Open Source Radar — November 15: Alibaba's Open Code Review
Today's board is the verification layer — the tool Alibaba used internally for two years before releasing it, Chrome's own DevTools opened to agents, and the protocol for the part where a person has to look.
open-code-review (Go, 51,645 stars) is the AI code review CLI Alibaba ran internally for two years before open-sourcing it under Apache-2.0 in May, and it shipped v1.13.10 today. The design choice is the interesting part: file selection, file bundling and rule matching are deterministic Go code, and only the decisions that need judgment go to the model — which the repo says is why it does not quietly skip files on a large diff or drift the line numbers of its comments. On its own benchmark of 200 real pull requests from 50 repositories, with ground truth from more than 80 senior engineers, Alibaba reports higher precision and F1 than a general-purpose agent on the same model at roughly a ninth of the tokens, and concedes lower recall as a deliberate trade for less noise. It runs as a CLI, as plugins for Claude Code, Codex, Cursor and Kimi Code, and as an MCP server, so the obvious use is a review gate in CI rather than another chat window.
chrome-devtools-mcp (TypeScript, 56,536 stars) is the MCP server that lets a coding agent drive a live Chrome: performance traces, network requests, console messages with source-mapped stack traces, screenshots, accessibility checks. It is maintained by Chrome's own DevTools team, and version 1.13.0 on November 11 added a standalone CLI plus bundled skills — including dedicated ones for accessibility audits, cookie and session debugging, Largest Contentful Paint and memory leaks. That is the difference between an agent that tells you the page works and an agent that measured LCP before and after its change. If your agent writes frontend code, this is the cheapest way to give it eyes.
ag-ui (TypeScript, 17,503 stars) is an MIT-licensed protocol for the agent-to-interface hop: roughly 16 standard event types that an agent backend emits while it works, and a few simple inputs it accepts back, carried over SSE, WebSockets or webhooks. It grew out of CopilotKit's partnership with LangChain and CrewAI and now has first-party clients for CopilotKit, Slack and Teams, React Native and OpenBot. Use it when you are building your own chat surface and would rather not invent streaming state sync, generative UI events and human-in-the-loop pauses from scratch — that plumbing is where most agent frontends quietly stall.
univer (TypeScript, 25,159 stars) is a spreadsheet and document SDK that has spent four years rebuilding Excel-class editing in the browser, and has now repositioned itself as the foundation of an "AI office": editing, calculation and file processing for people and agents. Version 1.5.0 landed on November 14, and the headless content operations are the part that matters for agents — read and edit a workbook, then check the result, without rendering a screen. Be clear-eyed about the split: the open core is Apache-2.0 and covers sheets, docs, formulas, rendering and the command system, while charts, pivot tables, real-time collaboration and the AI SDK extensions are commercial. The free tier gets you an editor, not a finished Office replacement.
The pattern: the open-source money has moved from generation to verification — reviewing what the model wrote, letting it measure the page it just changed, and giving a person a fast place to intervene.
Worth watching this week: whether Alibaba's precision-first review benchmark becomes the yardstick other code-review agents publish against, the way SWE-bench did for coding.
Which of these actually belongs in your pipeline — a review gate that misses bugs, or one that flags too many? Write to us via our contact page.
