Ground the review
OCR reads the exact before and after commits through a server with no write access to your repository.
REVIEW WITH EVIDENCE
Less noise.
More control.
Run AI code reviews locally or in GitLab CI with Alibaba Open Code Review (OCR). The toolkit supplies exact commits and relevant project decisions, checks findings, and records the result.
LATEST RELEASE See what’s new in the toolkit ↗
demo_client.py / merge requestReview
07
response = requests.get(url)SUGGESTED CHANGE
requests.get(url)requests.get(url, timeout=10)A
Alex · developer
Let’s choose the timeout for this service.
SYNTHETIC EXAMPLEEvidence → Review → Decision
01 / THE APPROACH
Review the change.
Keep the context.
OCR can inspect the code, history, and project guidance behind a change, not just the patch.
Check the result
Reject invalid output, filter sensitive data, and record which commit was reviewed.
Keep the conversation
Save a local report or post to GitLab. Replies from people stay in place when the bot runs again.
02 / WHO IT HELPS
For the people who write, review, and ship code.
Check a commit before you share it.
Review on your machine without GitLab credentials. Read checked findings in a private report. Use an API provider, or sign in with ChatGPT on a trusted personal device.
Explore local reviewKeep the discussion useful on every rerun.
Post inline findings in GitLab, keep threads once someone replies, and replace untouched bot notes when a new review succeeds.
Explore review operationsKnow what ran, what posted, and why.
Start with a CI review that advises without blocking merges. See which commit was reviewed, which notes reached GitLab, and where a run stopped. Add stricter rules when your team trusts the results.
Plan a GitLab rollout03 / IN THE WORKFLOW
A finding is the start of a conversation.
The timeout suggestion looks sensible, but the right number depends on the service. A developer can challenge it in GitLab, and that conversation stays in place on later runs.
Explore GitLab review operations
04 / CURRENT CAPABILITIES
What you can use today.
01 / LOCAL REVIEWS
Native ChatGPT sign-in for local reviews
On a trusted personal machine, explicit local mode can use OCR’s native ChatGPT authentication. GitLab CI still uses configured API providers; the two paths stay separate.
Local setup ↗02 / REPOSITORY EVIDENCE
Project decisions and guidance from the right revision
Read-only evidence from the base and proposed commits gives OCR verifiable facts on demand. Accepted decisions and guidance come from the target branch, so a proposed change cannot approve itself.
Project context ↗03 / GITLAB CONTEXT
More than the latest diff
When protected-target policy allows it, reviews can use bounded GitLab discussions, verified remediation history, and CI outcomes from the exact reviewed revision. Partial or unavailable context remains visible.
Context rules ↗04 / GOVERNED TOOLS
External read-only tools with clear limits
Optional Model Context Protocol (MCP) tools can supply extra facts. Allowlisted tools face schema, origin, budget, sensitive-data, and usage checks. The built-in repository evidence server remains mandatory.
Tool controls ↗05 / WHAT’S NEW
The latest release, at a glance.
Local reviews can use OCR’s native ChatGPT sign-in. API providers still work as before.
The recommended OCR can review more file types, including PowerShell, shaders, and OpenTofu.
The trust store was updated to remove a compromised certificate authority.
Read all changes in v0.12.0
Features
- Allow standalone local reviews to opt into OCR's native ChatGPT-plan authentication while preserving custom API providers as the default. Reuse OCR's private persistent login state through an isolated runtime home, reject ChatGPT mode in GitLab, and check local structural readiness without automatic login or API billing fallback. (#245)
Bug Fixes
- Keep direct navigation to admitted merge-request intent and external-tool availability visible in the compact evidence bootstrap, including when detailed context is clipped. External tools remain optional and governed by the existing registry, DLP and approval controls. (#239)
Maintenance
- Target checksum-verified Open Code Review 1.13.2 after qualifying 1.13.0 through 1.13.2. (#242)
- Refresh compatible MCP SDK 2.x, HTTPX2, development-tool and pinned GitHub Action versions while preserving locked installation, mandatory evidence, governed federation and release authorization boundaries. (#243)
Rules
- The recommended OCR adds built-in review selection and Rules for PowerShell (.ps1, .psm1, .psd1), Nushell (.nu), shaders (.glsl, .hlsl, .wgsl, .metal) and OpenTofu (.tofu). Qualification verifies the exact extension and built-in pattern contracts. (#242)
Security
- Raise the certifi minimum to 2026.10.19 and update the locked trust store to remove compromised CA trust. Update CI to uv 0.13.4 and PyPI publishing action 1.14.3 for their security fixes. Rebuild existing installed environments to receive the corrected trust store; supported Python versions remain unchanged. (#243)
Deprecations
- Qualified OCR 1.11.x versions now emit a deprecation warning as the rolling window advances to supported 1.12.x and 1.13.x lines. Upgrade to the recommended qualified OCR 1.13.2. (#242)
Removals
- OCR 1.10.x is no longer accepted by preflight under the documented rolling support policy. Replace older pins with a checksum-verified qualified patch from the current support window; OCR 1.13.2 is recommended. (#242)
06 / FIELD NOTE
Example operational metrics.
~9 in 10structured toolkit results completed without a technical failure.
~99 in 100merge requests changed after review received a follow-up review.
FOR TEAMS
Check what reached GitLab.
A green CI job does not mean a finding was posted. Compare the review result with the notes on the merge request.
FOR LEADS
Measure your own rollout.
Use these as operating checks. Compare quality and lead time against your team's baseline before changing policy.
Rounded shares from separate groups. They describe toolkit operation, not review quality or time saved.
07 / ONE MINUTE OVERVIEW
Watch a review play out.
See how repository facts become a finding, and how a developer responds.
08 / FIRST REVIEW
Run a local review.
See what it found.
Install the toolkit, add the verified ocr binary, and choose a model. Then run preflight and review one commit into a private Markdown report. GitLab CI can come later.
LOCAL / AFTER SETUP
ocr-ci preflight --local
ocr-ci review --local \
--result review.json \
--stderr review.stderr \
--report review.md \
-- --commit HEADUse the verified OCR version and a configured model. Preflight checks setup without a model call. HEAD becomes a fixed commit before review.
PRACTICAL DETAILS
Costs and data.
Cost
The toolkit is open source under Apache-2.0. Model use and GitLab infrastructure may cost extra; OCR is installed separately. Check your provider's pricing and set a budget before you run it. Configuration ↗
Where review data goes
Your chosen model provider receives the review context sent to it. In GitLab mode, the toolkit can post checked findings to a merge request. It limits context and filters sensitive data, but your team should confirm its provider and repository policies. Security model ↗
Missing timeout. A stalled call can block work.