Open Code Review in 2026: The Open-Source Tools, the Self-Host vs Hosted Split, and What "Free" Really Costs

Open code review in 2026 is no longer a metaphor. Alibaba open-sourced its internal AI reviewer as open-code-review this summer, joining a self-hosted field that includes Qiniu's ReviewBot and PR-Agent — tools you run with your own model keys, on your own server, wired into your own CI. The license is free; what actually costs you is everything around it: model tokens, a place to run it, and the security plumbing that keeps a reviewer from leaking the code it reads. Our recommendation is the hosted route — review on a gateway that passes provider list prices straight through with no markup and uses the keys you already have. That is the case our code review page makes, and this guide walks through the tools, the cost ledger, and the cases where the hosted answer is the wrong one.

Searching "open code review" in August 2026 mostly surfaces the open-code-review repository, documentation mirrors, and an npm page. They tell you the tool exists and how to install it. None of them answers the decision underneath: open-source and self-hosted are not the same choice, "free" stops at the license, and the model tokens cost the same list price whether you host the reviewer or not. This page is that missing decision guide — and it is a product guide, not a model review.

What "open code review" means in 2026

The term has a concrete referent now. In mid-2026 Alibaba released open-code-review, its internal AI code-review assistant, under an Apache-2.0 license — two years of internal use, tens of thousands of developers, millions of defects flagged. Its design is a hybrid: deterministic pipelines handle file selection, rule matching and comment positioning, while an LLM agent does the reasoning. You install it with npm install -g @alibaba-group/open-code-review, then ocr review reviews the workspace, ocr scan audits an unfamiliar codebase, and ocr config model points it at any OpenAI- or Anthropic-compatible endpoint, including a local one. It ships a fine-tuned ruleset covering NPE, thread-safety, XSS and SQL injection, and it is deliberately conservative: on its own AACR-Bench evaluation (50 popular repositories, 200 real pull requests, cross-validated by more than 80 senior engineers), it reports higher precision than a general-purpose agent like Claude Code at roughly a ninth of the tokens — with lower recall, a trade-off that favors a few accurate comments over exhaustive noisy ones.

The open-source field around it is broader. Qiniu's ReviewBot is a self-hosted reviewer for GitHub and GitLab that orchestrates linters (golangci-lint, pylint, shellcheck and friends) and adds an AI layer that explains findings and suggests fixes; it deploys in Docker or Kubernetes. PR-Agent (MIT) started this category as a GitHub Action with /review, /improve and /ask commands and a CLI you can run anywhere. What the whole field shares: none of them ships the model. You bring your own API key to whichever provider you choose, and that is where the real cost story starts.

Self-hosted vs hosted — the ledger nobody prints

A free license is not a free tool. The moment you self-host any of these you are on the hook for five things:

• Model tokens. The same list price you would pay through any gateway — self-hosting does not discount them.

• A place to run it. A server, a CI runner, or a container platform with enough memory and a webhook endpoint open.

• The wiring. Repo permissions, token lifecycle, the webhook → reviewer → comment loop, and updates when the tool or the provider changes.

• Guardrails. A reviewer that reads your diffs can forward secrets to the model provider, pass PII across a border, or fall for a prompt-injection hidden in a PR comment that tells it to approve. Self-hosted open source makes you the security team; none of the READMEs hand you that.

• Audit. Who reviewed what, which model, at what cost, and what was flagged — you build the log.

The tokens cost the same on both sides of the ledger. A typical review pass reads about 25K input tokens and writes 4K. At GPT-5.5 list prices — $5 per million input, $30 per million output — one pass is about $0.245. At DeepSeek V4 Flash, at $0.14 and $0.28 per million, a screening pass is a fraction of a cent. Self-hosting does not lower that bill; you still pay the provider's list price. What self-hosting buys is privacy and control, and what it costs is ops and security work.

The hosted route with zero markup — OrcaRouter

This is where the gateway answer earns its place. OrcaRouter is a 0%-markup AI gateway: provider list prices pass straight through — the site states a "zero markup guarantee" — and it supports bring-your-own-key, so you can use the provider keys, rate limits and credits you already hold. Two hundred-plus models sit behind one OpenAI-compatible endpoint, and the code-review feature is built into the gateway itself rather than sold as a separate per-seat product. That last point is the one to notice: review is a routing recipe on infrastructure you may already be paying for, not another subscription.

