Documentation

Using npx (no install)

npx @opencodereview/cli@latest scan ./src

Global install

npm install -g @opencodereview/cli
ocr scan ./src

GitHub Actions

# .github/workflows/ci.yml
name: Code Quality Check
on: [pull_request]

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: raye-deng/open-code-review@v1
        with:
          threshold: 70
          paths: 'src/**/*.ts'
          fail-on-low-score: true

GitLab CI

# .gitlab-ci.yml
include:
  - component: open-code-review/validate@v1
    inputs:
      threshold: 70
      paths: src

Register

Create a free account to unlock team features, dashboards, and license management.

License Key

Activate your license to unlock Pro and Enterprise features.

ocr license activate ocr-xxxx-xxxx-xxxx

Step 1: Scan your code

OCR analyzes your code across 3 levels and detects AI-specific defects.

Step 2: Preview fixes (dry-run)

Preview AI-generated fixes without modifying any files.

Step 3: Auto-fix

AI auto-fixes all detected issues. Done. Zero human intervention.

Generate IDE rules for Cursor / Copilot / Augment

npx @opencodereview/cli@latest heal ./src --generate-rules
# Creates .cursorrules, .copilot-rules, or .augmentrules

GitHub Actions — Scan + Auto-Heal

# .github/workflows/ci.yml
name: AI Code Review & Self-Heal
on: [pull_request]

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Scan
        run: npx @opencodereview/cli@latest scan ./src --threshold 70
      - name: Heal (auto-fix)
        run: npx @opencodereview/cli@latest heal ./src
        env:
          OCR_PROVIDER: glm
          OCR_API_KEY: ${{ secrets.OCR_API_KEY }}
      - name: Commit fixes
        run: |
          git config --global user.name "OCR Bot"
          git config --global user.email "[email protected]"
          git add -A
          git diff --cached --quiet || git commit -m "fix: OCR auto-heal applied"
          git push

GitLab CI — Scan + Heal

# .gitlab-ci.yml
ocr-review:
  stage: test
  image: node:20
  script:
    - npx @opencodereview/cli@latest scan ./src
    - npx @opencodereview/cli@latest heal ./src
  variables:
    OCR_PROVIDER: "glm"
    OCR_API_KEY: "$OCR_API_KEY"

Quick Start with L3

npx @opencodereview/cli@latest scan ./src --level l3 --provider openai --api-key sk-xxx

Using Free Providers (GLM)

# GLM (智谱) — free
npx @opencodereview/cli@latest scan ./src --level l3 --provider glm --api-key your-glm-key

CLI Flags

npx @opencodereview/cli@latest scan ./src \
  --level l3 \
  --provider glm \
  --api-key your-glm-key \
  --model glm-4

Config File (ocr.config.json)

{
  "level": "l3",
  "provider": "glm",
  "apiKey": "your-glm-key",
  "model": "glm-4",
  "paths": ["src/**/*.ts"],
  "threshold": 70
}

Environment Variables

export OCR_PROVIDER=glm
export OCR_API_KEY=your-glm-key
export OCR_MODEL=glm-4

Generate SARIF Report

GitHub Code Scanning Integration

Upload SARIF to GitHub Code Scanning for inline PR annotations and the Security tab:

# .github/workflows/ocr.yml
name: OCR Code Scanning
on: [pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - name: Run OCR scan
        run: |
          npx @opencodereview/cli@latest scan ./src \
            --output sarif \
            --output-file ocr-results.sarif
      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ocr-results.sarif
          category: open-code-review

SARIF Structure

OCR's SARIF output follows the v2.1.0 schema. Each finding maps to a SARIF result with rule metadata, severity levels, and file locations:

{
  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
  "version": "2.1.0",
  "runs": [{
    "tool": {
      "driver": {
        "name": "open-code-review",
        "version": "2.1.1",
        "rules": [{
          "id": "OCR001",
          "name": "HallucinatedPackage",
          "shortDescription": {
            "text": "Import references a package that does not exist on npm"
          },
          "defaultConfiguration": {
            "level": "error"
          }
        }]
      }
    },
    "results": [{
      "ruleId": "OCR001",
      "level": "error",
      "message": {
        "text": "Package 'lodash-utils' not found on npm registry"
      },
      "locations": [{
        "physicalLocation": {
          "artifactLocation": { "uri": "src/utils/helpers.ts" },
          "region": { "startLine": 3, "startColumn": 1 }
        }
      }]
    }]
  }]
}

SARIF Rule IDs

1. Get Your License Key

Register at opencodereview.com/register to create an account. Your License Key is available in the Dashboard after sign-up, or via the API:

# Register a new account
curl -X POST https://cloud.opencodereview.com/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","password":"your-password"}'

# Login to get your API token
curl -X POST https://cloud.opencodereview.com/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","password":"your-password"}'

# Response includes your access token:
# { "accessToken": "eyJ...", "licenseKey": "ocr-xxxx-xxxx-xxxx" }

2. API Authentication

All API requests require a Bearer token in the Authorization header:

curl https://cloud.opencodereview.com/api/licenses \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

3. Activate License in CLI

ocr license activate ocr-xxxx-xxxx-xxxx

4. API Endpoints

5. Submit a Scan via API

curl -X POST https://cloud.opencodereview.com/api/scans \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  -H "Content-Type: application/json" \
  -d '{
    "repositoryUrl": "https://github.com/your/repo",
    "branch": "main",
    "level": "l3",
    "paths": ["src/**/*.ts"]
  }'

Do I need an AI API key?

For L1 and local scans, no — Ollama runs locally for free. For L3 Deep Scan and heal, you need an API key from one of 8 supported providers. GLM is completely free.

What is Detect & Heal?

OCR's core differentiator: ocr scan detects issues, ocr heal auto-fixes them. Other tools just tell you what's wrong — OCR fixes it for you.

What languages are supported?

TypeScript, JavaScript, Python, Java, Go, Kotlin, and Rust. Each has its own AI-specific defect detector.

How is this different from ESLint?

ESLint checks code style. Open Code Review detects AI-specific issues and auto-fixes them — not just reports.