Open source AI code review for coding agents.
A separate reviewer checks every change your agent writes before you push. A code graph gives your agent a map of your codebase. Works in Claude Code, Codex, Cursor and Cline.
npx openqodex init- Apache 2.0
- No account or key of its own
- No telemetry

Works inClaude CodeCodexCursorCline
What you get
Code review
Every change your agent writes gets a receipt before the push: the verdict and one line per finding, from a Claude Code or Codex reviewer on your own login that is not your agent.
Passed with warnings: 8 findings (2 major, 6 minor) Change fdf921210d06 against main, 37 files, +2953 -306 1. Major bug: Brand mark ring invisible on dark theme (app/globals.css:134) 2. Major bug: Benchmark rows from different groups look the same (lib/benchmark.mjs:67-76) 3. Minor bug: Install tabs lack arrow-key navigation (app/components/Install.jsx:19) 4. Minor bug: Theme toggle leaves browser theme-color on the system scheme (app/components/ThemeToggle.jsx:11) 5. Minor performance: Whole content objects passed to a client component (app/page.jsx:110) 6. Minor bug: Reduced-motion override loses to class transitions (app/globals.css:311) 7. Minor bug: Check crashes on a tracked file deleted from the worktree (scripts/check.mjs:46) 8. Minor bug: Link check fetches have no timeout (scripts/links.mjs:40-41)
Code graph and knowledge
A map of your repository, built on your machine with no model. The reviewer reads what a change reaches, and your agent asks the same questions through MCP.
{
"call": "graph_callers",
"arguments": { "symbol": "readBenchmark" },
"repo": "openqodex/openqodex-lp",
"treeSha": "0d2a43c61652ce5fcaeb5a6d26e04bb6eb38becf",
"builtAt": "2026-10-25T10:53:19.993Z",
"target": { "id": "lib/benchmark.mjs#readBenchmark@53:23", "name": "readBenchmark", "kind": "function", "file": "lib/benchmark.mjs", "line": 53 },
"items": [
{ "from": "scripts/benchmark-snapshot.mjs", "kind": "calls", "site": { "file": "scripts/benchmark-snapshot.mjs", "line": 11, "column": 20, "tier": "certain", "evidence": "import", "via": { "file": "scripts/benchmark-snapshot.mjs", "line": 7, "spec": "../lib/benchmark.mjs" }, "rule": "js-relative" } },
{ "from": "scripts/check.mjs", "kind": "calls", "site": { "file": "scripts/check.mjs", "line": 66, "column": 25, "tier": "certain", "evidence": "import", "via": { "file": "scripts/check.mjs", "line": 15, "spec": "../lib/benchmark.mjs" }, "rule": "js-relative" } }
],
"counts": { "certain": 2, "likely": 0, "possible": 0 },
"unknown": { "floor": true, "reasons": ["4 calls go through a value (a callback or a computed member) in the repository root project, and could reach it"] }
}How a review runs
Scanners first, then a reviewer that is not your agent
Scan
OpenQodex runs the scanners that fit the files you changed and keeps their findings on the lines you changed.
Find and verify
Separate Claude Code or Codex sessions read the change with the code that calls it and quote a line as evidence for each candidate. A script checks every quote against the code.
Decide
You get a receipt: the verdict and one line per finding. Your agent asks "Fix all, or tell me which?" and fixes only what you name.
The push gate, a hook that looks for a review before your agent runs git push, warns by default. It blocks only when your repository sets review.block_on_severity.

A map of your code
OpenQodex builds a code graph of your repository on your machine, with no model: the functions, classes and types, the calls, imports and inheritance between them, and the proof for each.
The review brief carries who calls the changed code, so the reviewer reads the callers too.
Your agent asks the same graph questions through an MCP server, a local tool server that opens no network port.
Each call site carries the evidence that proved it and a level: certain, likely or possible.
- Languages: TypeScript, TSX, JavaScript, Python, Go and Ruby.
- Framework plugins: Django, Rails, Express, React, Next.js, FastAPI and Go net/http.
