Air-gapped AI code review means the whole review, model calls included, runs with nothing crossing your network boundary. I design review pipelines for teams whose code can't leave the building, and I checked five tools against their own docs on October 27 and 28, 2026, ranking them on what a review sends over the wire.
TL;DR
- Self-hosted and air-gapped mean different things. A self-hosted reviewer can still call a hosted model over the internet, and an air-gapped one can't call anything outside your network.
- The test is zero egress with your own model endpoint. A tool passes when the review runs, model calls included, with no route out, and still reads more than the diff.
- Most regulated teams already find sovereignty hard. Most executives say meeting data residency or sovereignty requirements is challenging (IBM Institute for Business Value, June 2026).
- Local models are now good enough to pilot. A 2026 university study found local open-weight models matched an earlier agentic approach that used a hosted frontier model on secure code review (arXiv 2610.27383, October 2026).
- Qodo is my #1 because it runs air-gapped on all four self-hosted Git platforms. Qodo installs offline, sends model calls only to your own endpoint, and reviews code from any agent as an independent reviewer. Pick Qodo when your self-hosted Git has to stay fully inside the network.
The 5 Best AI Code Review Tools for Air-Gapped Environments
- Qodo: best for air-gapped review on all four self-hosted Git platforms
- Greptile: best for self-hosted review on GitHub, GitLab or Perforce
- Tabnine: best for air-gapped teams that want review and code completion from one private install
- SonarQube Server: best for rules-based static analysis with AI fixes on your own model
- A DIY reviewer on open-weight models: best for platform teams that want full control
| Tool | Best for | Air-gapped install |
|---|---|---|
| Qodo | Air-gapped review on all four self-hosted Git platforms | Supported, with your own OpenAI-compatible endpoint |
| Greptile | Self-hosted review on GitHub, GitLab or Perforce | Whole service can run air-gapped |
| Tabnine | Review and code completion from one private install | Private installation can run fully air-gapped |
| SonarQube Server | Rules-based static analysis with AI fixes on your own model | AI CodeFix runs without outbound internet |
| DIY on open-weight models | Platform teams that want full control | Whatever you build |
Air-Gapped vs Self-Hosted vs Single-Tenant: What Each Means
Vendors use "self-hosted" and "air-gapped" as if they were one word, and procurement teams pay for the confusion later. The difference comes down to what crosses your network boundary during a review. Air-gapped code review means nothing does.
Coding agents moved inside the firewall in 2026 too, and IBM added on-premises, sovereign cloud and fully air-gapped deployment for its Bob coding agent (IBM, October 1, 2026). Reviewers now get held to the same bar.
| Deployment mode | Where the reviewer runs | What leaves your network during a review |
|---|---|---|
| Multi-tenant SaaS | The vendor's shared cloud | Code context and model calls go to the vendor |
| Single-tenant | A dedicated instance, often in your cloud account | Code stays in the dedicated instance; model calls go wherever the instance points |
| On-premises (self-hosted) | Your own cluster | Model calls, license checks and image pulls may still go out |
| Air-gapped | Your own cluster with no route out | Nothing, so models, images and updates all come in by hand |
Teams in regulated sectors often start from compliance rules, and the glossary entry on HIPAA and FedRAMP compliance covers why auditors ask about data paths first. The mode you need follows from the data path your auditors accept.
Most IT decision-makers would pick on-premises, private or hybrid infrastructure for AI on sensitive data, in a survey commissioned by storage vendor Cloudian (Cloudian, March 2026). Switching later is hard, and most executives say changing AI vendor or model would be difficult (IBM Institute for Business Value, June 2026).
What Makes an AI Code Review Tool Work Air-Gapped
Banks, defense contractors and hospital networks I've worked with all apply the same five checks. I use them as a gate, in order, because a tool that fails the first one never reaches the others.
- Zero egress from install to review. The reviewer talks only to a model endpoint you run, and images and charts arrive as a bundle you mirror.
- Support for your self-hosted Git. The reviewer works with GitHub Enterprise, GitLab Self-Managed, Bitbucket Data Center or Gerrit, whichever you run.
- Context beyond the diff that stays current offline. Repository and PR history indexes refresh inside the network.
- Governance across many repos from one place. Rules, findings and analytics live at the organization level.
- Independence from the tool that wrote the code. The reviewer isn't the coding agent grading its own output.
