CodeRabbit's Slop Detection is the most-cited answer to "how do we review the growing volume of AI-generated pull requests." Its own docs say the feature runs "on GitHub repositories." If your team works on GitLab or Azure DevOps, that sentence is the entire answer you get from most comparison pages.
So what does the docs actually say for the non-GitHub forges?
Enter SonarQube Server. Its own page describes it as an "on-premises automated code review and static analysis tool" that works by "integrating directly with your CI pipeline or on one of our supported DevOps platforms." That includes both the self-managed and cloud editions of the forges this site covers. Read on docs.sonarsource.com/sonarqube-server/latest.
The mechanism that maps to "growing volume" is the new code definition paired with a quality gate. SonarQube Server tracks what counts as new code, runs rules against each merge request before it merges, and the quality gate blocks code that fails. The homepage puts it plainly: new code, whether "written by a developer or generated by an AI agent," should meet the same standard. Read on the homepage.
SCM integration underpins the new code detection. Git and SVN are supported out of the box, using blame data so the server knows which lines are new. One relevant limit, straight from the docs: Team Foundation Version Control (TFVC) is not supported, so a project must be a Git repository. Read on the SCM integration page.
Then there are the AI-specific pieces, on the AI capabilities page: AI CodeFix suggests fixes, and the instance admin chooses the model provider. Sonar's hosted models, your own Azure OpenAI or AWS Bedrock deployment, or a self-hosted gateway. The server also ships a SonarQube MCP Server, available with the commercial editions, that connects an AI coding agent to issue data and project quality status.
One thing worth flagging because it decides how you evaluate this. The doc is explicit that AI-powered pull request review and CI failure analysis live in Gitar, a separate Sonar product, not in SonarQube Server. If you need a product that reads an open MR and comments like a reviewer, SonarQube Server is not that product. It verifies code against rules in CI. Those are different jobs, and choosing depends on which one the team actually wants.
That is the honest gap in the "which tool reviews AI code on GitLab or Azure DevOps" space. Most answers assume GitHub exists. SonarQube Server is the documented non-GitHub path for verifying code, and its own docs are clear about what it does and does not include.
