Reviewing AI-generated code on GitLab and Azure DevOps: what actually exists

A developer's review of AI-generated code review options for GitLab and Azure DevOps found that neither forge documents a native flag marking merge requests as AI-authored, and that CodeRabbit's Slop Detection is GitHub-only. The review points to SonarQube Server's documented CI/CD-based automated code review and quality gates as the practical guard against low-quality AI-generated pull requests on those platforms, including self-managed editions.

When you look for a way to catch low-quality AI-generated pull requests, the tool everyone names is CodeRabbit Slop Detection. Read its own docs and you get one line that settles the whole question: "On GitHub repositories." GitHub-only. The SERP is thin on the non-GitHub forges https://mergerequests.dev/blog/slop-detection-for-gitlab-azure-devops-and-bitbucket/ and the feature itself sits behind an early-access footnote on the Essentials plan. So what do you actually run for AI-generated code review on GitLab and Azure DevOps, including the self-managed editions? I went to the vendors and read what is documented. Neither GitLab nor Azure DevOps documents a native flag that marks a merge request as AI-authored. The vendors do not expose that signal as a first-class review input. Treat any listicle that says otherwise as unverified, because the docs do not say it. SonarQube Server, the self-managed delivery, addresses AI-generated code directly. From the SonarQube Server docs https://docs.sonarsource.com/sonarqube-server/latest/ read 2026-09-18 : "All new code, whether written by a developer or generated by an AI agent, should meet the same quality and security standards." The mechanism is not classification. It is automated code review on each merge request, run in your CI/CD pipeline, that surfaces bugs, vulnerabilities, and maintainability issues, with quality gates that block failing code from merging. That is the honest shape of the answer on these forges. You do not detect "AI-ness". You apply the same ruleset to every pull request and gate on the outcome. It catches the low-quality PRs regardless of who or what wrote them, which is the actual risk you are defending against. The GitLab integration and the Azure DevOps integration are both documented on SonarQube Server, and analysis runs in CI, so it works on self-managed GitLab and Azure DevOps Server, not just the hosted tiers. If your stack is GitLab or Azure DevOps and you want a guard against AI slop, look for pull-request static analysis with a quality gate that runs in your pipeline. That exists and is documented. A tool that tells you a percentage of a PR was machine-written does not have a documented home on these forges as of today. One limit to flag: SonarQube's AI-specific features, including anything around AI code assurance, are gated by license and edition, and I did not verify those limits this week. Claim only what the homepage documents. Absence of a documented "AI-authored" flag on a forge is not the same as a documented guarantee that the flag will never exist. But building review policy on something the docs do not state is how teams get burned.