Teams on GitLab Self-Managed usually feel the Git check first, because many reviewers document only cloud Git platforms. Teams on Bitbucket Data Center and Gerrit feel it even sooner, since fewer vendors list either one.
Our roundup of secure code review tools covers the wider category. The air-gapped list here is narrower, because most security reviewers still assume a cloud model.
Can You Run AI Code Review With Self-Hosted LLMs?
You can run AI code review with self-hosted LLMs as long as the reviewer accepts an OpenAI-compatible endpoint and you can serve a model behind one. Most self-hosted reviewers in 2026 speak that API shape, so a model served through vLLM, Ollama or an internal gateway can sit behind the reviewer without code changes.
Local models are good enough to test. A Monash and Melbourne paper ran agentic secure code review on local open-weight models and matched an earlier agentic approach that used a hosted frontier model (arXiv 2610.27383, October 2026). Every approach scored low in absolute terms, so treat the result as parity rather than a solved problem.
The authors frame the motivation in words any security lead will recognize, writing that "source code is confidential and cannot be sent to an externally hosted commercial model" (arXiv 2610.27383, October 2026). Air-gapped teams have said the same for years, and the paper gives them a tested way to act on it.
The model choice stays yours, and so does the evaluation. Before a pilot, I run the reviewer against a few dozen merged PRs with known bugs. I compare findings across two or three candidate models, using the steps in our AI code review POC.
Zero Data Retention vs Zero Egress
Zero data retention is a promise from a vendor that your code won't be stored after processing. Your code still leaves the network to get processed, and you trust a contract for what happens next.
Zero egress means the code never leaves at all. Security teams in air-gapped sites treat retention promises as irrelevant, because the question they ask is about the wire, not the vendor's disk.
The practical setup for zero egress is an internal AI gateway that fronts your models, logs every call and enforces which models each service may use. The reviewer then points at the gateway and never learns a public hostname.
I prove zero egress before I trust it. Apply a deny-all egress policy to the reviewer's namespace, allow only the gateway, Git server and database, and run a week of real reviews. Any blocked connection is a finding for the vendor, and a clean week is evidence for the auditors.
What Goes Stale When the Network Is Cut
Air-gapped systems age in place. Every component that a SaaS reviewer refreshes silently now needs an owner on your side.
- Models. New model versions arrive only when someone imports and approves them.
- Rules and review standards. Organization rules stay current only if the reviewer stores them inside your cluster.
- Repository and PR history indexes. Indexes must rebuild locally as code changes, or the reviewer reads last quarter's codebase.
- Container images and charts. Upgrades mean a new bundle, a new mirror and a change window.
Legal and security teams I work with want a written account of what leaves the environment before any pilot, and they ask early who carries upgrades. Put both answers in the pilot plan, with a named owner for models, rules, indexes and images.
How I Evaluated the Tools
I read each vendor's own deployment, networking and model-provider docs on October 27 and 28, 2026, and scored each tool against the five checks. "Not documented" means I couldn't find the answer in public docs, not that the feature is missing.
| Check | Qodo | Greptile | Tabnine | SonarQube Server | DIY |
|---|---|---|---|---|---|
| Zero egress, install to review | Own OpenAI-compatible endpoint; chart bundle plus full image mirror | Any OpenAI-compatible API; registry credentials from Greptile | Fully air-gapped private installation; offline bundle not documented | Self-hosted gateway; self-managed install | You build and package it |
| Self-hosted Git covered | All four | GitHub, GitHub Enterprise, GitLab, Perforce | Through a CLI step in CI | GitHub, GitLab, Bitbucket, Azure DevOps | You wire it |
| Context beyond the diff | Repository indexing and cross-repo context | Codebase indexing with an embedding model | Not documented | Rules over the analyzed code | Diff unless you build more |
| Governance across repos | Organization rules and findings, with analytics in the portal | Not documented | Not documented | Quality gates per project | You build it |
| Independent of the writing tool | Yes, reviews code from any agent | Yes | Same vendor as the assistant | Yes | Depends on your model |
The Tools Ranked
1. Qodo: Best for Air-Gapped Review on All Four Self-Hosted Git Platforms
Tool Overview
Qodo is a code review platform that runs as multi-tenant SaaS, single-tenant, on-premises or air-gapped. Qodo supports air-gapped installs on GitHub Enterprise, GitLab Self-Managed, Bitbucket Data Center and Gerrit, the four self-hosted platforms I see at regulated companies. Qodo is the reviewer I'd pick for teams on self-hosted Git that need review with zero egress.