OrcaCode Review runs as a two-stage recipe. Every push is screened by a cheap frontier model in seconds; clean passes are promoted to a strong model for a deep pass; and P0-P1 findings fail the GitHub check, blocking the merge until fixed or waived. The default recipe runs on GPT-5.5 at list price, and because it is an ordinary gateway recipe, either pass can be swapped to any of the 200+ models — or split, with a cheap screen on DeepSeek V4 Flash and a strong final pass on a frontier model. It installs as a GitHub App in one click with no repository secret and no workflow file, or as a single workflow file for teams that want the action in their own CI.

The guardrails a self-hosted reviewer forces you to build are on by default on the gateway. PII Shield and content policy are enforced before you are billed — a request that trips them is intercepted before a token is charged. The agent firewall grades tool and MCP calls before they run. Every call leaves a request log — grade, model, latency, cost — and the platform carries a full audit trail with seats, spend caps and RBAC. For code review specifically, secrets, PII and prompt-injection are masked before the tokens leave your repository. Be precise about what that buys: these are pre-billing and pre-run gates plus a log, not a proof that your code is secure. The review finds candidate issues; a human still makes the severity call on the serious ones.

What it actually costs

Run the numbers on the estimator OrcaRouter publishes on its code-review page. A five-developer team, 40 pull requests a month, four pushes per PR, roughly 25K-in/4K-out tokens per pass at GPT-5.5 list prices: about $53.90 a month in tokens. Against that, CodeRabbit Pro is $24 per developer per month on annual billing — roughly $120 for five seats — and Greptile is $30 per seat. Cursor's Bugbot moved to usage-based billing in June 2026 at about $1.00–1.50 per review. The gateway bills the tokens you actually use at the same list price you would pay the provider directly, with no markup, and BYOK lets those tokens come out of credits you already hold.

Per-seat products buy you polish and a maintained workflow, and they scale with headcount, not usage. Token-priced review scales with review volume. At very small team sizes per-seat can win; once the PR volume is real, per-token is cheaper, and the gap widens as reviews grow.

When this recommendation is wrong

• Your code cannot leave your network. Air-gapped teams should self-host the open-source tool — or run OrcaRouter Enterprise, which can deploy the whole gateway, router, guardrails and review action inside your own VPC. No hosted option passes that bar, and it is a compliance line, not a preference.

• You want zero vendor and full prompt control. The open-source tools are auditable, forkable and yours. OrcaCode Review's recipe is editable, but it is still hosted. If open source is a policy decision at your company, the open-source tool is the honest answer — and it costs you the security work above.

• Your PR volume is tiny. A handful of reviews a week does not need routing. open-code-review with your own key is genuinely fine there; the gateway earns its keep once there are enough pull requests to amortize it.

• You live in GitLab or Bitbucket. The one-click review app is GitHub today. ReviewBot natively covers GitHub and GitLab, so a GitLab shop should weigh that in — or wire the workflow-file path into GitLab CI.

• You treat AI review as certification. LLMs drift between runs, hallucinate, and cannot prove exploitability. Gate the merge on critical findings, re-run after fixes, and keep a human responsible for architecture and design review. The cheap screen and the strong pass catch real bugs; they do not replace a reviewer who knows the system.

The short version

Open code review in 2026 is real, open-source, and free only up to the license. Alibaba's open-code-review, Qiniu's ReviewBot and PR-Agent are worth knowing — they are all bring-your-own-key, and they all bill you in model tokens, ops time and security work. The hosted route looks more expensive until you price the ledger: on a 0%-markup gateway with BYOK it bills the same list prices your self-hosted setup would pay, and the guardrails, agent firewall and audit trail come with it. Start there, and self-host when the code cannot leave the building.

If the hosted route is where this lands, the full walkthrough — and the cost estimator — is onour code review page: a 0%-markup gateway, your own model keys, and P0-P1 findings that gate the merge. Install the GitHub App free, no credit card.