Configuration
The .ocra/config.json file and environment variables.
ocra reads .ocra/config.json from the root of the repository being reviewed. Every key is optional; unknown keys are rejected so typos fail loudly.
{
"models": {
"top": "google/gemini-3.1-pro-preview",
"standard": ["google/gemini-3.5-flash", "google/gemini-flash-lite-latest"],
"light": "google/gemini-flash-lite-latest"
},
"concurrency": 4,
"taskTimeoutMinutes": 10,
"runTimeoutMinutes": 25,
"verify": true,
"judge": true,
"maxCostUsd": 1,
"include": [],
"exclude": ["legacy/**"],
"runtime": "opencode",
"plugins": [],
"reviewers": {},
"pluginSettings": {}
}Models
Models are written as provider/model, using OpenCode's provider IDs (for example google, anthropic, openai). Each tier takes one model or a failback chain:
| Tier | Used for |
|---|---|
standard | Reviewer agents |
light | Helper calls such as grouping changed files |
top | The judge |
When a model is overloaded or rejects a request, the task retries on the next model in the chain. A rate limit with a short stated wait (up to 90 seconds) pauses that model for every task and retries it; a limit marked as daily, a longer or missing wait, or a fourth limit in a row takes the model out of the chain for the rest of the run. Each model has a circuit breaker: after two failures in a row it is skipped for a minute, then one request probes it; success brings it back, another failure skips it for twice as long (up to ten minutes). Credential errors stop immediately, because another model of the same provider would fail too.
Environment variables override the file, comma-separated for chains:
export OCRA_MODEL_STANDARD="google/gemini-3.5-flash,google/gemini-flash-lite-latest"
export OCRA_MODEL_LIGHT="google/gemini-flash-lite-latest"
export OCRA_MODEL_TOP="google/gemini-3.1-pro-preview"Provider keys
Keys are read from the environment only. Use the variable your provider expects in OpenCode, for example ANTHROPIC_API_KEY or OPENAI_API_KEY. For Google, GEMINI_API_KEY, GOOGLE_API_KEY and GOOGLE_GENERATIVE_AI_API_KEY all work.
The agent runtime receives only what it needs from your environment: PATH, HOME, locale, proxy and CA settings, and the credentials of the providers named in your model chains (for a provider ocra does not know, every variable starting with its uppercased id, such as GROQ_ for groq). Anything else, like cloud credentials or GITHUB_TOKEN, stays out. If a provider needs another variable, list its name in OCRA_RUNTIME_ENV, comma-separated.
For providers that always need a key (Google, Anthropic, OpenAI, OpenRouter, Groq, Mistral, DeepSeek, xAI, Azure), ocra checks before starting that one is set and names the variable if it is missing.
Execution
| Key | Default | Meaning |
|---|---|---|
concurrency | 4 | Review tasks running at once (1–32) |
taskTimeoutMinutes | 10 | Limit for one review task |
runTimeoutMinutes | 25 | Limit for the whole run |
maxCostUsd | none | Spend limit for the run: review tasks use up to 80% of it, verification and judging the rest (see --max-cost-usd) |
judge | true | Merge, filter and recalibrate findings across reviewers (one top-tier call per run with findings) |
verify | true | Fact-check findings before reporting them (one standard-tier call per file with findings) |
A task that fails or times out never fails the run; its files are reported as failed.
File selection
ocra skips binary files, likely secrets (.env, keys, certificates, cloud and registry credentials, *.tfvars), deleted files, media and archives, lock files, vendored and generated code, and very large diffs. Files over 1 MB are diffed as binary and skipped. Database migrations are always reviewed.
exclude: globs to skip in addition.include: globs to review even if they would be skipped as generated or by extension. Secrets can never be included.
Reviewers
reviewers.<id> turns a reviewer off or raises the risk tier it starts at. Risk tiers, from lowest: trivial (≤10 changed lines), lite (≤100), full (larger changes, more than 20 files, or sensitive paths such as auth/ and CI workflows).
{ "reviewers": { "correctness": { "minTier": "lite" }, "security": { "enabled": false } } }Pairs the matrix skips are listed under skipped in the JSON report; a file no reviewer covers shows up as unreviewed in coverage.
Shared configuration
An organization can keep common settings in one place and let repositories extend it:
{ "extends": "https://config.example.com/ocra.json#sha256=<hex>" }The shared file may set models, concurrency, the timeouts, verify, judge, maxCostUsd, include, exclude, reviewers, github and rules (the same shape as .ocra/rules.json entries). It cannot list plugins or choose a runtime: it comes from outside the repository and must not run code. The repository's own values win; include, exclude and rules are combined and models, reviewers and github are merged key by key.
Only https URLs are accepted, without redirects, up to 256 KB. The optional #sha256= fragment pins the exact content. If the file cannot be loaded or is invalid, ocra warns and continues with the repository's own settings.
Plugins
runtime names the registered runtime to use. plugins lists extra plugins by package name or path, and pluginSettings.<plugin-name> holds each plugin's settings. See Plugins.