Alibaba's code reviewer claims 4.7x Claude Code's precision at a fourteenth of the tokens

alibaba/open-code-review cut v1.12.1 at 11:23 UTC this morning. It's a Go CLI that ran as Alibaba's internal review assistant for two years before the May 2026 open-source release, and it's at 24,596 stars with 443 added today.

The architecture explains the claimed numbers. It runs deterministic rule pipelines first for the classes that don't need a model at all (null pointer dereferences, thread-safety violations, XSS, SQL injection), then hands an LLM agent the cases that need judgment, with the ability to read full files and search the codebase for context. On its own AACR-Bench it reports 33.90% precision with Claude-4.6-Opus against 7.23% for Claude Code on the identical model. Token cost per review: 385K against 5,664K.

Same model, 4.7x the precision, a fourteenth of the tokens. If that holds outside the vendor's own benchmark, it's the largest cost-quality gap I've seen published this quarter.

Now the caveat, and it's load-bearing. AACR-Bench is Alibaba's benchmark, measuring Alibaba's tool. That's not disqualifying, plenty of good tools ship with a self-authored eval because nothing else exists, but a 4.7x delta on a self-designed test is exactly the shape you'd expect from a benchmark that encodes the author's definition of a finding. Claude Code isn't a code-review product, it's a general coding agent being scored on a review task it wasn't shaped for. The comparison is real but it isn't fair, and the honest version of the claim is narrower: a purpose-built review pipeline beats a general agent at review, which is what you'd guess.

The token number is the one I trust most, because it's mechanical. Deterministic rules catching the boring 80% means the model never sees most of the diff. That's architecture, not benchmarking.

Today's release fixes OpenCode 2.x support by moving to native tools and commands (#1213), validates that the git binary on PATH is safe before invoking it (#865), and posts findings against the reviewed commit rather than whatever HEAD happens to be (#1230). That last one matters more than it sounds. A review comment attached to the wrong commit is worse than no comment. Rules routing now sends Python stub files to the Python rules, and a stale alias pointing at deepseek-flash was removed. Eight-plus commits in the 24 hours around the release, so this is a fast cycle, not a quarterly drop.

If you're paying per-token for agent code review right now, run both against the same 50 PRs and count findings you'd actually act on. The two-year production history before open-sourcing gives this more weight than most repos with a benchmark table in the README, and the deterministic-first shape is copyable even if you don't adopt the tool.