Open source AI code review for coding agents.

A separate reviewer checks every change your agent writes before you push. A code graph gives your agent a map of your codebase. Works in Claude Code, Codex, Cursor and Cline.

npx openqodex init
  • Apache 2.0
  • No account or key of its own
  • No telemetry
A review's report page

Works inClaude CodeCodexCursorCline

What you get

Code review

Every change your agent writes gets a receipt before the push: the verdict and one line per finding, from a Claude Code or Codex reviewer on your own login that is not your agent.

Passed with warnings: 8 findings (2 major, 6 minor)
Change fdf921210d06 against main, 37 files, +2953 -306
1. Major bug: Brand mark ring invisible on dark theme (app/globals.css:134)
2. Major bug: Benchmark rows from different groups look the same (lib/benchmark.mjs:67-76)
3. Minor bug: Install tabs lack arrow-key navigation (app/components/Install.jsx:19)
4. Minor bug: Theme toggle leaves browser theme-color on the system scheme (app/components/ThemeToggle.jsx:11)
5. Minor performance: Whole content objects passed to a client component (app/page.jsx:110)
6. Minor bug: Reduced-motion override loses to class transitions (app/globals.css:311)
7. Minor bug: Check crashes on a tracked file deleted from the worktree (scripts/check.mjs:46)
8. Minor bug: Link check fetches have no timeout (scripts/links.mjs:40-41)
The receipt as printed on 2026-10-25 for a 37-file change to this site: passed with warnings, 8 findings.

Code graph and knowledge

A map of your repository, built on your machine with no model. The reviewer reads what a change reaches, and your agent asks the same questions through MCP.

{
  "call": "graph_callers",
  "arguments": { "symbol": "readBenchmark" },
  "repo": "openqodex/openqodex-lp",
  "treeSha": "0d2a43c61652ce5fcaeb5a6d26e04bb6eb38becf",
  "builtAt": "2026-10-25T10:53:19.993Z",
  "target": { "id": "lib/benchmark.mjs#readBenchmark@53:23", "name": "readBenchmark", "kind": "function", "file": "lib/benchmark.mjs", "line": 53 },
  "items": [
    { "from": "scripts/benchmark-snapshot.mjs", "kind": "calls", "site": { "file": "scripts/benchmark-snapshot.mjs", "line": 11, "column": 20, "tier": "certain", "evidence": "import", "via": { "file": "scripts/benchmark-snapshot.mjs", "line": 7, "spec": "../lib/benchmark.mjs" }, "rule": "js-relative" } },
    { "from": "scripts/check.mjs", "kind": "calls", "site": { "file": "scripts/check.mjs", "line": 66, "column": 25, "tier": "certain", "evidence": "import", "via": { "file": "scripts/check.mjs", "line": 15, "spec": "../lib/benchmark.mjs" }, "rule": "js-relative" } }
  ],
  "counts": { "certain": 2, "likely": 0, "possible": 0 },
  "unknown": { "floor": true, "reasons": ["4 calls go through a value (a callback or a computed member) in the repository root project, and could reach it"] }
}
graph_callers for readBenchmark in this site's own repository: two certain callers, and a note that four calls through values could also reach it.

How a review runs

Scanners first, then a reviewer that is not your agent

  1. Scan

    OpenQodex runs the scanners that fit the files you changed and keeps their findings on the lines you changed.

  2. Find and verify

    Separate Claude Code or Codex sessions read the change with the code that calls it and quote a line as evidence for each candidate. A script checks every quote against the code.

  3. Decide

    You get a receipt: the verdict and one line per finding. Your agent asks "Fix all, or tell me which?" and fixes only what you name.

The push gate, a hook that looks for a review before your agent runs git push, warns by default. It blocks only when your repository sets review.block_on_severity.

The report
The same review's report page at its findings, each with a severity, a category and its file and line.

A map of your code

OpenQodex builds a code graph of your repository on your machine, with no model: the functions, classes and types, the calls, imports and inheritance between them, and the proof for each.

The review brief carries who calls the changed code, so the reviewer reads the callers too.

Your agent asks the same graph questions through an MCP server, a local tool server that opens no network port.

Each call site carries the evidence that proved it and a level: certain, likely or possible.

