Bitbucket AI Code Review: 3 Things I Didn't Expect

I expected Bitbucket AI code review to copy the GitHub story, and I hit three surprises instead. The first covers Bitbucket Data Center, the second Bitbucket Cloud, and the third both. I checked every claim below against vendor docs in October 2026, because the listicles I started with didn't agree with each other.

TL;DR

• Vendor listicles disagree on Data Center support. Two 2026 listicles gave opposite answers for the same tool, so the vendor's own support table is the only source I trust.
• Atlassian's reviewer bills the PR author. Rovo Dev code review draws credits from the author's allocation, and Free plans cover about 2 to 8 reviews per user before reviews stop (Atlassian, October 2026).
• Bitbucket Data Center isn't going away in 2029. Atlassian exempted Bitbucket from the March 28, 2029 Data Center end of life, so DC support is a long-term need.
• Qodo is my pick because it reviews PRs on Bitbucket Cloud and Data Center, air-gapped included. Qodo connects through one wizard, uses your own model endpoint and reviews code from any agent. Pick it when your team runs Data Center, or Cloud and Data Center side by side.

The Bitbucket AI Code Review Tools I Compared

1. Qodo: best for teams on Bitbucket Cloud, Data Center or both
2. Rovo Dev code review: best for Atlassian Cloud teams that want review inside Rovo and keep PRs small
3. CodeRabbit: best for teams that want a hosted reviewer on Cloud or Data Center
4. A browser extension on a local model: best for individual reviewers on Data Center

Tool	Best for	Bitbucket Cloud	Bitbucket Data Center	Who pays per review
Qodo	Teams on Cloud, Data Center or both	Yes	Yes, including on-prem and air-gapped	Workspace credits
Rovo Dev code review	Atlassian Cloud teams that want review inside Rovo	Yes	Not documented	The PR author's Rovo Dev credits
CodeRabbit	A hosted reviewer on Cloud or Data Center	Yes	Yes, through a bot user	Not documented
Browser extension (ThinkReview)	Individual reviewers on Data Center	Yes, with an API token	Yes, with an HTTP access token	The extension's review credits, or a local model

Surprise 1: The Lists Disagree on Who Supports Data Center

My first search for Data Center support turned up two 2026 listicles from code review vendors. One said a tool supported Data Center, and the other said the same tool didn't. One of them still used Qodo's old name, so its research predated the rebrand.

I went to the docs instead. Qodo's deployment table lists Bitbucket Data Center under multi-tenant, single-tenant, on-premises and air-gapped. Bitbucket Cloud runs multi-tenant and single-tenant, the two models a cloud product needs.

A Bitbucket code review tool either documents Data Center support on its own site or I treat it as unsupported until a vendor engineer shows me. Listicles are where I start, not where I decide.

When the docs are vague, I'd ask the vendor three questions. Which Data Center versions do you test against? Does the reviewer run inside my network or call in from yours? Who creates the bot user? A vendor that answers all three in writing usually supports Data Center properly.

Surprise 2: Rovo Dev Code Review Runs on the Author's Credits

Rovo Dev is Atlassian's AI agent, and code review is one of its jobs. I assumed a workspace would pay for reviews like build minutes. Credits come out of the PR author's allocation instead (Atlassian Rovo Dev activation page, October 2026), and that billing model changed five things I hadn't planned for.

What the Credit Model Means Day to Day

1. Reviews stop when the author runs out. Atlassian says reviews don't run if the author has no credits left, and only the author can trigger one manually.
2. Free plans cover a handful of reviews. The rollout page lists 350 Rovo Dev credits per user on Free, which Atlassian describes as "about 2 to 8 code reviews per user".
3. Standard adds more credits. Each Standard user gets 2,000 credits per month.
4. Every commit can cost credits. Atlassian suggests running reviews only when a PR is created, or on request, to cut credit usage.
5. Big PRs may get nothing. PRs with more than 10,000 changed lines, or repos over 20 GB, may get no comments.

Atlassian's rollout page covers compliance too. Rovo Dev hasn't been externally audited for ISO 27001 and SOC 2 compliance yet, isn't HIPAA compliant and doesn't support data residency (Atlassian, October 2026). Regulated teams should read that page before a pilot.

