What is delegate-review?

A command that uses Open Code Review to select files and review rules, then asks the host coding agent to perform the actual code review. Open Code Review is a tool for examining Git changes for engineering problems.

Use it to review workspace changes, a single commit, or a branch range, then inspect each selected diff for correctness, security, performance, and other stated concerns.

It keeps file selection and project-specific review rules consistent while leaving the reasoning to the coding agent. This is useful when the host agent needs to understand the wider codebase or requirements.

delegate-review — Command by alibaba

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add commands/alibaba/open-code-review/delegate-review

Clone the repo

git clone --depth 1 https://github.com/alibaba/open-code-review

Per session 21 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 435 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00021	$0.00435
Opus 5	$0.00010	$0.00217
Sonnet 5	$0.00004	$0.00087
Haiku 4.5	$0.00002	$0.00044

Measured 3d ago against content hash acbf3a1d45b8, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

delegate-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/open-code-review/claude-code/commands/delegate-review.md · 49 lines

What it actually says

Invoke OpenCodeReview (OCR) in delegation mode. OCR determines which files to review and provides review rules; you perform the actual code review using your own capabilities.

Workflow

Step 1: Preview

ocr delegate preview [user-args]

Default (no user arguments): workspace mode (staged + unstaged + untracked).
If the user provides --commit or -c: pass through as-is.
If the user provides --from and --to: pass through as-is.
(Optional) Provide --background "context" or -b "context" for business context.
If ocr is not found, install it: npm i -g @alibaba-group/open-code-review.

This outputs mode/ref metadata and the reviewable file list.

Step 2: Get Rules

Pass all reviewable file paths to get their review checklists:

ocr delegate rule <path1> <path2> ...

Step 3: Get Diffs and Review

For each reviewable file, get its diff using git (based on mode/ref from Step 1):

Range: git diff <merge_base>..<to> -- <path>
Commit: git show <commit> -- <path>
Workspace: git diff HEAD -- <path> (or read directly for untracked files)

Then review focusing on: correctness, security, performance, error handling, concurrency, maintainability. Only comment on changed code (+ lines).

Step 4: Report and Fix

Classify each issue by severity:

High: Obvious bugs, security issues, data loss, or clear mistakes with precise fix proposals
Medium: Reasonable concerns, performance suggestions, or fixes requiring manual work
Low: Discard silently (likely false positives, nitpicks, or insufficient context)

Automatically fix High and Medium issues that are safe and well-defined.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

3d ago First seen · 49 lines · 21 tokens per session scan A acbf3a1d45b8

Subscribe to this mod's changes

delegate-review is a command published in the GitHub repository alibaba/open-code-review (21,659 stars, last pushed 5d ago), licensed Apache-2.0. It adds 21 tokens to every session and 435 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code review agent agent-skills code-review-assistant harness repository-level-context

delegate-review

Getting it into your agent

What it costs to keep this loaded

Grade A, and why

Nothing flagged

What it actually says

Workflow

Step 1: Preview

Step 2: Get Rules

Step 3: Get Diffs and Review

Step 4: Report and Fix

What this file has done since we first saw it

Other commands, from other repositories

full-review

commit

harness

qa-parallel

build-parallel

build