  • Languages: TypeScript, TSX, JavaScript, Python, Go and Ruby.
  • Framework plugins: Django, Rails, Express, React, Next.js, FastAPI and Go net/http.
Find

A definition by name, what a symbol is, what a file defines.

graph_searchgraph_symbolgraph_outline
Reach

Who calls it, what it calls, who imports, implements or references it, the path between two points, what a change reaches.

graph_callersgraph_calleesgraph_importersgraph_implementersgraph_referencesgraph_pathgraph_impact
Shape

Routes and their handlers, the tests that reach a symbol, packages and import cycles.

graph_routesgraph_testsgraph_packagesgraph_cycles
Change

What the change removed or moved, and a rebuild on demand.

graph_changesgraph_refresh
Honesty

What the graph could not see, why an edge exists, how fresh the build is.

graph_unknownsgraph_explaingraph_statusgraph_capabilities

Measured on planted bugs

A public demo repository holds one bug planted on purpose, labelled in its README. This is the receipt of its review.

Passed with warnings: 1 finding (1 major)
Change d466e2d07183 against origin/base, 1 file, +6 -0
1. Major bug: Off-by-one loop skips the last page (src/paginate.js:25)
The receipt as printed on 2026-10-25 for a one-file change to the demo repository: passed with warnings, 1 finding, the planted bug at src/paginate.js:25. See the run The demo repository

The benchmark plants bugs on purpose and scores how many the review finds, how often it reports something that is not there, and what each review costs.

Each case is a small repository with one change, the shape a developer has before a push.

Planted bugs, dev split
ReviewerModelIssue recallPrecisionClean rateCost per reviewAccepted
Claude Codeclaude-graph-on, rules 7claude-opus-5-5129/153 (84.3%)142/146 (97.3%) to 146/146 (100.0%)6/6 (100.0%)$0.08702026-10-12
Codexcodex-graph-on, rules 7gpt-6.1-sol115/153 (75.2%)125/146 (85.6%) to 146/146 (100.0%)6/6 (100.0%)not measured2026-10-12
Scanner onlyscan, rules 1no model32/51 (62.7%)35/45 (77.8%) to 40/45 (88.9%)1/2 (50.0%)not measured2026-10-11
Scanner onlyscan, rules 2no model32/51 (62.7%)35/40 (87.5%) to 40/40 (100.0%)2/2 (100.0%)not measured2026-10-23

Precision is a range: the low end counts every finding no person has ruled on as wrong, the high end as correct.

Works in your agent

Coding agentStarts a reviewCan be the reviewerPush gateGets the graph tools
Claude Codeyesyesyesyes
Codex CLIyesyesyes, after you trust the hook in Codexyes
Cursoryesnono, a rule asks Cursor to reviewyes
Clineyesnono, a rule asks Cline to reviewyes, after you add the entry init prints

In Cursor and Cline, the review needs Claude Code or Codex installed as the reviewer.

Private by default

OpenQodex collects no usage data, no crash reports and no identifiers. It has no server and no account, and it sends no telemetry.

  • The reviewer sends the brief and what it reads to the model your Claude Code or Codex login uses.
  • The built-in scanners, as OpenQodex runs them, send no code.
  • The privacy page lists every other network use. --offline turns off the network scanners, the downloads and the version check.

Questions

How is this different from Claude Code's own review?

The scanners run first, then a fresh Claude Code or Codex process with no memory of your session, and a script checks every line it quotes. The benchmark runs Claude Code's own /code-review on the same cases as a control.

Does it need an API key?

No account or key of its own: the reviewer runs on your Claude Code or Codex login. The GitHub Action is the exception and needs an Anthropic API key.

Not yet

  • No review on your own API key, except in the GitHub Action.
  • macOS and Linux only; nothing is tested on Windows or WSL.
  • No review finds every problem. The report names each stage that did not run.

Install it, or sign in

Run it yourself

npx openqodex init

init finds Claude Code, Cursor, Codex CLI and Cline on your machine, lists the files it will write, and asks you once.

Then say to your agent: "review my change with openqodex".

Nothing that is open today becomes paid later.

Hosted OpenQodex

Hosted OpenQodex at agents.openqodex.com: code review on your pull requests, and a hosted MCP server with the code graph of your repositories.

Sign in with GitHub

Get started

One line installs it

npx openqodex init

Then say to your agent: "review my change with openqodex".