Bitbucket AI Code Review: 3 Things I Didn't Expect

TL;DR

I expected Bitbucket AI code review to copy the GitHub story, and I hit three surprises instead. The first covers Bitbucket Data Center, the second Bitbucket Cloud, and the third both.

I checked every claim below against vendor docs in October 2026, because the listicles I started with didn't agree with each other.

• Vendor listicles disagree on Data Center support. Two 2026 listicles gave opposite answers for the same tool, so the vendor's own support table is the only source I trust.
• Atlassian's reviewer bills the PR author. Rovo Dev code review draws credits from the author's allocation, and Free plans cover about 2 to 8 reviews per user before reviews stop (Atlassian, October 2026).
• Bitbucket Data Center isn't going away in 2029. Atlassian exempted Bitbucket from the March 28, 2029 Data Center end of life, so DC support is a long-term need.
• Qodo is my pick because it reviews PRs on Bitbucket Cloud and Data Center, air-gapped included. Qodo connects through one wizard, uses your own model endpoint and reviews code from any agent. Pick it when your team runs Data Center, or Cloud and Data Center side by side.

The Bitbucket AI Code Review Tools I Compared

• Qodo: best for teams on Bitbucket Cloud, Data Center or both
• Rovo Dev code review: best for Atlassian Cloud teams that want review inside Rovo and keep PRs small
• CodeRabbit: best for teams that want a hosted reviewer on Cloud or Data Center
• A browser extension on a local model: best for individual reviewers on Data Center

Surprise 1: The Lists Disagree on Who Supports Data Center

My first search for Data Center support turned up two 2026 listicles from code review vendors. One said a tool supported Data Center, and the other said the same tool didn't. One of them still used Qodo's old name, so its research predated the rebrand. I went to the docs instead.

Qodo's deployment table lists Bitbucket Data Center under multi-tenant, single-tenant, on-premises and air-gapped. Bitbucket Cloud runs multi-tenant and single-tenant, the two models a cloud product needs.

A Bitbucket code review tool either documents Data Center support on its own site or I treat it as unsupported until a vendor engineer shows me. Listicles are where I start, not where I decide.

When the docs are vague, I'd ask the vendor three questions.

1. Which Data Center versions do you test against?
2. Does the reviewer run inside my network or call in from yours?
3. Who creates the bot user?

A vendor that answers all three in writing usually supports Data Center properly.

Surprise 2: Rovo Dev Code Review Runs on the Author's Credits

Rovo Dev is Atlassian's AI agent, and code review is one of its jobs. I assumed a workspace would pay for reviews like build minutes. Credits come out of the PR author's allocation instead (Atlassian Rovo Dev activation page, October 2026), and that billing model changed five things I hadn't planned for.

What the Credit Model Means Day to Day

• Reviews stop when the author runs out. Atlassian says reviews don't run if the author has no credits left, and only the author can trigger one manually.
• Free plans cover a handful of reviews. The rollout page lists 350 Rovo Dev credits per user on Free, which Atlassian describes as "about 2 to 8 code reviews per user".
• Standard adds more credits. Each Standard user gets 2,000 credits per month.
• Every commit can cost credits. Atlassian suggests running reviews only when a PR is created, or on request, to cut credit usage.
• Big PRs may get nothing. PRs with more than 10,000 changed lines, or repos over 20 GB, may get no comments.

Atlassian's rollout page covers compliance too. Rovo Dev hasn't been externally audited for ISO 27001 and SOC 2 compliance yet, isn't HIPAA compliant and doesn't support data residency (Atlassian, October 2026). Regulated teams should read that page before a pilot.

There's one more catch for me. Rovo Dev also writes code, and you shouldn't review code with the same tool that wrote it, because the reviewer inherits the writer's blind spots. In one study, models caught fewer injected errors when the review ran in the session that wrote the work (arXiv 2603.12123, March 2026).

Surprise 3: Bitbucket Data Center Isn't Going Away

I expected Data Center to vanish with the rest of Atlassian's Data Center line. Impacted products reach end of life on March 28, 2029, but Bitbucket and Bamboo Data Center will not (Atlassian Data Center end-of-life notice). Existing Data Center customers get a Hybrid License covering Data Center and Cloud from early 2027.

Atlassian names compliance, data sovereignty and air-gapped requirements as reasons customers stay on Data Center. Security researchers describe the same limit for AI review, where source code can't be sent to an externally hosted model (arXiv 2610.27383, October 2026).

Atlassian also keeps building for agents on Data Center. Bitbucket Data Center 10.5.0, released on September 29, 2026, added a bundled server for the Model Context Protocol, and admins limit the tools it exposes with a whitelist file. A reviewer that only supports Cloud leaves those teams out for years.

Data Center's long future changed the buying question for me. I'd planned to pick a Cloud-first reviewer and live with gaps until a migration. Now I'd pick a reviewer that treats Data Center as a first-class platform, because the hybrid license means some teams will run both for a long time.

AI Code Review on Bitbucket Data Center

Data Center is where the reviewer choice gets hard, because the server sits inside your network. A hosted reviewer needs a way in for webhooks and a way out for comments. An on-prem reviewer runs next to Bitbucket and never leaves the building.

Qodo handles both cases. The same Data Center wizard works for multi-tenant, single-tenant and on-premises deployments, and air-gapped installs forward model calls to your own OpenAI-compatible endpoint, so code never leaves the network.

The air-gapped code review setup is the one regulated Bitbucket shops tend to ask about. Regulated teams usually shortlist from secure code review tools first, and Data Center support is the filter that shortens that list most.

For the air-gapped route, the platform team installs Qodo on Kubernetes with a mirrored image bundle and points the bundled gateway at an internal model endpoint. Once that endpoint is configured, Qodo needs no outbound access to a public model API, and the Bitbucket connection itself runs through the same wizard below.

