GitLab Duo Agent Platform

Agents use more than 80 built in tools that act on GitLab itself, creating commits and merge requests, submitting reviews, updating issues, dismissing vulnerabilities and running GLQL queries, with read only access to any REST or GraphQL endpoint, and in the IDE they also edit files, search, and run shell and Git commands. Agentic Chat and the Software Development flow connect to outside MCP servers over stdio, HTTP or SSE, and external agents and flows authenticate to other systems with CI variables and OIDC tokens, kept within an allowed domains policy.

Sourcedocs.gitlab.com/user/duo_agent_platform/agents/toolsread 2026-11-08

A flow combines one or more agents, and custom flows defined in YAML chain agent, deterministic tool, AI task and human input components with routers between them. Flows started from the web run on the customer's CI runners under Docker or Kubernetes, with an optional sandbox for network and file isolation, while IDE flows run on the developer's machine. Sessions record each run and pause at human checkpoints with a to do and an email, and the Developer flow can hand parts of its work to subagents with their own context, an experiment.

Sourcedocs.gitlab.com/user/duo_agent_platform/flowsread 2026-11-08

GitLab Orbit, a software lifecycle context graph for agents, runs generally available on GitLab.com and feeds the Planner agent and an MCP query tool, and semantic code search builds vector embeddings of repositories behind a REST API, an MCP tool and the CLI, in beta on GitLab.com and Self Managed. Agents also draw on project files, issues, merge requests, pipelines, wikis and commits, Agentic Chat itself uses keyword search, and context exclusions keep chosen files out of agent runs on a best effort basis.

Sourcedocs.gitlab.com/orbitread 2026-11-08

Every tool call in Agentic Chat asks for approval by default, with group owners or administrators setting whether a session can approve tools once or never, and outside MCP tools need approval per session unless listed as approved. Tool governance, in beta, sets each tool to always allow, always ask or always deny at group level with stricter project overrides and fails closed, and owners can block whole MCP servers and turn agents on or off by group. Flows started from chat run without asking, and Code Review approval decisions stay off by default.

Sourcedocs.gitlab.com/user/ai-governance/tool-governanceread 2026-11-08

Agents act through a composite identity that takes the narrower of the triggering user's role and a service account's Developer role, using tokens scoped to AI workflows and MCP, and merge requests are attributed to the person who started the work. Custom roles can govern the AI Catalog and agent artifacts, groups sign in through SAML, and prompt injection scanning can log or interrupt suspicious input. SOC 2 Type 2 and ISO 27001, 27017 and 27018 cover GitLab.com and Dedicated without naming the Duo AI gateway, and GitLab trains no generative models on customer data.

Sourcedocs.gitlab.com/user/duo_agent_platform/composite_identityread 2026-11-08

Every agent and flow run has a session with full or concise logs, and audit events record session starts, prompts sent to models, tool calls, tool approvals and denials, AI Catalog changes and flow triggers, with an AI audit events page and SIEM streaming still in beta. A credits dashboard shows usage per user and per product with usage caps, an AI governance dashboard is in limited availability, and an impact dashboard on GitLab.com tracks agent results across the software lifecycle.

Sourcedocs.gitlab.com/user/compliance/audit_event_typesread 2026-11-08

Agentic Chat remembers the most recent conversation, archives conversations 30 days after they start and cuts them at 200,000 tokens, and agent sessions are deleted 30 days after their last activity, while a tool lets an agent read context from another session. Custom rules and AGENTS.md files at user, project and folder level, plus agent skills, apply standing instructions to new conversations. GitLab keeps no memory that agents write and recall across sessions.

Sourcedocs.gitlab.com/user/gitlab_duo_chat/agentic_chatread 2026-11-08

The platform runs on GitLab.com, Self Managed and Dedicated. GitLab's managed AI gateway runs in Google Cloud regions in the US, Europe and Asia without a customer choice of region, while on Dedicated the gateway runs in the customer's own AWS region, and GitLab Duo Self Hosted serves models on the customer's infrastructure through vLLM, Bedrock or Azure OpenAI, including fully isolated networks with an add on for offline licenses. Dedicated for Government requires self hosted models in AWS GovCloud.

Sourcedocs.gitlab.com/administration/gitlab_duo_self_hostedread 2026-11-08

Eight foundational agents cover planning, CI, data analysis, security analysis, permissions, onboarding, support and flow creation, and thirteen foundational flows cover development from an issue, software development, code review, reviewer recommendations, pipeline fixes, CI conversion, breaking change resolution, work plans, SAST and secret false positive detection, vulnerability resolution, vulnerability context and security review. The AI Catalog lists these alongside GitLab managed external agents and shared custom agents and flows, each versioned and pinnable with public, private or restricted visibility.

Sourcedocs.gitlab.com/user/duo_agent_platform/flows/foundational_flowsread 2026-11-08

Flows start when someone mentions an agent, assigns an issue or a reviewer, or when a pipeline runs, passes, fails or is canceled, a merge request is created, approved, marked ready or hits a conflict, or a work item is created or changes status. Code Review runs on every new merge request and push, SAST false positive detection runs after each scan, scheduled triggers from every 15 minutes to monthly are in beta, and a REST API and the GitLab MCP server start flows from outside. Chat, slash commands and the Fix pipeline and Implement buttons start work by hand.

Sourcedocs.gitlab.com/user/duo_agent_platform/triggersread 2026-11-08

Claude Sonnet 5.5 is the default for chat and most flows, and the top level group owner on GitLab.com, or the administrator on Self Managed and Dedicated, can pick other models from the Claude, GPT, Gemini, GLM, Kimi and MiniMax families per feature and pin or restrict the models chat may use, with no automatic fallback. Self hosted deployments bring their own models through vLLM, Bedrock, Azure OpenAI, Anthropic, OpenAI or Google's agent platform, with other OpenAI compatible models in beta.

Sourcedocs.gitlab.com/user/duo_agent_platform/model_selectionread 2026-11-08

A REST API starts and manages flows, the GitLab MCP server accepts OAuth or fine grained personal access tokens over HTTP or stdio and offers tools that start, read and send input to agent sessions on every tier, and the Duo CLI runs headless for scripts and CI. GitLab.com allows 60 MCP requests a minute on Free and 600 on Premium and Ultimate, and external agents such as Claude Code, Codex, Amazon Q and Gemini plug into the same flows and catalog.

Sourcedocs.gitlab.com/api/duo_agent_platform_flowsread 2026-11-08

The Code Review flow scans and reviews each merge request against custom review instructions and reviews again after new pushes, the Developer flow runs the project's tests when they are configured, a test tool runs them on request, and SAST false positive detection and vulnerability resolution attach confidence scores to their findings. GitLab measures its own agents with an internal evaluation framework that customers cannot run, and there is no harness for testing how a custom agent or flow behaves before it ships.

Sourcedocs.gitlab.com/user/duo_agent_platform/flows/foundational_flows/code_reviewread 2026-11-08

No agent drives a browser, a desktop or another computer, and the Software Development flow cannot reach the web at all. Agentic Chat can search the web and fetch pages, an experiment that a group owner must allow and that is switched on per conversation, so web content arrives as fetched text. Pipeline, merge request and security work all runs through GitLab's own APIs and the customer's runners.

Sourcedocs.gitlab.com/user/gitlab_duo_chat/agentic_chatread 2026-11-08