Claude Code for Bitbucket Pull Request Review: What Actually Works (2026)

Claude Code for Bitbucket Pull Request Review

Claude Code will review a Bitbucket branch without complaint, and then it stops. The findings sit in your terminal, because nothing official carries them to the pull request.

For Bitbucket teams that missing last step is the whole problem in late 2026. Tutorials written for GitHub rarely mention it, because on GitHub Anthropic already built the plumbing.

TL;DR: Anthropic's managed Code Review is GitHub-only and limited to Team and Enterprise plans. Its official CI guides cover GitHub Actions and GitLab CI/CD, with no Bitbucket page. On Bitbucket you have four realistic routes: run /code-review locally on a checked-out PR branch, wire Claude Code's headless mode into Bitbucket Pipelines (Cloud) or Jenkins/Bamboo (Server, Data Center), use Atlassian's own Rovo Dev review on Cloud, or run Claude through a VS Code extension that posts to Bitbucket after you approve each comment. This guide walks through all four, including the parts that break.

Does Claude Code work with Bitbucket?

Claude Code works on any Git repository you have checked out, so the review half of the job runs fine on Bitbucket code. The integration half does not exist. Anthropic's docs list Bitbucket in exactly one place we could find: the --from-pr flag in the CLI reference, which accepts a Bitbucket pull request URL to reopen sessions linked to that PR. Everything that posts review comments targets GitHub or GitLab.

Here are the review options from Anthropic's own comparison table, mapped onto a Bitbucket repository:

Read the table by column and the pattern is blunt. Anything that only needs a working tree runs on Bitbucket just fine. Anything that has to talk to a pull request was built for GitHub, then GitLab, and Bitbucket never made the list, so most of what follows is about that last posting step, the one you end up owning yourself.

How do you review a Bitbucket PR with /code-review?

The fastest honest answer is to check out the PR's source branch and point /code-review at a branch range. The local review docs say the command works on any plan and counts toward your plan's usage or API billing like the rest of the session.

Fetch the branch first:

git fetch origin
git checkout feature/payment-retries

Then, inside a Claude Code session, compare it to the PR's target branch:

/code-review origin/main...feature/payment-retries

With no target at all, /code-review reviews your branch's commits ahead of its upstream plus uncommitted changes, falling back to main when there is no upstream. On a Bitbucket checkout the explicit origin/main...branch form is safer, because it compares against the target branch as Bitbucket sees it, which is what the pull request diff shows.

Add --fix if you want Claude to apply the findings to your working tree afterwards. Its edits still go through your permission mode, so nothing changes without the prompts you normally see.

What /code-review can't do on a Bitbucket PR

The --comment flag is where Bitbucket drops out. Anthropic's docs say it posts findings "on a GitHub pull request as inline comments, or on a GitLab merge request as a single note," with GitLab going through the glab CLI. Bitbucket gets no mention.

Targets are murky too. "A pull request by number" is listed as valid, but only GitHub and GitLab get host-specific rules. We wouldn't bet on /code-review 1234 finding a Bitbucket PR, so review the branch range instead.

One trap if you copied a GitHub tutorial: the local review reads CLAUDE.md and ignores REVIEW.md, which only configures the managed GitHub service. Severity rules tuned in REVIEW.md do nothing on a Bitbucket checkout until you move them into CLAUDE.md.

Is ultrareview worth it for Bitbucket code?

Ultrareview is the deeper, cloud-run variant you start with /code-review ultra. Its PR mode needs a repository on github.com, but branch mode does not: Claude Code bundles your local repository state and uploads it to a cloud sandbox. So a Bitbucket repository can use ultrareview as long as you run it from a checked-out branch.

Anthropic's ultrareview page is upfront about money, and the numbers make the decision for you. Pro and Max accounts get three free runs, once, with no refresh. After that a typical review runs $5 to $25 in usage credits depending on the size of the change, which is cheap insurance on a risky auth PR and a silly line item on every typo fix. You also need a claude.ai login, and it won't run under Zero Data Retention.

How do you run Claude Code in Bitbucket Pipelines?

You build it yourself from three documented pieces: Claude Code's headless mode, the Pipelines pull-requests trigger, and the Bitbucket Cloud pull request comments endpoint. None of it is an official integration, so you own the maintenance.

The pieces, as their docs describe them:

• Trigger. A pull-requests pipeline runs when a pull request is created and merges the destination branch into your working branch first. PRs from forks don't trigger it.
• Variables. Pipelines exposes BITBUCKET_PR_ID, BITBUCKET_PR_DESTINATION_COMMIT, BITBUCKET_WORKSPACE and BITBUCKET_REPO_SLUG in PR builds.
• Clone depth. The default clone is the last 50 commits. clone: depth: full gives you the whole history.

On the Claude side, claude -p runs a prompt non-interactively, and --bare skips hooks, skills, plugins, MCP servers and CLAUDE.md discovery. Anthropic calls bare mode the recommended mode for scripted calls. It also never reads subscription OAuth credentials, so CI needs ANTHROPIC_API_KEY.