- Find
A definition by name, what a symbol is, what a file defines.
graph_searchgraph_symbolgraph_outline- Reach
Who calls it, what it calls, who imports, implements or references it, the path between two points, what a change reaches.
graph_callersgraph_calleesgraph_importersgraph_implementersgraph_referencesgraph_pathgraph_impact- Shape
Routes and their handlers, the tests that reach a symbol, packages and import cycles.
graph_routesgraph_testsgraph_packagesgraph_cycles- Change
What the change removed or moved, and a rebuild on demand.
graph_changesgraph_refresh- Honesty
What the graph could not see, why an edge exists, how fresh the build is.
graph_unknownsgraph_explaingraph_statusgraph_capabilities
Measured on planted bugs
A public demo repository holds one bug planted on purpose, labelled in its README. This is the receipt of its review.
Passed with warnings: 1 finding (1 major) Change d466e2d07183 against origin/base, 1 file, +6 -0 1. Major bug: Off-by-one loop skips the last page (src/paginate.js:25)
The benchmark plants bugs on purpose and scores how many the review finds, how often it reports something that is not there, and what each review costs.
Each case is a small repository with one change, the shape a developer has before a push.
| Reviewer | Model | Issue recall | Precision | Clean rate | Cost per review | Accepted |
|---|---|---|---|---|---|---|
| Claude Codeclaude-graph-on, rules 7 | claude-opus-5-5 | 129/153 (84.3%) | 142/146 (97.3%) to 146/146 (100.0%) | 6/6 (100.0%) | $0.0870 | 2026-10-12 |
| Codexcodex-graph-on, rules 7 | gpt-6.1-sol | 115/153 (75.2%) | 125/146 (85.6%) to 146/146 (100.0%) | 6/6 (100.0%) | not measured | 2026-10-12 |
| Scanner onlyscan, rules 1 | no model | 32/51 (62.7%) | 35/45 (77.8%) to 40/45 (88.9%) | 1/2 (50.0%) | not measured | 2026-10-11 |
| Scanner onlyscan, rules 2 | no model | 32/51 (62.7%) | 35/40 (87.5%) to 40/40 (100.0%) | 2/2 (100.0%) | not measured | 2026-10-23 |
Precision is a range: the low end counts every finding no person has ruled on as wrong, the high end as correct.
Works in your agent
| Coding agent | Starts a review | Can be the reviewer | Push gate | Gets the graph tools |
|---|---|---|---|---|
| Claude Code | yes | yes | yes | yes |
| Codex CLI | yes | yes | yes, after you trust the hook in Codex | yes |
| Cursor | yes | no | no, a rule asks Cursor to review | yes |
| Cline | yes | no | no, a rule asks Cline to review | yes, after you add the entry init prints |
In Cursor and Cline, the review needs Claude Code or Codex installed as the reviewer.
Private by default
OpenQodex collects no usage data, no crash reports and no identifiers. It has no server and no account, and it sends no telemetry.
- The reviewer sends the brief and what it reads to the model your Claude Code or Codex login uses.
- The built-in scanners, as OpenQodex runs them, send no code.
- The privacy page lists every other network use. --offline turns off the network scanners, the downloads and the version check.
Questions
How is this different from Claude Code's own review?
The scanners run first, then a fresh Claude Code or Codex process with no memory of your session, and a script checks every line it quotes. The benchmark runs Claude Code's own /code-review on the same cases as a control.
Does it need an API key?
No account or key of its own: the reviewer runs on your Claude Code or Codex login. The GitHub Action is the exception and needs an Anthropic API key.
Not yet
- No review on your own API key, except in the GitHub Action.
- macOS and Linux only; nothing is tested on Windows or WSL.
- No review finds every problem. The report names each stage that did not run.
Install it, or sign in
Run it yourself
npx openqodex initinit finds Claude Code, Cursor, Codex CLI and Cline on your machine, lists the files it will write, and asks you once.
npx -y openqodex@0.14.0 init --yes --agent <host><host> is claude-code, codex, cursor or cline.
Then say to your agent: "review my change with openqodex".
Nothing that is open today becomes paid later.
Hosted OpenQodex
Hosted OpenQodex at agents.openqodex.com: code review on your pull requests, and a hosted MCP server with the code graph of your repositories.
Sign in with GitHubGet started
One line installs it
npx openqodex initThen say to your agent: "review my change with openqodex".