What GitLab Duo does
GitLab Duo combines code suggestions, chat, review, security assistance, agents, and multi-step flows in GitLab and supported IDEs.
GitLab Duo spans more of the delivery lifecycle than a standalone coding assistant. Code Suggestions and IDE integrations support implementation, while chat can explain project context. The Agent Platform provides foundational, custom, and external agents plus reusable flows that can search sources, create files, and take actions. In merge requests, Code Review Flow runs multi-step analysis with repository and cross-file context through a CI job, while security-oriented flows can investigate false positives or draft vulnerability resolutions. Keeping these activities beside issues, pipelines, permissions, and audit history can reduce handoffs.
That integration also creates a complex control plane. Feature availability depends on GitLab version, tier, add-on, namespace, flags, runners, assigned seats, and credits. Agentic review needs an eligible runner and service-account access, and external tools expand the attack surface. GitLab documents prompt guardrails, but repository text, issues, and connected sources remain potentially hostile input. Administrators should restrict foundational flows and external agents, protect branches and environments, inspect service accounts, and preserve required CI and human approval. Generated security fixes need reproduction and regression testing rather than automatic acceptance.
Duo Core is included with eligible Premium and Ultimate subscriptions, while selected Agent Platform capabilities can run on Free with purchased GitLab Credits. Pro and Enterprise are seat add-ons whose current contract price should be verified; their included features do not consume usage credits. Agent Platform work uses credits with feature and model multipliers. Data handling varies by route: GitLab documents zero retention with Fireworks AI except prompt caching, limited retention for some other providers, retained chat and workflow history, and optional expanded trace logging. Self-hosted or hybrid models increase data control but require AI Gateway, model, network, runner, security, and upgrade operations.
How GitLab Duo works
Duo takes the authorized issue, repository, merge request, pipeline, or security context and routes a feature through GitLab's AI Gateway or configured self-hosted models. Assistive features return suggestions, while agents and flows can call GitLab tools or CI jobs; permissions and human review govern the result.
Resolve namespace, feature, and model access
GitLab evaluates the user's role, Duo entitlement, namespace, credits, enabled agents or flows, and cloud or self-hosted model route. Administrators constrain features, service accounts, tools, and projects.
Collect lifecycle context
The selected feature gathers permitted issue, repository, merge-request, pipeline, vulnerability, or external-source context. Model routing, prompt caching, history, and logging determine how that material is processed and retained.
Suggest code or run an agentic flow
Assistive features return chat or code suggestions, while agents and flows can create files, call GitLab tools, or launch CI-based analysis. Runners and feature-model multipliers affect operational cost and behavior.
Review output through DevSecOps gates
Engineers reproduce findings, inspect generated changes, and require protected branches, pipelines, security checks, and human approval. Administrators monitor credits, audit events, external agents, model updates, and retained histories.
How to set up GitLab Duo
Map the exact entitlement
Record the GitLab version, offering, tier, Duo add-on, seats, namespace, available credits, and whether cloud, self-hosted, or hybrid model routing is permitted.
Enable a narrow feature set
Begin with Code Suggestions or one chat use case, then allow only the required foundational flow, agent, project, and user roles at the top-level group.
Prepare runners and service access
For agentic flows, configure a dedicated Docker-capable runner and inspect service-account tokens, branch protection, CI variables, network egress, and external tool permissions.
Test context and retention paths
Use a non-sensitive project to examine sent context, selected providers, prompt caching, chat history, logs, and deletion behavior; keep expanded logging off unless justified.
Enforce independent review
Require human merge approval and trusted pipelines, reproduce review and security findings, monitor credits and audit events, and reassess models, flags, and integrations after upgrades.
GitLab Duo FAQs
Is GitLab Duo included with GitLab?
Duo Core is included with eligible Premium and Ultimate subscriptions. Selected Agent Platform features can also run on Free with GitLab Credits; other capabilities require Pro or Enterprise add-ons.
How do GitLab Duo credits work?
Agent Platform actions consume GitLab Credits according to feature and model multipliers. Duo Pro and Enterprise features use seat entitlements instead and do not consume those credits.
Can GitLab Duo review merge requests?
Yes. Code Review Flow provides agentic repository-aware analysis, while Duo Enterprise can use a non-agentic review path. Both still require engineer verification and normal merge controls.
Can GitLab Duo use self-hosted models?
GitLab supports self-hosted and hybrid configurations for eligible self-managed environments. Customers operate the AI Gateway, models, networking, runners, capacity, and security controls.
Does GitLab retain Duo prompts and responses?
Retention varies. GitLab documents model-specific policies, retained chat and workflow history, prompt-caching exceptions, and additional trace retention when expanded logging is enabled.
Listing reviewed 2026-07-15. Product details and pricing can change; verify important terms on the provider's website.
Related Coding AI tools
Related AI guides
Reviews
Tell the community what you made, what worked, and what you wish you knew before starting.