There's one more catch for me. Rovo Dev also writes code, and you shouldn't review code with the same tool that wrote it, because the reviewer inherits the writer's blind spots. In one study, models caught fewer injected errors when the review ran in the session that wrote the work (arXiv 2603.12123, March 2026).

Surprise 3: Bitbucket Data Center Isn't Going Away

I expected Data Center to vanish with the rest of Atlassian's Data Center line. Impacted products reach end of life on March 28, 2029, but Bitbucket and Bamboo Data Center will not (Atlassian Data Center end-of-life notice).

Existing Data Center customers get a Hybrid License covering Data Center and Cloud from early 2027. Atlassian names compliance, data sovereignty and air-gapped requirements as reasons customers stay on Data Center. Security researchers describe the same limit for AI review, where source code can't be sent to an externally hosted model (arXiv 2610.27383, October 2026).

Atlassian also keeps building for agents on Data Center. Bitbucket Data Center 10.5.0, released on September 29, 2026, added a bundled server for the Model Context Protocol, and admins limit the tools it exposes with a whitelist file. A reviewer that only supports Cloud leaves those teams out for years.

Data Center's long future changed the buying question for me. I'd planned to pick a Cloud-first reviewer and live with gaps until a migration. Now I'd pick a reviewer that treats Data Center as a first-class platform, because the hybrid license means some teams will run both for a long time.

AI Code Review on Bitbucket Data Center

Data Center is where the reviewer choice gets hard, because the server sits inside your network. A hosted reviewer needs a way in for webhooks and a way out for comments. An on-prem reviewer runs next to Bitbucket and never leaves the building.

Qodo handles both cases. The same Data Center wizard works for multi-tenant, single-tenant and on-premises deployments, and air-gapped installs forward model calls to your own OpenAI-compatible endpoint, so code never leaves the network. The air-gapped code review setup is the one regulated Bitbucket shops tend to ask about.

Regulated teams usually shortlist from secure code review tools first, and Data Center support is the filter that shortens that list most.

For the air-gapped route, the platform team installs Qodo on Kubernetes with a mirrored image bundle and points the bundled gateway at an internal model endpoint. Once that endpoint is configured, Qodo needs no outbound access to a public model API, and the Bitbucket connection itself runs through the same wizard below.

Hands-On: Connecting Qodo to Bitbucket Data Center

The wizard starts in the Qodo portal. In the Data Center docs I read, the flow looks short. You pick Bitbucket, then the self-hosted option, and Qodo asks how you want the bot account created. Configuration typically takes around five minutes, and on Data Center the new wizard brings Review Standards and findings with it.

Automatic Setup

1. Enter the server URL and an admin login. Qodo uses the administrator credentials once to create a dedicated account, scope it to the projects you pick and configure webhooks, and discards them afterward.
2. Choose repositories. Picking a project includes every repository in it, including ones added later.
3. Finish. Qodo creates the qodo-bot account, registers the webhooks and warns you before its token expires.

Manual Setup

If my security team didn't want to hand admin credentials to any vendor, manual setup, which arrived in Qodo 3.0 on October 1, 2026, is the route I'd pick.

1. Ask an admin for a dedicated user. The username must contain qodo, such as svc-qodo, and the user needs write access to the projects Qodo should review.
2. Enter that user's credentials and test the connection. Qodo checks that the username contains qodo.
3. Create the webhook yourself. In manual mode, you create the webhook for the chosen repositories in Bitbucket.

What Works Differently on Bitbucket

Qodo on Bitbucket runs the same review loop as on GitHub, with a few Bitbucket-specific touches worth knowing before the first PR. Reviews run on every push, and Qodo updates its findings as you commit fixes.

Findings arrive in full as standard markdown, since Bitbucket has no collapsible sections, and older resolved findings move to the Qodo portal to keep long PRs readable.

Two settings exist only on Bitbucket and Gerrit. One shows section titles inside each finding, and the other links each finding in the summary to its inline comment, which helps on long PRs.

Jira works as ticket context, so Qodo can check a PR against the linked issue's acceptance criteria. Atlassian shops get review tied to the ticket, and the review commands, /agentic_review, /agentic_describe and /ask, all work on Bitbucket the way they do elsewhere.