For posting, a repository access token with the pull request Write permission can create comments, sent as Authorization: Bearer <token>. Store both secrets as secured repository variables so Pipelines masks them in logs.

Put together, a minimal version looks like this. It is an example to adapt and test on a throwaway repository, not a drop-in config:

# Example only. Adapt the image, prompt, branch pattern and limits before use.
image: node:22

pipelines:
  pull-requests:
    '**':
      - step:
          name: Claude Code review (posts one summary comment)
          clone:
            depth: full
          script:
            - apt-get update && apt-get install -y jq
            - curl -fsSL https://claude.ai/install.sh | bash
            - export PATH="$HOME/.local/bin:$PATH"
            - git diff "$BITBUCKET_PR_DESTINATION_COMMIT...HEAD" > pr.diff
            - >
              claude --bare -p "Review the changes in pr.diff for correctness bugs and
              security problems. Read surrounding files only when you need context.
              List each finding as file:line, severity, and a short explanation.
              If nothing is serious, say so in one line."
              --allowedTools "Read" --output-format json > review.json
            - jq -r '.result' review.json > review.md
            - jq -n --rawfile body review.md '{content: {raw: $body}}' > comment.json
            - >
              curl --fail -sS -X POST
              "https://api.bitbucket.org/2.0/repositories/$BITBUCKET_WORKSPACE/$BITBUCKET_REPO_SLUG/pullrequests/$BITBUCKET_PR_ID/comments"
              -H "Authorization: Bearer $BB_REVIEW_TOKEN"
              -H "Content-Type: application/json"
              --data @comment.json

ANTHROPIC_API_KEY and BB_REVIEW_TOKEN are secured repository variables you create. The install command and the ~/.local/bin launcher path come from Anthropic's setup docs. With --output-format json, the response also carries total_cost_usd, which is worth logging from day one so you learn your real cost per PR before finance asks.

Can the pipeline post inline comments?

Yes, but you have to do the line mapping yourself. The Bitbucket Cloud comment object accepts an inline block with a required path and a to line in the new version of the file. Claude Code's --json-schema flag makes the output match a schema you define, landing in a structured_output field. So the pattern is: ask for findings as an array of {path, line, body}, loop over them, and post one comment per finding.

The fiddly part is that a model's line numbers are not always the diff's line numbers. Expect to validate each finding against pr.diff before posting, or you will get comments anchored to the wrong line.

Where does the DIY pipeline break?

The first failure mode is security, and it is specific to pull request pipelines. Anthropic's headless docs warn that without --bare, a -p session runs the hooks in a project's .claude/settings.json and connects the servers in its .mcp.json, "even in a folder you've never trusted." In a PR pipeline, that folder is the contributor's branch. Keep --bare on, keep --allowedTools narrow, and remember that the diff itself can contain text written to steer the model.

The second is noise. The pipeline above posts whatever Claude writes, on every PR, and nobody reads it first.

Our read on unfiltered review bots is not kind to them: once every PR gets a wall of machine comments, reviewers learn to scroll past the bot, and you end up paying for output nobody reads. A human checkpoint, or at least a severity filter before posting, buys more than another week of prompt tuning, which is the case we made in human-in-the-loop AI code review.

The third is coverage. Atlassian documents pull-requests pipelines as running when a pull request is created, and notes they run alongside any matching branch pipelines. Overlapping definitions can start two runs at once.

Push a fix to an open PR on a test repository and watch what happens before you trust the setup.

What about Bitbucket Server and Data Center?

Pipelines is a Bitbucket Cloud product, and Atlassian's request to bring a Pipelines-style embedded CI to Server (BSERV-9399) is still open in "Gathering Interest" status. Self-hosted teams run the headless step from the CI they already have, usually Jenkins or Bamboo.

On Jenkins, the Bitbucket Server integration plugin is maintained under Atlassian's name and lists Bitbucket 8.19 or newer as a requirement. The review step itself is the same claude --bare -p call as in the Pipelines example. Only the posting step changes.

The Data Center REST API takes a general pull request comment as {"text": "..."} posted to:

POST {baseurl}/rest/api/latest/projects/{projectKey}/repos/{repositorySlug}/pull-requests/{pullRequestId}/comments

Line comments use an anchor object with path, line and lineType. Authentication goes through an HTTP access token. Project and repository tokens are sent as a Bearer header and require a Data Center licence. Personal tokens use Basic auth with your username.

Two dates decide how much effort this deserves. Atlassian ended support for Server products on February 15, 2024, per its October 2020 announcement. Its September 2025 Ascend post puts Data Center end of life at March 28, 2029.

That second date is about two and a half years away, a long time to keep reviewing PRs by hand. For the network side (firewalls, internal CAs, where the AI call actually goes), see our Bitbucket Server AI code review guide.

Can Claude Code read Bitbucket PRs through MCP?

On Bitbucket Cloud, yes, through Atlassian's own server. Atlassian announced on April 8, 2026 that the Rovo MCP server now supports Bitbucket Cloud, with pull request tools covering diff, comments and approvals. Claude Code can connect to MCP servers, so in principle you can ask it to read a PR diff and post a comment in one session.