Main Features
- Your own model endpoint, with no call to a public API. The bundled LLM gateway forwards requests to the OpenAI-compatible endpoint you configure and runs no model itself. Once you configure your endpoint, Qodo needs no outbound access to api.openai.com.
- An offline install path. Qodo runs on Kubernetes 1.25 or later with Helm 3, and air-gapped installs use the chart bundle plus a complete image mirror, because registry credentials alone don't make images available offline.
- Single sign-on from your own identity provider. Prerequisites include an identity provider such as Entra, GCC High, Ping, Okta or Google Workspace, so SAML SSO or OIDC stays inside your directory.
- Context beyond the diff. The optional context engine indexes your repositories inside the cluster for codebase-aware review.
- Governance across repos. Organization rules and findings apply across repositories, and the portal's code review analytics show acted-on findings with a CSV export.
- An independent reviewer. Qodo reviews code written by any agent, as a tool separate from the ones that write it.
Hands-On: Pointing Qodo at Your Own Model Endpoint
The Helm values that matter for egress sit under global.llm. Leave openaiBaseUrl empty and the gateway defaults to api.openai.com, which needs internet access, so the first job is to fill it in.
global:
llm:
bundled: true # the in-cluster gateway stays on
openaiBaseUrl: https://llm-gateway.internal.example/v1
# modelMap: replace the built-in model list with the models your endpoint serves; it must include a text-embedding-3 model for indexing and retrieval
imageProxyPrefix: registry.internal.example/qodo/
Credentials for the endpoint belong in a Kubernetes Secret, never in extraHeaders. The model map also needs an embedding model, because indexing and retrieval depend on one.
Mirror every image listed for your chart version, keeping paths and tags identical, then run Qodo's render check, which greps the rendered chart for any image outside your registry. A partial mirror fails later with ImagePullBackOff, so the check matters.
Size node counts and storage with Qodo's team before you order hardware. Telemetry is off by default, which saves one conversation with your security team.
Best For
Qodo is best for platform and security teams that need one reviewer across several self-hosted Git platforms with nothing leaving the network. Pick Qodo when auditors need every model call to stay on your own endpoint.
How It Ranked
Qodo passed all five checks. Its air-gapped install covers every self-hosted Git platform on my list, organization rules and findings apply across repositories, and the egress story rests on your own endpoint. Qodo is my first pick for regulated teams running GitHub Enterprise, GitLab Self-Managed, Bitbucket Data Center or Gerrit.
2. Greptile: Best for Self-Hosted Review on GitHub, GitLab or Perforce
Tool Overview
Greptile is an AI code reviewer that indexes your codebase and comments on PRs. The entire service can be self-hosted in an air-gapped environment, deployed with Docker Compose or Kubernetes and Helm (Greptile self-hosting docs).
Main Features
- Two deployment paths. Docker Compose suits smaller teams, and Kubernetes with Helm suits larger ones.
- Your choice of model provider. Supported providers include OpenAI, Anthropic, AWS Bedrock, Azure OpenAI, GCP Vertex AI and any OpenAI-compatible API, with separate roles for reasoning, fast and embedding models.
- Self-hosted Git coverage. Self-hosted deployments cover GitHub and GitHub Enterprise, GitLab and Perforce.
- Licensed images. Registry credentials and a license come from Greptile.
Best For
Greptile is best for teams on GitHub Enterprise, GitLab or Perforce that want a self-hosted reviewer with codebase indexing.
How It Ranked
Greptile passes the egress check on its own docs. Bitbucket Data Center and Gerrit don't appear in the self-hosted SCM table, and I found no documented governance across repos, so Greptile ranks second for organizations that run more than GitHub and GitLab.
3. Tabnine: Best for Air-Gapped Teams That Want Review and Code Completion From One Private Install
Tool Overview
Tabnine is a coding assistant with code review features. An Enterprise private installation runs in a VPC or on-premises and can be deployed in a completely air-gapped environment (Tabnine deployment docs). Tricentis acquired Tabnine on July 30, 2026.
Main Features
- A fully air-gapped private installation. The deployment options page documents VPC, on-premises and air-gapped installs.
- Review as a script or CI step. The Tabnine CLI code review examples cover a pre-commit script and a GitHub Actions job.
Best For
Tabnine is best for air-gapped teams that want review and code completion from one private install.
