Open Code Review — AI Code Quality Gate
An open-source quality gate built specifically for AI-generated code, catching hallucinated imports, phantom dependencies, and stale APIs that traditional linters miss — via CLI, MCP, or CI/CD.
The skill itself requests no dangerous permissions; scanning is read-only, but heal_code modifies user files with only a soft 'review before committing' tip — no explicit confirmation gate or rollback mechanism. It depends on the external npm package @opencodereview/mcp-server from an unverified publisher, so the supply chain is not auditable. Deducted for: unconfirmed file writes with no recovery path, undisclosed external dependency risk.
Critical self-inconsistency: SKILL.md instructs calling scan_directory / scan_diff / explain_issue / heal_code, while the README lists the MCP tools as ocr_scan / ocr_heal / ocr_explain — following the skill may fail outright with no failure-feedback guidance. The repo has vitest tests and CI, but CI excludes tree-sitter WASM tests and nothing was executed. Deducted for: tool-name contradiction, unreproduced key paths.
Triggers, supported languages and scenarios (scan, diff review, PR gate) are clearly described with fairly precise semantic triggers. But boundaries of non-fit (unsupported languages, false-positive rates, the L3 requirement for Ollama/LLM) are thinly disclosed. Core function relies on the npm registry, generally reachable from mainland China. Deducted for: weak non-fit and environment-precondition disclosure.
Docs are readable and well-structured, but with a hard defect: SKILL.md front-matter declares license: MIT while the repo LICENSE and package. are BUSL-1.1 (non-commercial restriction, Apache only from 2030) — a contradictory license claim. Metadata version 1.0 mismatches repo 1.9.0; no changelog or maintenance path for the skill. Deducted for: license contradiction and version drift.
The claimed hallucinated-dependency/stale-API detection has matching implementation and test evidence, so the core task is plausible; but static review cannot confirm outputs are directly usable, and demo reports and competitor comparisons are author self-claims. Deducted for: limited independently verifiable evidence of output usability and comparative benefit (static cap 7).
The repo contains real test files (ai-provider.test.ts, ai-healer.test.ts, etc.) and CI workflows — auditable primary material; but coverage targets only the AI layer and fix engine, with no test evidence for the scan tool path the skill actually instructs, and the tool-name contradiction weakens traceability. Deducted for: narrow coverage, insufficient third-party execution evidence (static cap 5).
- The SKILL.md declares MIT while the repository is actually BUSL-1.1 — commercial use is restricted; verify licensing before adoption.
- MCP tool names in SKILL.md (scan_directory, etc.) contradict the tools listed in the README (ocr_scan, etc.); following the skill as written may fail.
- heal_code modifies source files directly — back up first, prefer dry-run, and review all changes manually.
- The skill depends on an unverified third-party npm package, posing supply-chain risk.
- This is a static source review with no execution; actual detection effectiveness is unverified.
What does this skill do, and when should you use it?
Open Code Review is described as the first open-source CI/CD quality gate designed specifically for AI-generated code. It detects hallucinated imports (verified against npm/PyPI/Maven/Go module registries), phantom packages, stale APIs, over-engineering patterns, and security anti-patterns. Analysis runs in three layers — structural detection, semantic embedding analysis, and an optional L3 LLM deep scan powered by local Ollama or any OpenAI-compatible provider, so code can stay fully on-premise. It ships language-specific detectors for TypeScript/JavaScript, Python, Java, Go, and Kotlin, and outputs terminal, JSON, SARIF, and interactive HTML reports that plug into GitHub Actions and GitLab CI. One caution: the license is inconsistent across sources — SKILL.md says MIT while the README and npm badge say BSL-1.1 and GitHub says NOASSERTION — so verify licensing before commercial adoption.
Scans source directories or PR diffs, reads dependency manifests (package., requirements.txt, pom.xml) and validates imports against npm, PyPI, Maven, and Go module registries; flags stale/removed API calls, dead code paths, and security anti-patterns (hardcoded secrets, eval(), bare except, unhandled errors, and other language-specific issues); in L3 mode calls a local or remote LLM for cross-file coherence checks and confidence scoring; offers AI auto-fix via ocr heal (with a dry-run preview) and exposes scan_directory, scan_diff, explain_issue, and heal_code as MCP tools for AI IDEs. It produces structured reports with A+→F scoring, severity tiers, and fix suggestions.
- Teams using Copilot/Cursor/Claude Code who want hallucinated imports and stale APIs caught before merging AI-generated PRs
- Open-source maintainers screening AI-assisted contributions for non-existent dependencies
- DevOps/platform engineers adding a quality gate to GitHub Actions or GitLab CI without sending code to a cloud service
- Security-conscious teams requiring 100% local analysis via Ollama so code never leaves their machines
- AI-IDE users who want to scan and fix code directly from Claude Desktop, Cursor, or Windsurf via the MCP server
- Solo developers trying it with zero config: npx @opencodereview/cli scan src/
What are this skill's strengths and limitations?
- Free and self-hostable, unlike per-seat commercial PR review services
- Verifies hallucinated imports against real npm/PyPI/Maven/Go registries — a capability ESLint/SonarQube lack
- Runs 100% locally via Ollama and accepts any OpenAI-compatible endpoint, keeping code private
- Six language-specific detectors plus SARIF output for GitHub Code Scanning, supporting both GitHub and GitLab
- Three integration surfaces: CLI, MCP server, and GitHub Action
- Conflicting license signals: SKILL.md says MIT, README badge and license section say BSL-1.1 (commercial use requires a paid license; converts to Apache 2.0 on 2030-03-11), GitHub shows NOASSERTION — must be resolved before commercial use
- L3 deep scan requires an LLM endpoint (Ollama or remote); without AI, analysis degrades to structural detection
- The README comparison table is self-reported with no independent benchmarks; the Product Hunt badge contains a placeholder post_id (XXXXX)
- heal_code auto-fixes carry risk of introducing new issues — the docs themselves insist on human review before committing
How do you install this skill?
1) CLI: npm install -g @opencodereview/cli; 2) MCP mode: add {"mcpServers":{"open-code-review":{"command":"npx","args":["-y","@opencodereview/mcp-server"]}}} to claude_desktop_config. or your Cursor/Windsurf MCP settings; 3) CI mode: add uses: raye-deng/open-code-review@v1 to a GitHub Actions workflow. The skill itself lives at skill/SKILL.md in the repo and can be placed as a standard Agent Skills folder (no dedicated install script is documented).
How do you use this skill?
Fast scan (no AI needed): ocr scan src/; deep scan with a local LLM: ocr scan src/ --sla L3 --provider ollama --model qwen3-coder, or any OpenAI-compatible endpoint via --api-base/--model/--api-key; review PRs with scan_diff; preview auto-fixes with ocr heal src/ --dry-run; generate IDE rules with ocr setup src/; choose output format with --format terminal||sarif|html. Configure SLA level and AI provider in .ocrrc.yml. As a Skill, trigger with prompts like "scan this code", "check for AI-generated bugs", or "audit my imports".
How does this skill compare with similar options?
The README compares it against Claude Code Review, CodeRabbit, and GitHub Copilot: its claimed differentiators are free pricing, open-source self-hosting, AI hallucination/stale API detection, and local LLM analysis, whereas competitors are cloud-based, per-seat paid, and do no hallucination detection. These claims are self-reported and unverified.