GitLab Duo Agent Platform Integration

Last Updated: 2026-02-16 Status: Planned GA: GitLab 18.8 (January 2026)

Overview

GitLab Duo Agent Platform embeds AI agents across the entire SDLC. It provides three extension vectors plus flows for chaining agents.

Pricing: GitLab Credits — Ultimate gets 24 credits/user/month included. On-demand: $1/credit beyond included.

Extension Vectors

Custom Agents (Vector 1)

Agent 1: [object Object]

Purpose: OSSA manifest validation, registry queries, separation of duties enforcement

Tools: Read File, Find Files, Blob Search, Get Issue, Create Issue Note, Get Repository File, List Repository Tree, GitLab API GET

System Prompt Focus: OSSA schema validation, tier rules (tier_1_read, tier_2_write, tier_3_full), separation of duties conflict matrix, manifest structure guidance.

Agent 2: [object Object]

Purpose: Pipeline triage, infrastructure health, deployment status

Tools: Get Pipeline Errors, Get Job Logs, Get Pipeline Failing Jobs, CI Linter, Get Merge Request, Run Command, GitLab API GET

System Prompt Focus: Pipeline failure analysis, job log parsing, infrastructure status from MCP, Vast.ai instance health.

Agent 3: [object Object]

Purpose: Drupal module management, migration assistance, all_drupal_custom sync guidance

Tools: Read File, Find Files, Blob Search, Get Repository File, List Repository Tree, Create Issue, Create Issue Note, Grep

System Prompt Focus: Drupal 11 expertise, Acquia Cloud patterns, buildkit drupal sync workflow.

Agent 4: [object Object]

Purpose: Vulnerability triage with OSSA compliance context

Tools: List Vulnerabilities, Get Vulnerability Details, Dismiss/Confirm Vulnerability, Create Vulnerability Issue, Link to MR

System Prompt Focus: FedRAMP/NIST awareness, severity assessment, automatic vulnerability-to-issue linking.

External Agent (Vector 2): [object Object]

Runs as CI/CD job triggered by @mention in issues/MRs. Uses Claude Code with restricted tools.

Service Account: ai-bluefly-builder-blueflyio — PAT with api, read_repository, write_repository scopes.

Conventions enforced via AGENTS.md:

• Branch from release/v0.X.x as {issue#}-{slug}
• Commit messages: Refs: #{issue_number}
• Import from @bluefly/agent-* packages, never duplicate
• Never modify version fields, create tags, or commit to main
• TypeScript strict, no any types

Custom Flows (Vector 4)

Flow 1: OSSA Compliance Review

Triggers on MRs modifying platform-agents/. Two-stage: validate manifest → check separation of duties.

Flow 2: Issue-to-MR (Bluefly Convention)

Triggers by assigning flow service account to an issue. Two-stage: analyze and plan → implement changes.

Flow 3: Drupal Module Review

Triggers on MRs to all_drupal_custom/. Validates module structure, coding standards, sync compatibility.

Key URLs