The catches are not small. Atlassian says its Bitbucket tools take API tokens only for now, your workspace must be linked to an Atlassian organization, and an admin has to switch on API token auth in the Rovo MCP settings. Data Center isn't mentioned. For one developer on Cloud that's workable, but it still dodges the question of who reads a comment before it posts.

Is Atlassian's Rovo Dev code review an alternative?

For Bitbucket Cloud teams already paying for Atlassian's AI, Rovo Dev is the path with the least glue. Atlassian's Rovo Dev code review page says it "currently supports Bitbucket Cloud and GitHub repositories," and the activation guide says credits for each review come out of the pull request author's Rovo Dev allocation. If the author has no credits, the review doesn't run.

It isn't Claude Code, though, and Server and Data Center aren't listed. So Rovo Dev answers "I want AI review in Bitbucket Cloud," which is a different question from the one most people searching for Claude Code on Bitbucket are asking.

How does Git AutoReview run Claude on Bitbucket?

We built Git AutoReview because of that gap: Claude reviews code well, and nothing official connects it to a Bitbucket pull request with a person in the loop.

It's a VS Code extension that talks to Bitbucket Cloud, Server and Data Center. It pulls the PR diff, runs Claude, and shows every finding in the editor before anything is posted.

There are two ways it uses Claude:

• Quick Review sends the diff to Claude with your own Anthropic API key, or to Gemini or GPT if you prefer. Typical API spend is around $2–5 a month for a working developer.
• Deep Review drives your existing Claude Code install as an agent that opens related files, follows imports and checks tests. It takes 2–5 minutes on a typical PR, and runs on the Claude plan you already have, since Anthropic includes Claude Code in every paid plan.

Data Center teams tend to ask about privacy before anything else, so here is the answer. Your code goes from VS Code straight to Anthropic, Google or OpenAI under your own account, and Git AutoReview never sees it, stores it or trains on it. You pay for that with about two minutes on first install, pasting a key or pointing the extension at Claude Code. It is setup, and pretending otherwise would be dishonest.

The approval step is the real difference from the Pipelines script. Comments arrive as drafts in VS Code; you approve, edit or drop each one, and only those you keep reach the PR. Linked Jira tickets are read for context, read-only.

As far as we know, Git AutoReview is the only VS Code extension with native Bitbucket Cloud, Server and Data Center support. It is not the only AI review tool on Bitbucket. CodeRabbit and Qodo both cover Bitbucket Cloud and Data Center, Greptile lists Cloud on all plans and Data Center on Enterprise, and none of them list Server. Our Bitbucket AI code review guide compares them in detail.

Pricing: Free is $0 for 10 reviews a day on one repository. Developer is $9.99/month and Team is $14.99/month, or $99.90 and $149.90 billed annually. Those are subscription prices only. AI usage goes on your provider bill at their direct rate, or comes out of the Claude subscription you already have.

Which option should your team pick?

Pick by where your Bitbucket lives and who should read the review before it lands. Those two questions settle it faster than any feature comparison.

Solo developer, any Bitbucket. Use /code-review origin/main...branch in your own Claude Code session. It costs nothing beyond your plan, and you copy the findings you agree with into the PR by hand. The copying is tedious at five PRs a day and fine at one.

Cloud team that wants every PR reviewed automatically. Start the Pipelines step on one repository with --bare, a narrow tool list and cost logging. Already paying for Rovo Dev and indifferent to the model? Compare it with your script first.

Server or Data Center team. You're writing the Jenkins or Bamboo step yourself or using a tool that already speaks the Data Center API. Factor in that your CI agents need outbound access to Anthropic's API, which is often the real blocker behind a corporate firewall.

Any team that wants a human gate. That's the case Git AutoReview was built for. The reviewer sees the findings in VS Code and decides what reaches the PR.

One case none of these handle well: monorepos where a single PR touches hundreds of files. Every option here either truncates context or gets expensive, and the honest move is to split the PR before blaming the reviewer.

How do you measure whether Claude reviews are helping?

Track how many posted findings get acted on, not how many get posted. A bot that leaves 15 comments per PR and gets two of them fixed has a worse signal than one that leaves three and gets two fixed, even though the first looks busier.

Three numbers are enough for the first month. First, the share of AI comments that led to a code change or a reply. Second, cost per reviewed PR, which total_cost_usd gives you in headless runs. Third, time from PR open to first human review, since the point of a first-pass reviewer is to make the human pass shorter, not to replace it. If most AI comments get ignored, tighten the prompt or add an approval step before you add more models.

Frequently asked questions

Related resources

• AI Code Review for Bitbucket — the full tool comparison across Cloud, Server and Data Center
• Bitbucket AI Code Review — how Git AutoReview connects to each Bitbucket edition
• Bitbucket Server AI Code Review Guide — self-hosted setup, firewalls and token types
• How to Add AI Code Review to Bitbucket Pipelines — more Pipelines patterns beyond Claude Code
• Claude Code vs Gemini CLI for Code Review — the two terminal agents compared on PR review
• Claude Code for AI Code Reviews in VS Code — the Deep Review workflow step by step
• Bitbucket Cloud vs Data Center — which edition fits which team