Open Code Review

Open Code Review is a linter built specifically for the mess AI code generators leave behind. It scans for hallucinated imports (when Claude invents a package that doesn't exist), deprecated API calls, and common security anti-patterns that LLMs love to suggest. The idea is sound: AI-generated code fails in predictable ways, so you need predictable checks. I've run it in a pre-commit hook on a Next.js project where I was leaning hard on Claude for boilerplate. It caught two phantom imports in one week, both from Claude confidently referencing non-existent utility libraries. The deprecated API detection flagged an old React lifecycle method I'd asked Claude to refactor but it had quietly ignored. Security checks are basic but useful: hardcoded secrets, eval() calls, that sort of thing. The workflow is straightforward. Install globally, point it at a directory or file, and it spits out a report. You can pipe it into CI with exit codes, which is where it earns its keep. I've seen teams gate PR merges on it, especially when juniors are copy-pasting AI suggestions without reading them. Quirks: it's opinionated about what counts as a hallucination, and you'll need to tune the ruleset if you're working in a less common language or framework. The docs assume you know your way around npm and CI config. It doesn't integrate with every IDE, so you're mostly running it as a CLI step. Also, it won't catch logic errors or architectural mistakes, just the surface-level stuff AI gets wrong. Skip this if you're not using AI to write code, or if your team already has a robust linting and security scanning pipeline that catches these issues. It's redundant if you're running ESLint with strict rules and a proper dependency audit. But if you're shipping AI-generated code at speed and want a safety net that understands the failure modes of LLMs, this is a sensible addition to your toolchain.