fixes + generate IDE rules\nocr heal src/ --provider ollama --model qwen3-coder --setup-ide\n\n# Only generate IDE rules (Cursor, Copilot, Augment)\nocr setup src/\n```\n\n## Multi-Language Detection\n\nLanguage-specific detectors for **6 languages**, plus hallucinated package databases (npm, PyPI, Maven, Go modules):\n\n| Language | Specific Detectors |\n|----------|-------------------|\n| **TypeScript / JavaScript** | Hallucinated imports (npm), stale APIs, over-engineering |\n| **Python** | Bare `except`, `eval()`, mutable default args, hallucinated imports (PyPI) |\n| **Java** | `System.out.println` leaks, deprecated `Date/Calendar`, hallucinated imports (Maven) |\n| **Go** | Unhandled errors, deprecated `ioutil`, `panic` in library code |\n| **Kotlin** | `!!` abuse, `println` leaks, null-safety anti-patterns |\n\n## How It Compares\n\n| | Open Code Review | Claude Code Review | CodeRabbit | GitHub Copilot |\n|---|---|---|---|---|\n| **Price** | **Free** | $15–25/PR | $24/mo/seat | $10–39/mo |\n| **Open Source** | ✅ | ❌ | ❌ | ❌ |\n| **Self-hosted** | ✅ | ❌ | Enterprise | ❌ |\n| **AI Hallucination Detection** | ✅ | ❌ | ❌ | ❌ |\n| **Stale API Detection** | ✅ | ❌ | ❌ | ❌ |\n| **Deep LLM Analysis** | ✅ | ❌ | ❌ | ❌ |\n| **AI Auto-Fix** | ✅ | ❌ | ❌ | ❌ |\n| **Multi-Language** | ✅ 6 langs | ❌ | JS/TS | JS/TS |\n| **Registry Verification** | ✅ npm/PyPI/Maven | ❌ | ❌ | ❌ |\n| **Unicode Security Detection** | ✅ | ❌ | ❌ | ❌ |\n| **SARIF Output** | ✅ | ❌ | ❌ | ❌ |\n| **GitHub + GitLab** | ✅ Both | GitHub only | Both | GitHub only |\n| **Data Privacy** | ✅ 100% local | ❌ Cloud | ❌ Cloud | ❌ Cloud |\n\n## Quick Start\n\n```bash\n# Install\nnpm install -g @opencodereview/cli\n\n# Fast scan — no AI needed\nocr scan src/\n\n# Deep scan — with local LLM (Ollama)\nocr scan src/ --sla L3 --provider ollama --model qwen3-coder\n\n# Deep scan — with any OpenAI-compatible provider\nocr scan src/ --sla L3 --provider openai-compatible \\\n  --api-base https://your-provider/v1 --model your-model --api-key YOUR_KEY\n```\n\n## CI/CD Integration\n\n### GitHub Actions (30 seconds)\n\n```yaml\nname: Code Review\non: [pull_request]\n\njobs:\n  review:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: raye-deng/open-code-review@v1\n        with:\n          sla: L1\n          threshold: 60\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n```\n\n### GitLab CI\n\n```yaml\ncode-review:\n  script:\n    - npx @opencodereview/cli scan src/ --sla L1 --threshold 60 --format json --output ocr-report.json\n  artifacts:\n    reports:\n      codequality: ocr-report.json\n```\n\n### Output Formats\n\n```bash\nocr scan src/ --format terminal    # Pretty terminal output\nocr scan src/ --format json        # JSON for CI pipelines\nocr scan src/ --format sarif       # SARIF for GitHub Code Scanning\nocr scan src/ --format html        # Interactive HTML report\n```\n\n### Configuration\n\n```yaml\n# .ocrrc.yml\nsla: L3\nai:\n  embedding:\n    provider: ollama\n    model: nomic-embed-text\n    baseUrl: http://localhost:11434\n  llm:\n    provider: ollama\n    model: qwen3-coder\n    endpoint: http://localhost:11434\n\n  # Or use any OpenAI-compatible provider:\n  # provider: openai-compatible\n  # apiBase: https://your-llm-endpoint/v1\n  # model: your-model\n```\n\n## MCP Server — Use in Claude Desktop, Cursor, Windsurf\n\nIntegrate Open Code Review directly into your AI IDE via the [Model Context Protocol](https://modelcontextprotocol.io/):\n\n```bash\nnpx @opencodereview/mcp-server\n```\n\n**Claude Desktop** (`claude_desktop_config.json`):\n```json\n{\n  \"mcpServers\": {\n    \"open-code-review\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@opencodereview/mcp-server\"]\n    }\n  }\n}\n```\n\n**Cursor / Windsurf / VS Code Copilot**: Add the same configuration in your MCP settings.\n\n**Available MCP Tools**: `ocr_scan` (quality gate scan), `ocr_heal` (AI auto-fix), `ocr_explain` (issue explanation).\n\n> 💡 **Chrome DevTools MCP Compatible**: The OCR MCP Server follows the standard [Model Context Protocol](https://modelcontextprotocol.io/). Pair it with Google's [Chrome DevTools MCP Server](https://developer.chrome.com/docs/devtools/mcp) for a complete AI-native dev workflow — one inspects your running app, the other inspects your source code.\n\n## Project Structure\n\n```\npackages/\n  core/              # Detection engine + scoring (@opencodereview/core)\n  cli/               # CLI tool — ocr command (@opencodereview/cli)\n  mcp-server/        # MCP Server for AI IDEs (@opencodereview/mcp-server)\n  github-action/     # GitHub Action wrapper\n```\n\n## Who Is This For?\n\n- **Teams using AI coding assistants** — Copilot, Cursor, Claude Code, Codex, or any LLM-based tool that generates production code\n- **Open-source maintainers** — Review AI-generated PRs for hallucinated imports, stale APIs, and security anti-patterns before merging\n- **DevOps / Platform engineers** — Add a quality gate to CI/CD pipelines without sending code to cloud services\n- **Security-conscious teams** — Run everything locally (Ollama), keep your code on your machines\n- **Solo developers** — Free, fast, and works with zero configuration (`npx @opencodereview/cli scan src/`)\n\n## Featured On\n\n<a href=\"https://www.producthunt.com/products/open-code-review\"><img src=\"https://api.producthunt.com/widgets/embed-image/v1/top-post-badge.svg?post_id=XXXXX&theme=dark&period=daily\" alt=\"Product Hunt\" width=\"250\" /></a>\n\n## License\n\n[BSL-1.1](LICENSE) — Free for personal and non-commercial use. Converts to Apache 2.0 on 2030-03-11.\nCommercial use requires a [Team or Enterprise license](https://codes.evallab.ai/pricing).\n\n---\n\n**Star this repo if you find it useful — it helps more than you think!**\n",
  "bytes": 10328,
  "sha": "1733b19be90299be1429ce4b852767c01b5f1a6b4f82b1bfdf50673e7ca811d7",
  "repo_slug": "raye-deng/open-code-review",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_raye_deng_open_code_review_09339bc6/readme"
}