I expected Bitbucket AI code review to copy the GitHub story, and I hit three surprises instead. The first covers Bitbucket Data Center, the second Bitbucket Cloud, and the third both. I checked every claim below against vendor docs in October 2026, because the listicles I started with didn't agree with each other.
| Tool | Best for | Bitbucket Cloud | Bitbucket Data Center | Who pays per review |
|---|---|---|---|---|
| Qodo | Teams on Cloud, Data Center or both | Yes | Yes, including on-prem and air-gapped | Workspace credits |
| Rovo Dev code review | Atlassian Cloud teams that want review inside Rovo | Yes | Not documented | The PR author's Rovo Dev credits |
| CodeRabbit | A hosted reviewer on Cloud or Data Center | Yes | Yes, through a bot user | Not documented |
| Browser extension (ThinkReview) | Individual reviewers on Data Center | Yes, with an API token | Yes, with an HTTP access token | The extension's review credits, or a local model |
My first search for Data Center support turned up two 2026 listicles from code review vendors. One said a tool supported Data Center, and the other said the same tool didn't. One of them still used Qodo's old name, so its research predated the rebrand.
I went to the docs instead. Qodo's deployment table lists Bitbucket Data Center under multi-tenant, single-tenant, on-premises and air-gapped. Bitbucket Cloud runs multi-tenant and single-tenant, the two models a cloud product needs.
A Bitbucket code review tool either documents Data Center support on its own site or I treat it as unsupported until a vendor engineer shows me. Listicles are where I start, not where I decide.
When the docs are vague, I'd ask the vendor three questions. Which Data Center versions do you test against? Does the reviewer run inside my network or call in from yours? Who creates the bot user? A vendor that answers all three in writing usually supports Data Center properly.
Rovo Dev is Atlassian's AI agent, and code review is one of its jobs. I assumed a workspace would pay for reviews like build minutes. Credits come out of the PR author's allocation instead (Atlassian Rovo Dev activation page, October 2026), and that billing model changed five things I hadn't planned for.
Atlassian's rollout page covers compliance too. Rovo Dev hasn't been externally audited for ISO 27001 and SOC 2 compliance yet, isn't HIPAA compliant and doesn't support data residency (Atlassian, October 2026). Regulated teams should read that page before a pilot.
There's one more catch for me. Rovo Dev also writes code, and you shouldn't review code with the same tool that wrote it, because the reviewer inherits the writer's blind spots. In one study, models caught fewer injected errors when the review ran in the session that wrote the work (arXiv 2603.12123, March 2026).
I expected Data Center to vanish with the rest of Atlassian's Data Center line. Impacted products reach end of life on March 28, 2029, but Bitbucket and Bamboo Data Center will not (Atlassian Data Center end-of-life notice).
Existing Data Center customers get a Hybrid License covering Data Center and Cloud from early 2027. Atlassian names compliance, data sovereignty and air-gapped requirements as reasons customers stay on Data Center. Security researchers describe the same limit for AI review, where source code can't be sent to an externally hosted model (arXiv 2610.27383, October 2026).
Atlassian also keeps building for agents on Data Center. Bitbucket Data Center 10.5.0, released on September 29, 2026, added a bundled server for the Model Context Protocol, and admins limit the tools it exposes with a whitelist file. A reviewer that only supports Cloud leaves those teams out for years.
Data Center's long future changed the buying question for me. I'd planned to pick a Cloud-first reviewer and live with gaps until a migration. Now I'd pick a reviewer that treats Data Center as a first-class platform, because the hybrid license means some teams will run both for a long time.
Data Center is where the reviewer choice gets hard, because the server sits inside your network. A hosted reviewer needs a way in for webhooks and a way out for comments. An on-prem reviewer runs next to Bitbucket and never leaves the building.
Qodo handles both cases. The same Data Center wizard works for multi-tenant, single-tenant and on-premises deployments, and air-gapped installs forward model calls to your own OpenAI-compatible endpoint, so code never leaves the network. The air-gapped code review setup is the one regulated Bitbucket shops tend to ask about.
Regulated teams usually shortlist from secure code review tools first, and Data Center support is the filter that shortens that list most.
For the air-gapped route, the platform team installs Qodo on Kubernetes with a mirrored image bundle and points the bundled gateway at an internal model endpoint. Once that endpoint is configured, Qodo needs no outbound access to a public model API, and the Bitbucket connection itself runs through the same wizard below. The wizard starts in the Qodo portal. In the Data Center docs I read, the flow looks short. You pick Bitbucket, then the self-hosted option, and Qodo asks how you want the bot account created. Configuration typically takes around five minutes, and on Data Center the new wizard brings Review Standards and findings with it.
qodo-bot account, registers the webhooks and warns you before its token expires.
If my security team didn't want to hand admin credentials to any vendor, manual setup, which arrived in Qodo 3.0 on October 1, 2026, is the route I'd pick.
qodo, such as svc-qodo, and the user needs write access to the projects Qodo should review.
Qodo on Bitbucket runs the same review loop as on GitHub, with a few Bitbucket-specific touches worth knowing before the first PR. Reviews run on every push, and Qodo updates its findings as you commit fixes.
Findings arrive in full as standard markdown, since Bitbucket has no collapsible sections, and older resolved findings move to the Qodo portal to keep long PRs readable.
Two settings exist only on Bitbucket and Gerrit. One shows section titles inside each finding, and the other links each finding in the summary to its inline comment, which helps on long PRs.
Jira works as ticket context, so Qodo can check a PR against the linked issue's acceptance criteria. Atlassian shops get review tied to the ticket, and the review commands, /agentic_review, /agentic_describe and /ask, all work on Bitbucket the way they do elsewhere.