Hands-On: Connecting Qodo to Bitbucket Data Center

The wizard starts in the Qodo portal. In the Data Center docs I read, the flow looks short. You pick Bitbucket, then the self-hosted option, and Qodo asks how you want the bot account created.

Configuration typically takes around five minutes, and on Data Center the new wizard brings Review Standards and findings with it.

Automatic Setup

• Enter the server URL and an admin login. Qodo uses the administrator credentials once to create a dedicated account, scope it to the projects you pick and configure webhooks, and discards them afterward.
• Choose repositories. Picking a project includes every repository in it, including ones added later.
• Finish. Qodo creates the qodo-bot account, registers the webhooks and warns you before its token expires.

Manual Setup

If my security team didn't want to hand admin credentials to any vendor, manual setup, which arrived in Qodo 3.0 on October 1, 2026, is the route I'd pick.

• Ask an admin for a dedicated user. The username must contain qodo, such as svc-qodo, and the user needs write access to the projects Qodo should review.
• Enter that user's credentials and test the connection. Qodo checks that the username contains qodo.
• Create the webhook yourself. In manual mode, you create the webhook for the chosen repositories in Bitbucket.

What Works Differently on Bitbucket

Qodo on Bitbucket runs the same review loop as on GitHub, with a few Bitbucket-specific touches worth knowing before the first PR.

Reviews run on every push, and Qodo updates its findings as you commit fixes. Findings arrive in full as standard markdown, since Bitbucket has no collapsible sections, and older resolved findings move to the Qodo portal to keep long PRs readable.

Two settings exist only on Bitbucket and Gerrit. One shows section titles inside each finding, and the other links each finding in the summary to its inline comment, which helps on long PRs.

Jira works as ticket context, so Qodo can check a PR against the linked issue's acceptance criteria. Atlassian shops get review tied to the ticket, and the review commands, /agentic_review, /agentic_describe and /ask, all work on Bitbucket the way they do elsewhere.

What I'd Check Before Installing Any Bitbucket AI Reviewer

The three surprises gave me the first three checks, which are docs over listicles, who pays and where code goes. Reading the Data Center setup docs added setup permissions, and planning review across many teams added governance and independence. I'd run every Bitbucket AI reviewer through them, in this order.

1. Cloud, Data Center or both, per the vendor's docs. A listicle isn't evidence, so I look for the vendor's own support table.
2. Who pays per review and what gets skipped. Per-author credits, size limits and rate limits all decide which PRs get reviewed.
3. Where code and model calls go. On Data Center, check whether the reviewer runs on-prem and whether it can use your own model endpoint.
4. Setup permissions. Note whether the tool needs admin credentials, a bot user, a webhook or an outbound tunnel.
5. Governance across many repos. Rules and findings should roll up across projects, not live in one repo's config.
6. Independence from your coding agent. The reviewer shouldn't be the agent that wrote the change.

The academy guide to the Bitbucket AI code review goes deeper on each check.

How I Evaluated

I read each tool's own Bitbucket setup, billing and deployment docs in October 2026 and scored them against the six checks. "Not documented" means I couldn't find it in the vendor's public docs.

The Tools

1. Qodo: Best for Teams on Bitbucket Cloud, Data Center or Both

Tool Overview

Qodo is a code review platform that reviews pull requests on Bitbucket Cloud and Bitbucket Data Center, along with GitHub, GitLab, Azure DevOps and Gerrit. On Data Center, Qodo runs multi-tenant, single-tenant, on-premises or air-gapped, which makes it my pick for Data Center teams that need on-prem or air-gapped review.

Main Features

• One Data Center wizard. Automatic setup uses admin credentials once, and manual setup works with an admin-created user and webhook.
• Air-gapped Data Center. The bundled gateway forwards model calls to your own OpenAI-compatible endpoint.
• Jira ticket context. Reviews can check PRs against the linked Jira issue.
• Governance across repositories. Organization rules, findings and the Repositories page cover Bitbucket Cloud, and on Data Center the new wizard brings Review Standards, findings and the Repositories page.
• Usage-based billing. Workspace credits replace seats, with a 14-day trial and an optional spending cap.

Qodo's governance features are a big part of why it shows up among agentic code review tools for enterprise teams. On Bitbucket Cloud, organization rules and organization-wide findings roll up across every repository, so leaders see one view of review across teams.

Best For

Qodo is best for teams that run Bitbucket Cloud, Data Center or both and want one reviewer for all of it. Pick Qodo when Data Center has to stay on-prem or air-gapped.

How It Ranked

Qodo covered Cloud and Data Center down to air-gapped installs, with your own model endpoint and a reviewer separate from the coding agent. Data Center depth made Qodo my first pick.

2. Rovo Dev Code Review: Best for Atlassian Cloud Teams That Want Review Inside Rovo and Keep PRs Small

Tool Overview

Rovo Dev code review is Atlassian's AI reviewer for pull requests, and Rovo Dev works on Bitbucket and GitHub repositories connected to Rovo (Atlassian, October 2026).

Main Features

• Author-paid credits. Reviews draw from the PR author's Rovo Dev credits.
• Acceptance criteria checks. Standard includes checks against the linked work item's acceptance criteria.
• Ten languages. Atlassian lists support for ten programming languages.
• A workspace rate limit. Atlassian cites about 10 PRs per minute per workspace.

Best For

Rovo Dev code review is best for Atlassian Cloud teams that want review inside Rovo and keep PRs small.

How It Ranked

Rovo Dev runs inside Atlassian Cloud. The author-paid credits, the size limits, the missing audits listed on its rollout page and