M1 shipped · runs locally · Apache-2.0

A code reviewer that reads before it comments.

ocra splits a change into focused review tasks. Each agent can only read your repository, has to quote the code it means, and must say what it checked. Most runs end with a handful of findings. Some end with none, and that is fine.

QuickstartSource on GitHub

Node 22+, any model OpenCode supports

example output
$ ocra review --from main
[ocra] 4 file(s) selected, 1 excluded · risk tier: lite
[ocra] 2 review task(s) (grouped)
[ocra] correctness-1 gemini-3.5-flash: 5 tool calls, $0.0081
[ocra] correctness-2 completed in 7.4s · 0 finding(s)
 
src/auth/session.ts
  critical   L42       Every session is treated as expired
    isExpired() compares expiresAt in seconds with Date.now() in
    milliseconds, so users are logged out right after signing in.
    Suggestion: return session.expiresAt * 1000 < Date.now();
 
1 finding(s) (1 critical) · 21,406 in / 402 out · $0.0143

What happens when you run ocra review

The steps that must not go wrong are plain, tested code. Models are only asked for judgment.

model

Review

The agent reads the exact revision under review through three tools and reports each issue by quoting code. It has no shell, cannot write, and stops after 20 steps.

codemodelplanned

Decisions we made on purpose

Each of these costs something. We think the trade is worth it.

  1. 01

    The model never picks the line.

    Models are bad at line numbers and good at quoting. So they quote, and ocra finds the lines.

  2. 02

    Reviewers are told what to leave alone.

    Style, speculation, missing tests and untouched code are out of scope in every prompt. You get fewer comments, not weaker ones.

  3. 03

    Nothing runs with write access.

    Agents can read files, read diffs and search. Editing, shell and network tools are switched off.

  4. 04

    Your machine stays out of the prompt.

    Local OpenCode config, installed skills and instruction files are disabled before the first request.

  5. 05

    Every attempt shows its bill.

    Input, output, reasoning and cached tokens, with cost, per model call and per run.

  6. 06

    When a model falls over, the next one takes the task.

    Give each tier a list of models. Overloads and quota errors move on; a model that keeps failing is skipped for the rest of the run.

What a finding looks like

Enough to decide in a few seconds whether to fix it or dismiss it.

src/auth/session.ts · L422critical
41 export function isExpired(session: Session) {
42 + return session.expiresAt < Date.now(); 1
43 }

Every session is treated as expired

expiresAt is stored in seconds but compared with Date.now() in milliseconds, so every session counts as expired and users are logged out right after signing in.

Evidence: token.ts:18 sets expiresAt = Math.floor(Date.now() / 1000) + ttl3

+ return session.expiresAt * 1000 < Date.now();4
  1. 1The line the agent quoted
  2. 2Where ocra located it
  3. 3What the agent checked with its tools
  4. 4The smallest fix, when there is one

Your team's rules, as a plugin

The Git adapter, the OpenCode runtime and the reviewer that ships today are plugins too. Yours get the same small contract: register rules, reviewers, tools or listeners, and receive your own settings.

  • Three lifecycle hooks, run in a fixed order
  • Settings validated per plugin
  • Clashing or late registrations fail with the plugin's name
Plugin guide
// tools/ocra-team-rules.mjs
export default {
  name: "team-rules",
  configure(ctx) {
    ctx.registerRules([{
      path: "services/**",
      rule: `${ctx.settings.team}: require idempotency keys`,
    }]);
  },
};

Where it stands

  1. M1Local reviewCLI, selection, bundling, anchoring, the correctness reviewer, OpenCode runtime, plugins, benchmark harness.shipped
  2. M2More reviewersSecurity and performance reviewers, verification, a judge, risk-based routing.next
  3. M3GitHubInline comments on pull requests and incremental re-review.planned
  4. M4HardeningCircuit breakers, remote config, review memory, an --ultra mode for recall.planned

Try it on a repository you know

It runs against any Git repository on your machine. Your model provider sees the change under review and the files the agents open, nothing else.

Read the quickstart
git clone https://github.com/jma49/Open-CR-Agent.git
cd Open-CR-Agent && npm install && npm run build
npm link --workspace @open-cr-agent/cli
export GEMINI_API_KEY=...
cd your-repository && ocra review