The three surprises gave me the first three checks, which are docs over listicles, who pays and where code goes. Reading the Data Center setup docs added setup permissions, and planning review across many teams added governance and independence. I'd run every Bitbucket AI reviewer through them, in this order.
The academy guide to the Bitbucket AI code review goes deeper on each check. I read each tool's own Bitbucket setup, billing and deployment docs in October 2026 and scored them against the six checks. "Not documented" means I couldn't find it in the vendor's public docs.
| Check | Qodo | Rovo Dev code review | CodeRabbit | Browser extension |
|---|---|---|---|---|
| Cloud and Data Center | Both | Cloud | Both | Both |
| Who pays, what gets skipped | Workspace credits with an optional monthly spending cap | Author's credits; large PRs may be skipped | Not documented | Review credits, or a local model |
| Where code and model calls go | Your network on-prem or air-gapped | Atlassian cloud | CodeRabbit cloud; reverse tunnel for private instances | Your browser and local model |
| Setup permissions | Admin once, or a qodo-named user plus webhook | Repository connection in Rovo | Bot user, HTTP access token, OAuth consumer | Personal HTTP access token |
| Governance across repos | Rules and findings on Cloud and Data Center | Not documented | Not documented | No |
| Independent of the coding agent | Yes, reviews code from any agent | Same vendor as the agent | Yes | Depends on the model |
Qodo is a code review platform that reviews pull requests on Bitbucket Cloud and Bitbucket Data Center, along with GitHub, GitLab, Azure DevOps and Gerrit. On Data Center, Qodo runs multi-tenant, single-tenant, on-premises or air-gapped, which makes it my pick for Data Center teams that need on-prem or air-gapped review.
Qodo's governance features are a big part of why it shows up among agentic code review tools for enterprise teams. On Bitbucket Cloud, organization rules and organization-wide findings roll up across every repository, so leaders see one view of review across teams.
Qodo is best for teams that run Bitbucket Cloud, Data Center or both and want one reviewer for all of it. Pick Qodo when Data Center has to stay on-prem or air-gapped.
Qodo covered Cloud and Data Center down to air-gapped installs, with your own model endpoint and a reviewer separate from the coding agent. Data Center depth made Qodo my first pick.
Rovo Dev code review is Atlassian's AI reviewer for pull requests, and Rovo Dev works on Bitbucket and GitHub repositories connected to Rovo (Atlassian, October 2026).
Rovo Dev code review is best for Atlassian Cloud teams that want review inside Rovo and keep PRs small.
Rovo Dev runs inside Atlassian Cloud. The author-paid credits, the size limits, the missing audits listed on its rollout page and the same-vendor overlap with its coding agent kept it below Qodo for me.
CodeRabbit is an AI PR reviewer that supports Bitbucket Cloud and Bitbucket Data Center. Data Center setup uses a bot user with an HTTP access token plus an OAuth consumer, with webhooks configured automatically.
.coderabbit.yaml.
CodeRabbit is best for teams on Bitbucket Cloud or a reachable Data Center server that want a hosted reviewer.
CodeRabbit documents a bot-user setup for Data Center. In the hosted setup, review traffic leaves your network, so it doesn't fit the air-gapped teams Atlassian names as Data Center's audience. CodeRabbit's self-hosted overview lists a self-hosted option for Bitbucket Data Center on its Enterprise plan.
ThinkReview is a browser extension that reviews PRs in the page you're reading. ThinkReview works with Bitbucket Cloud through an API token and Data Center through an HTTP access token, and reviews can run through a local Ollama model.
A browser extension is best for one developer who wants a second opinion on Data Center PRs today.
With a local model, the extension keeps code on your machine and needs no admin. Nothing rolls up across a team, so it can't cover the governance check.
Checking Data Center support in the vendor's docs, knowing who pays for each review and planning for Data Center past 2029 all point to the same answer. Qodo passed those checks on Cloud and Data Center, air-gapped included, as an independent reviewer. Pick Qodo when one reviewer has to cover every Bitbucket you run.
Teams that also run GitHub or GitLab can compare options in our roundup of tools for GitLab AI code review, where Qodo reviews with the same loop.
Qodo's earlier post on Bitbucket code review covers the human side of the workflow. AI code review works almost the same on Bitbucket Cloud and Data Center. Qodo reviews PRs on both with the same review commands and markdown comments. Data Center adds on-prem and air-gapped deployment, and wiki-based configuration stays a Cloud option.
You can run AI code review on-prem or air-gapped with Bitbucket Data Center. Qodo supports on-premises and air-gapped deployments for Bitbucket Data Center, with model calls going to your own endpoint.
Rovo Dev includes 350 credits per user on Free, about 2 to 8 code reviews, and 2,000 credits per Standard user each month, and credits come from the PR author (Atlassian, October 2026). Qodo bills the workspace through credits instead, with an optional spending cap, so reviews don't stop when one author runs out.
AI code review works alongside Bitbucket Pipelines rather than inside it. Qodo reviews pull requests through webhooks, so it works the same whether you build with Bitbucket Pipelines, Jenkins or another CI system.
A Bitbucket reviewer needs either admin credentials once or a dedicated bot user. For Qodo on Data Center, that means admin credentials used once, or a user whose name contains qodo with write access, plus a webhook an admin creates.
On Bitbucket, Qodo comments use standard markdown, and two display settings exist only on Bitbucket and Gerrit.
Inline comment severity thresholds, feedback on draft PRs, chat on code suggestions, Rule Miner and Relevance run on GitHub and GitLab, with draft-PR feedback and Rule Miner on Azure DevOps and severity thresholds on Gerrit, and none of them run on Bitbucket.