open-code-review

What is open-code-review?

open-code-review is an MCP (Model Context Protocol) server that integrates Open Code Review’s AI-powered quality gate directly into AI IDEs such as Claude Desktop, Cursor, Windsurf, and VS Code Copilot. It catches defects in AI-generated code—hallucinated imports, stale APIs, over-engineering, and security anti-patterns—using local LLMs or any OpenAI-compatible provider. The server is self-hostable, free for personal and non-commercial use, and supports TypeScript, JavaScript, Python, Java, Go, and Kotlin.

How to use open-code-review?

Install the MCP server globally via npm (npx @opencodereview/mcp-server), then add the configuration to your IDE’s MCP settings (e.g., claude_desktop_config.json for Claude Desktop). Once connected, tools such as ocr_scan, ocr_heal, and ocr_explain become available for scanning, auto-fixing, and explaining code issues.

Key features of open-code-review

• AI hallucination detection (hallucinated imports, stale APIs)
• Deep LLM analysis with cross-file coherence checks
• AI auto-fix (preview and apply fixes)
• Multi-language support (TypeScript, JavaScript, Python, Java, Go, Kotlin)
• 100% local or self-hosted (no cloud dependencies)
• Works with any OpenAI-compatible LLM (e.g., Ollama, remote endpoints)

Use cases of open-code-review

• Teams using AI coding assistants (Copilot, Cursor, Claude Code) to review generated code before merging
• Open-source maintainers vetting AI-generated PRs for hallucinated imports and security anti-patterns
• DevOps teams adding a self-hosted quality gate to CI/CD pipelines (GitHub Actions, GitLab CI)
• Security-conscious teams that want to run code analysis entirely on-premises using local LLMs
• Solo developers who want a free, zero‑configuration code review tool in their AI IDE

FAQ from open-code-review

What does the MCP server do vs. the CLI tool ocr?

The MCP server exposes the same detection engine as a set of tools for AI IDEs, whereas the CLI tool (ocr) runs scans directly in a terminal or CI pipeline. Both share the same core analysis, but the MCP server enables in‑IDE review and auto‑fix without leaving the editor.

What runtime or dependencies are required?

The server requires Node.js to run. For deep scans (L3 SLA), you need an LLM provider—either a local Ollama instance or any OpenAI‑compatible API endpoint. Scans with lower SLAs (L1, L2) can run without an LLM, using structural and semantic analysis only.

Where does my code and data live?

When using a local LLM (e.g., via Ollama), all analysis happens on your own machine—code never leaves your environment. If you connect to a remote OpenAI‑compatible provider, your code is sent to that provider’s endpoint; the server itself does not store or log any code.

What transport and authentication does the MCP server use?

The server uses the standard Model Context Protocol (MCP) with stdio transport. It does not require authentication because it runs as a local process within your IDE; no network ports are exposed by default.

Is the MCP server free to use?

Yes, the server is free for personal and non‑commercial use under the BUSL‑1.1 license (which converts to Apache 2.0 in 2030). Commercial use requires a paid license for the underlying Open Code Review engine.