What I'd Check Before Installing Any Bitbucket AI Reviewer

The three surprises gave me the first three checks, which are docs over listicles, who pays and where code goes. Reading the Data Center setup docs added setup permissions, and planning review across many teams added governance and independence. I'd run every Bitbucket AI reviewer through them, in this order.

1. Cloud, Data Center or both, per the vendor's docs. A listicle isn't evidence, so I look for the vendor's own support table.
2. Who pays per review and what gets skipped. Per-author credits, size limits and rate limits all decide which PRs get reviewed.
3. Where code and model calls go. On Data Center, check whether the reviewer runs on-prem and whether it can use your own model endpoint.
4. Setup permissions. Note whether the tool needs admin credentials, a bot user, a webhook or an outbound tunnel.
5. Governance across many repos. Rules and findings should roll up across projects, not live in one repo's config.
6. Independence from your coding agent. The reviewer shouldn't be the agent that wrote the change.

The academy guide to the Bitbucket AI code review goes deeper on each check.

How I Evaluated

I read each tool's own Bitbucket setup, billing and deployment docs in October 2026 and scored them against the six checks. "Not documented" means I couldn't find it in the vendor's public docs.

Check	Qodo	Rovo Dev code review	CodeRabbit	Browser extension
Cloud and Data Center	Both	Cloud	Both	Both
Who pays, what gets skipped	Workspace credits with an optional monthly spending cap	Author's credits; large PRs may be skipped	Not documented	Review credits, or a local model
Where code and model calls go	Your network on-prem or air-gapped	Atlassian cloud	CodeRabbit cloud; reverse tunnel for private instances	Your browser and local model
Setup permissions	Admin once, or a qodo-named user plus webhook	Repository connection in Rovo	Bot user, HTTP access token, OAuth consumer	Personal HTTP access token
Governance across repos	Rules and findings on Cloud and Data Center	Not documented	Not documented	No
Independent of the coding agent	Yes, reviews code from any agent	Same vendor as the agent	Yes	Depends on the model

The Tools

1. Qodo: Best for Teams on Bitbucket Cloud, Data Center or Both

Tool Overview

Qodo is a code review platform that reviews pull requests on Bitbucket Cloud and Bitbucket Data Center, along with GitHub, GitLab, Azure DevOps and Gerrit. On Data Center, Qodo runs multi-tenant, single-tenant, on-premises or air-gapped, which makes it my pick for Data Center teams that need on-prem or air-gapped review.

Main Features

1. One Data Center wizard. Automatic setup uses admin credentials once, and manual setup works with an admin-created user and webhook.
2. Air-gapped Data Center. The bundled gateway forwards model calls to your own OpenAI-compatible endpoint.
3. Jira ticket context. Reviews can check PRs against the linked Jira issue.
4. Governance across repositories. Organization rules, findings and the Repositories page cover Bitbucket Cloud, and on Data Center the new wizard brings Review Standards, findings and the Repositories page.
5. Usage-based billing. Workspace credits replace seats, with a 14-day trial and an optional spending cap.

Qodo's governance features are a big part of why it shows up among agentic code review tools for enterprise teams. On Bitbucket Cloud, organization rules and organization-wide findings roll up across every repository, so leaders see one view of review across teams.

Best For

Qodo is best for teams that run Bitbucket Cloud, Data Center or both and want one reviewer for all of it. Pick Qodo when Data Center has to stay on-prem or air-gapped.

How It Ranked

Qodo covered Cloud and Data Center down to air-gapped installs, with your own model endpoint and a reviewer separate from the coding agent. Data Center depth made Qodo my first pick.

2. Rovo Dev Code Review: Best for Atlassian Cloud Teams That Want Review Inside Rovo and Keep PRs Small

Tool Overview

Rovo Dev code review is Atlassian's AI reviewer for pull requests, and Rovo Dev works on Bitbucket and GitHub repositories connected to Rovo (Atlassian, October 2026).

Main Features

1. Author-paid credits. Reviews draw from the PR author's Rovo Dev credits.
2. Acceptance criteria checks. Standard includes checks against the linked work item's acceptance criteria.
3. Ten languages. Atlassian lists support for ten programming languages.
4. A workspace rate limit. Atlassian cites about 10 PRs per minute per workspace.

Best For

Rovo Dev code review is best for Atlassian Cloud teams that want review inside Rovo and keep PRs small.

