orcacode-review

OrcaCode Review

AI code review that catches serious issues before they merge — powered by OrcaRouter.

Automatically review every pull request, post findings directly on the affected lines, and block serious issues from merging.

P0/P1 → ❌ Block · P2 → 💬 Comment · Clean → ✅ Pass

How it works

PR → Fast Review → Strong Review → Merge Gate
        │               │
     P0/P1?           P0/P1?
        ↓               ↓
      BLOCK           BLOCK

Every PR starts with a fast, low-cost model. Once clear of P0/P1 issues, OrcaCode automatically escalates to a stronger model for the final review.

You choose the models in OrcaRouter. OrcaCode handles the review.

What you get

• 🔍 Automatic review on every PR
• 💬 Inline P0 / P1 / P2 findings
• 🛑 Merge gate for serious issues
• ⚡ Fast → strong model cascade
• 🧠 Choose your own review models
• 🎯 Precision filtering to reduce false positives
• 🔒 OrcaRouter guardrails + security policies
• 🔄 Re-run anytime with /orcacode-review

One-command install

Either installer writes the workflow, guides you through the API key, and sets up the merge gate.

Terminal — no install required:

npx orcacode-review

Claude Code — as a plugin:

/plugin marketplace add Continuum-AI-Corp/orca-code-review
/plugin install orca-code-review

Then ask: "set up OrcaCode Review in this repo". The skill also handles reconfiguring, troubleshooting, and uninstalling.

The CLI has the same lifecycle commands:

npx orcacode-review init          # write the workflow
npx orcacode-review reconfigure   # change blocking rules, diff limits, where config lives
npx orcacode-review doctor        # diagnose reviews that don't run or don't post
npx orcacode-review uninstall     # remove it (drops the merge gate first)

Prefer to wire it by hand? The manual steps are below.

Use it from any agent

The setup skill installs into 36 agent platforms — the same catalog the OrcaDub MCP server uses, so IDs and paths match across Orca products.

npx orcacode-review skill list      # all 36, with the ones detected here marked
npx orcacode-review skill install   # pick from a checkbox list; detected agents pre-checked

Detected platforms are pre-selected. For unattended or agent-driven setup, name them:

npx orcacode-review skill install --platform claude --platform codex --scope project --yes
npx orcacode-review skill install --platform cursor --scope global --yes

Claude Code, Cursor, Codex, OpenCode, Windsurf, Cline, RooCode, Continue, GitHub Copilot, Gemini CLI, Amazon Q Developer, Qwen Code, Kilo Code, Auggie, Kimi Code, Kiro, Lingma, Junie, CodeBuddy Code, CoStrict, Crush, Factory Droid, iFlow, Pi, Qoder, Antigravity, Antigravity 2.0, Bob Shell, ForgeCode, Trae, Trae CN, ZCode, MimoCode, Hermes, OpenClaw, Command Code.

An existing identical skill is left unchanged; an existing different one is preserved unless you pass --force. Use --json for structured output and NO_COLOR for plain text.

Language

The CLI speaks English and Simplified Chinese, picked from your locale (LC_ALL / LC_MESSAGES / LANG). Override it per run, or pin it for good:

npx orcacode-review --lang zh          # 中文界面
npx orcacode-review --lang en          # English
export ORCACODE_LANG=zh                # 固定下来

Guided flows open with a language screen when --lang is not given. Add --no-banner to skip the wordmark.

Only prose is translated — flags, platform IDs, workflow inputs, and shell commands stay verbatim, because you still have to type them.

Quick Start

1. Enable OrcaCode Review

Go to OrcaRouter → Apps → OrcaCode Review and turn it on.

Configure your models, review mode, severity rules, merge policy, and other settings directly from the console.

2. Install the GitHub Action

Install OrcaCode Review from GitHub Marketplace →

Add the Action to your repository:

- uses: Continuum-AI-Corp/orca-code-review@v1
  with:
    orcarouter-api-key: ${{ secrets.ORCAROUTER_API_KEY }}

3. Add your API key

Create or copy a key from OrcaRouter → API Keys.

Add it to your GitHub repository as:

ORCAROUTER_API_KEY

under Settings → Secrets and variables → Actions.

4. Open a PR

That's it.

OrcaCode automatically reviews new PRs and pushes, posts findings inline, and reports the merge gate.

Severity

Severity	Meaning	Result
P0	Critical / blocker	❌ Block
P1	High severity	❌ Block
P2	Advisory	💬 Comment

Customize the rubric and blocking policy from OrcaRouter → Apps → OrcaCode Review.

Configure without touching YAML

Manage OrcaCode from OrcaRouter → Apps → OrcaCode Review:

• Models — choose your fast + strong reviewers
• Review mode — every push, ready for review, or on demand
• Merge policy — choose which severities block
• Exhaustive review — run additional strong-model passes
• Quiet mode — keep P2 findings in the summary
• Custom rubric — define your own review rules
• Guardrails — add security and policy checks

Change your review strategy anytime. No GitHub workflow edits required.

Re-run a review

Comment on any PR:

/orcacode-review

to request another review.

Block merges

To make P0/P1 findings actually prevent merging:

GitHub → Settings → Branches / Rulesets → Require status checks to pass

Add the review check as required.

Security & Privacy

OrcaCode reads the PR diff and repository files required for review. It does not execute PR code.

Optional run reporting sends only review metadata — repository, PR, commit SHA, tier, severity counts, gate result, and engine version.

No source code, diff, or finding text is included in run reports.

OrcaRouter guardrails can add secret detection, PII detection, prompt-injection protection, code-security rules, and external security scanners.

See SECURITY.md for details.

Under the hood

OrcaCode Review uses Open Code Review as its review engine and OrcaRouter for model routing, policy, and control.

OrcaCode decides how to review. OrcaRouter decides what model runs it.

License

MIT © Continuum-AI-Corp.

Open Code Review is Apache-2.0. Attribution is preserved in NOTICE.