Open Code Review

The trait that decides it is that there is no account. It installs from npm, runs inside the automation you already have, and comments on the diff without a third party ever holding your repository. For a team that would like a reviewer bot and cannot get one past their own security review, that changes the answer from no to maybe.

It is young and the polish shows in the edges. Pick it when you want the reviewer under your own control. Pick CodeRabbit if you want a product with a support queue and years of tuning behind the comments.

The risk is independence. One documented mode delegates the review to whichever coding agent you already run, and on most teams that is the same agent that wrote the code under review. A reviewer sharing the author's blind spots is not a reviewer; it is a second opinion from the first opinion, and it will confidently approve its own mistaken assumptions.

If you use that mode, use a different model than the one that authored the change. What it does right: it runs in Gerrit as well as the two obvious hosts, which almost nothing else on this board bothers to support.

1. The comparison set is 200 pull requests chosen by the authors, so it is self-authored and not comparable to anything published elsewhere. 2. The precision claim needs a labelling protocol, and none is described: who decided a comment was correct, and were they blind to which system produced it. 3. The token figure, roughly a ninth of a general-purpose agent, is the more checkable claim, since it follows from bundling files and running sub-agents only where needed.

The architecture is sound: deterministic code selects files, matches rules and positions comments, leaving the model to judge rather than to navigate. The numbers are reported, not verified.

Understand who pays for this. A very large platform company published it, charges nothing, and has no attached service to upsell you into. That means the tool exists because a team inside was given a mandate, and mandates inside large companies are renewed annually by people who did not write the code. Twenty-two thousand stars will not save it from a reorganisation.

Moat: none for the publisher, which is fine, because the strategic return is reputation and recruiting rather than revenue. Likely path: continued release while the team exists, then a slow stop. Position: adopt, and keep the fork you can maintain.

The finance side is simple: nothing to buy, and the only meter is model consumption per pull request, which for sixty engineers is a forecastable number once we have measured a fortnight. It slots into the automation we already run, so there is no new infrastructure and no new vendor onboarding.

What worries me is maturity and accountability. This appeared in the middle of this year, there is no support agreement behind it, and every diff we review travels to whichever model endpoint we point it at, so retention is inherited from that contract rather than this one. Approved with conditions: two repositories, false positives measured before wider rollout.

Apache-2.0 on a review tool matters more than on most things, because a reviewer I cannot read is a reviewer I cannot argue with. This one installs globally from npm, runs from my shell, and speaks MCP as a client, so my own servers become context the reviewer can reach rather than integrations I wait for somebody to build.

Provider configuration is mine, which means a review can run against my own endpoint or none at all depending on the mode I pick. That is the flexibility I want from something that reads every line I write. This one I would keep.