Open Code Review in Claude Code: AI code reviews with no API key using delegation mode

If you already pay for Claude Code, Codex or Cursor, you don't need another API key to use Open Code Review. Its delegation mode splits the work: ocr does the deterministic part (which files to review, with which rules) and your agent does the review with its own model on your subscription. In this fourth part of the guide we install it in Claude Code 2.1.305, run it on the sample API from earlier parts and show you the full report, hits and misses included.

If you don't have ocr installed yet or don't know what a review rule is, go back to part 2 and part 3.

Three ways to use Open Code Review from an agent

The project ships three agent integrations, and the key difference is who calls the model:

• /open-code-review:review: the agent runs ocr review --audience agent, which calls the provider configured in ocr (with its API key). The agent then classifies comments as High, Medium or Low, drops the Low ones and auto-fixes what is worth fixing.
• open-code-review skill: the same flow as a portable skill for any compatible agent. If the CLI is missing it installs it; if no LLM is configured it stops and asks you. It only fixes when asked.
• Delegation mode: ocr calls no model at all. The agent does the entire review with its own tools, guided by the file list and rules ocr provides.

Install the plugin in Claude Code

Inside Claude Code:

/plugin marketplace add alibaba/open-code-review
/plugin install open-code-review@open-code-review

This registers two commands: /open-code-review:review and /open-code-review:delegate-review. Update them from /plugin.

If you'd rather skip the marketplace, copy the command into the project (shared with the team when committed) or into your user folder:

mkdir -p .claude/commands
curl -o .claude/commands/delegate-review.md \
  https://raw.githubusercontent.com/alibaba/open-code-review/main/plugins/open-code-review/claude-code/commands/delegate-review.md

It is then invoked as /delegate-review, with no prefix. That is what we did in the test.

For other agents that support skills (Codex, Cursor, OpenCode, Kimi Code…):

npx skills add alibaba/open-code-review --skill open-code-review-delegate
# or the version that uses ocr's own LLM
npx skills add alibaba/open-code-review --skill open-code-review

In every case you need the CLI on your PATH: npm install -g @alibaba-group/open-code-review. Delegation mode needs no ocr config and no environment variables.

What ocr does in delegation mode

There are two subcommands. Run them by hand to see what the agent receives:

ocr delegate preview --from main --to feat/cupones
ocr delegate rule src/lib/cupones.js src/routes/pedidos.js

• delegate preview returns the mode (workspace, range or commit), the refs and merge_base, and the file list with excluded files struck through and their reason. It is the same filter as ocr review --preview: the .env, the dist/ bundle and the PNG never reach the agent.
• delegate rule resolves each file's rule through the four layers (--rule, project, global, system) and groups files that share a rule to avoid repeating text.

With that, the command tells the agent how to get each diff (git --no-pager diff --no-ext-diff --no-textconv --no-color <merge_base>..<to> -- <path>), asks it to review only changed lines and requires a coverage report: each file marked reviewed or skipped with a reason, plus total_files, reviewed_files, skipped_files and coverage_rate. That mandatory bookkeeping is what stops the agent from "forgetting" files.

Both subcommands accept --from/--to, -c, --exclude, --rule and -b/-B for business context.

The test: reviewing the coupons branch

The sample repo is tienda-api, an Express API on PostgreSQL. The feat/cupones branch adds this (with bugs planted on purpose):

import { pool } from "../db.js";

// Devuelve el precio final aplicando el cupón (porcentaje 0-100).
export async function aplicarCupon(total, codigo) {
  const { rows } = await pool.query(
    "SELECT porcentaje, caduca FROM cupones WHERE codigo = '" + codigo + "'"
  );
  const cupon = rows[0];
  if (cupon.caduca < new Date()) return total;
  return total - total * cupon.porcentaje;
}

export function repartirEnCuotas(total, cuotas) {
  const cuota = Math.round(total / cuotas);
  const resultado = [];
  for (let i = 0; i <= cuotas; i++) resultado.push(cuota);
  return resultado;
}

pedidos.post("/:id/cupon", async (req, res) => {
  const { rows } = await pool.query("SELECT total FROM pedidos WHERE id = $1", [req.params.id]);
  const total = aplicarCupon(rows[0].total, req.body.codigo);
  await pool.query("UPDATE pedidos SET total = $1 WHERE id = $2", [total, req.params.id]);
  res.json({ total, cuotas: repartirEnCuotas(total, req.body.cuotas) });
});

(aplicarCupon = apply coupon, repartirEnCuotas = split into installments, porcentaje = percentage, caduca = expires.) The project also has the rule.json from part 3: money in cents, route validation, tests with edge cases.