How It Ranked

Rovo Dev runs inside Atlassian Cloud. The author-paid credits, the size limits, the missing audits listed on its rollout page and the same-vendor overlap with its coding agent kept it below Qodo for me.

3. CodeRabbit: Best for Teams That Want a Hosted Reviewer on Cloud or Data Center

Tool Overview

CodeRabbit is an AI PR reviewer that supports Bitbucket Cloud and Bitbucket Data Center. Data Center setup uses a bot user with an HTTP access token plus an OAuth consumer, with webhooks configured automatically.

Main Features

1. Data Center through a bot user. An admin creates the user, token and OAuth consumer.
2. Private instances through a tunnel. A reverse tunnel serves Data Center servers that aren't reachable from the internet, and Bitbucket still sends webhooks to CodeRabbit over HTTPS.
3. Configuration in the repo. Review behavior lives in .coderabbit.yaml.

Best For

CodeRabbit is best for teams on Bitbucket Cloud or a reachable Data Center server that want a hosted reviewer.

How It Ranked

CodeRabbit documents a bot-user setup for Data Center. In the hosted setup, review traffic leaves your network, so it doesn't fit the air-gapped teams Atlassian names as Data Center's audience. CodeRabbit's self-hosted overview lists a self-hosted option for Bitbucket Data Center on its Enterprise plan.

4. A Browser Extension on a Local Model: Best for Individual Reviewers on Data Center

Tool Overview

ThinkReview is a browser extension that reviews PRs in the page you're reading. ThinkReview works with Bitbucket Cloud through an API token and Data Center through an HTTP access token, and reviews can run through a local Ollama model.

Main Features

1. Runs in your browser. Nothing installs on a server, and you don't need an admin.
2. Local models. Ollama keeps code on your machine.
3. Personal scope. Each reviewer installs and configures it alone.

Best For

A browser extension is best for one developer who wants a second opinion on Data Center PRs today.

How It Ranked

With a local model, the extension keeps code on your machine and needs no admin. Nothing rolls up across a team, so it can't cover the governance check.

Conclusion

Checking Data Center support in the vendor's docs, knowing who pays for each review and planning for Data Center past 2029 all point to the same answer. Qodo passed those checks on Cloud and Data Center, air-gapped included, as an independent reviewer. Pick Qodo when one reviewer has to cover every Bitbucket you run.

Teams that also run GitHub or GitLab can compare options in our roundup of tools for GitLab AI code review, where Qodo reviews with the same loop.

Qodo's earlier post on Bitbucket code review covers the human side of the workflow.

FAQ

Does AI code review work the same on Bitbucket Cloud and Data Center?

AI code review works almost the same on Bitbucket Cloud and Data Center. Qodo reviews PRs on both with the same review commands and markdown comments. Data Center adds on-prem and air-gapped deployment, and wiki-based configuration stays a Cloud option.

Can I run AI code review on-prem or air-gapped with Bitbucket?

You can run AI code review on-prem or air-gapped with Bitbucket Data Center. Qodo supports on-premises and air-gapped deployments for Bitbucket Data Center, with model calls going to your own endpoint.

How much does Rovo Dev cost?

Rovo Dev includes 350 credits per user on Free, about 2 to 8 code reviews, and 2,000 credits per Standard user each month, and credits come from the PR author (Atlassian, October 2026). Qodo bills the workspace through credits instead, with an optional spending cap, so reviews don't stop when one author runs out.

Does AI code review work with Bitbucket Pipelines?

AI code review works alongside Bitbucket Pipelines rather than inside it. Qodo reviews pull requests through webhooks, so it works the same whether you build with Bitbucket Pipelines, Jenkins or another CI system.

What permissions does a Bitbucket reviewer need?

A Bitbucket reviewer needs either admin credentials once or a dedicated bot user. For Qodo on Data Center, that means admin credentials used once, or a user whose name contains qodo with write access, plus a webhook an admin creates.

Which features differ from GitHub?

On Bitbucket, Qodo comments use standard markdown, and two display settings exist only on Bitbucket and Gerrit.

Inline comment severity thresholds, feedback on draft PRs, chat on code suggestions, Rule Miner and Relevance run on GitHub and GitLab, with draft-PR feedback and Rule Miner on Azure DevOps and severity thresholds on Gerrit, and none of them run on Bitbucket.