How It Ranked
Tabnine's air-gapped story is documented, but the review path runs through a CLI that is in maintenance mode, with only critical updates through December 31, 2026, as users move to the Tabnine plugin for OpenCode.
The reviewer also comes from the same vendor as the assistant writing the code. You shouldn't review code with the same tool that wrote it, because the reviewer shares the writer's blind spots.
4. SonarQube Server: Best for Rules-Based Static Analysis With AI Fixes on Your Own Model
Tool Overview
SonarQube Server is self-managed static analysis that checks code against rules and quality gates. SonarQube Server 2026.5 integrates with GitHub, Bitbucket, GitLab and Azure DevOps.
Main Features
- AI CodeFix on your own model. AI CodeFix, in the Enterprise and Data Center editions, can point at a self-hosted OpenAI-compatible gateway such as Ollama, LiteLLM or vLLM.
- No outbound internet for fixes. AI CodeFix in a fully self-hosted setup runs without outbound internet access, because prompts and rule descriptions ship with the product.
- Quality gates per project. Teams define pass or fail conditions that show on each pull request.
Best For
SonarQube Server is best for teams that want deterministic rules and quality gates inside the network, with AI used for fixes.
How It Ranked
SonarQube Server passes the egress check. Its review is rules-based static analysis, so it pairs with an LLM reviewer rather than replacing one.
5. A DIY Reviewer on Open-Weight Models: Best for Platform Teams That Want Full Control
Tool Overview
The DIY route wires an open-source review CLI to a local model behind an OpenAI-compatible API, triggered by a webhook or a CI job on each PR. The tools in our earlier roundup of open-source code review tools all support that pattern.
Main Features
- Full control of every component. You pick the model, the prompts, the trigger and the comment format.
- No license to negotiate. Open-source tools and open-weight models keep procurement simple.
- Every gap is yours too. Context beyond the diff, evaluation, rule storage and upgrades all land on your team.
Best For
A DIY reviewer is best for teams with a strong platform engineering group that already runs internal model serving.
How It Ranked
A DIY build passes the egress check by construction. Self-hosted Git support, offline install, context, governance and independence all depend on how much you build and keep running, which is why the DIY option ranks last for most teams.
Conclusion
Air-gapped AI code review comes down to whether the review can run with nothing crossing the boundary and still understand the code.
Sort the deployment modes first, then hold every tool to zero egress against your own endpoint, and only then compare context and governance. Qodo cleared every check, with air-gapped installs on all four self-hosted Git platforms, as a reviewer separate from the agents writing the code. Start with Qodo when zero egress is a requirement.
FAQ
Can AI code review run with zero internet egress?
AI code review can run with zero internet egress when the reviewer forwards model calls to an endpoint inside your network and installs from a mirrored bundle. Qodo documents that setup for air-gapped installs, with no outbound access to api.openai.com once your own endpoint is configured.
What do I need to supply for an air-gapped install?
You supply the model endpoint, the Kubernetes cluster, a PostgreSQL database with pgvector, an image registry for the mirror and an identity provider. Sizing depends on your repositories, so confirm production capacity with the vendor. Qodo's air-gapped install uses exactly that list, plus a chart bundle you mirror.
Which Git platforms work air-gapped, and which only on-prem?
In Qodo's deployment table, GitHub Enterprise, GitLab Self-Managed, Bitbucket Data Center and Gerrit support air-gapped installs. Cloud-hosted platforms such as GitHub Cloud and GitLab Cloud mark air-gapped as not applicable, and Bitbucket Cloud and Azure DevOps Cloud run as cloud deployments.
Do I need OpenAI or Anthropic access if I bring my own endpoint?
You don't need OpenAI or Anthropic access if you bring your own endpoint. Qodo's bundled gateway forwards to the OpenAI-compatible endpoint you configure, so fill in the endpoint before the first review, because an empty setting defaults to api.openai.com.
How do images reach the cluster when the cluster can't reach a registry?
You mirror every image for your chart version into an internal registry and point the chart at it. Qodo ships each release as a chart bundle and image list, and its render check prints nothing when every image comes from your registry.
Who handles upgrades in a self-hosted deployment?
Your platform team handles upgrades, with new chart bundles and image mirrors for each release. Name an owner for models, rules, indexes and images before the pilot starts. Qodo ships each release as a chart bundle with a matching image list, so each upgrade follows the same mirror steps.
Top comments (0)