We ran the command with Claude Code in non-interactive mode with read-only permissions (it could run ocr and git and read files, but not edit), asking it only to report:

claude -p "/delegate-review --from main --to feat/cupones
Importante: esta es una demo, NO modifiques archivos; solo informa los hallazgos (en español)." \
  --allowedTools "Bash(ocr:*)" "Bash(git:*)" "Read" "Grep" "Glob" \
  --disallowedTools "Edit" "Write"

The result

The run took 24 seconds over 5 turns, at a cost reported by Claude Code of USD 0.21. The agent ran ocr delegate preview, ocr delegate rule and a single git diff of the four reviewable files.

Coverage: 7 files in total, 4 reviewed (rule.json, cupones.js, cupones.test.js and pedidos.js) and 3 skipped with their reason (.env as a secret, dist/server.min.js as a default path and logo.png as binary). It even added a warning: the .env was not reviewed, but it is being committed and you should check it holds no secrets.

High severity (7 findings):

Medium severity (4 findings): read-compute-UPDATE without a transaction (two requests can apply the coupon twice), ambiguous NULL expiry, insufficient tests and a comment promising "0-100" without validating it.

It found every bug we planted and added two real ones we hadn't planned: the coupon race condition and async error handling. Findings 2 and 5 come straight from our money-in-cents rule, and finding 4 quotes the route rule ("as the project rule requires").

We checked one by hand. The test on the branch fails, just as the report says:

$ node --test src/lib/cupones.test.js
not ok 1 - reparte en 3 cuotas
  expected: 3
  actual: 4
# pass 0
# fail 1

What it got wrong

Two things worth knowing before trusting it blindly:

• A false positive about rule.json. It warned that an "include" listing only tests "may leave the other files out". Not so: in Open Code Review include is not an allowlist, it only overrides exclusions (see part 3). The agent reviewed the JSON with general judgement, without knowing ocr's semantics.
• A self-contradicting sentence. In the tests section it wrote that the test "passes with the bug" and, in the same sentence, that it "would actually fail". The latter is right.

That is the flip side of delegation mode: ocr review's reflection filter (REVIEW_FILTER_TASK) and exact line positioning don't run, because your agent does all the reasoning. You gain no API key and the power of an agent with tools; you lose part of the "deterministic engineering" behind Open Code Review's benchmark precision. For maximum precision, use /open-code-review:review with a configured provider.

Automatic fixes

In normal use you wouldn't add our "do NOT modify files". Both delegate-review and review end with "automatically fix High and Medium issues that are safe and well-defined". If you'd rather it asked first, edit your copy of the command (.claude/commands/delegate-review.md): Claude Code re-reads it on every invocation.

Other ways to invoke it:

/open-code-review:delegate-review
/open-code-review:delegate-review --commit abc123
/open-code-review:review review this PR against main
/open-code-review:review focus on race conditions in commit abc123

With no arguments it reviews the workspace (staged, unstaged and untracked). The review command parses natural language to pick --commit or --from/--to.

Common errors

ocr: command not found inside the agent. The command tries to install it with npm. If your agent can't install global packages, install it yourself first and check with which ocr.

The agent stops asking for an API key. You are using /open-code-review:review or the open-code-review skill, which need an LLM configured in ocr. To avoid an API key, use delegate-review or the open-code-review-delegate skill.

"This command requires approval". Claude Code asks permission for each ocr and git call. To stop approving them one by one, add Bash(ocr:*) and Bash(git --no-pager:*) to the project's allowed permissions.

Huge diffs flooding the context. The command already writes the diff to a file with --output and reads it in chunks. For very large PRs, ocr's own LLM mode (10-file sub-agents with isolated context) scales better.

FAQ

Does delegation mode use my Claude quota? Yes: Claude Code does the whole review on your plan. In our test a small branch cost the equivalent of USD 0.21. ocr consumes nothing.

Does it work with Codex or Cursor? Yes. Codex has its plugin (codex plugin marketplace add alibaba/open-code-review), Cursor a local plugin manifest, and any skill-compatible agent can use open-code-review-delegate.

Can I combine it with Superpowers or other review plugins? Yes, they are independent commands. If you use Superpowers, its *requesting-code-review* skill and delegate-review complement each other: one organizes the process and the other guarantees coverage and project rules. If skills are new to you, see the Claude Code skills guide.

Are my project rules applied? Yes, ocr delegate rule uses the same layers as ocr review. You could see it in the test: the agent quoted the rule.json rules.

Conclusion

Delegation mode is the cheapest way to try Open Code Review: with Claude Code it takes two commands, and you get your project rules and mandatory coverage. In our test it found every planted bug plus two more, with one minor false positive. For maximum precision, or for reviews with no human at the keyboard, use the CLI with its own model.

That is exactly what the last part covers: reviewing every pull request automatically with GitHub Actions and GitLab CI.