Finance · SaaS
The Mid-American Conference school becomes a founding partner of the Austin-based platform, gaining real-time visibility into student-athlete NIL activity, streamlined compliance workflows, and the market intelligence to identify new NIL and revenue opportunities.
The Mid-American Conference school becomes a founding partner of the Austin-based platform, gaining real-time visibility into student-athlete NIL activity, streamlined compliance workflows, and the market intelligence to identify new NIL and revenue opportunities.
Oct 15 · 00:04·GlobeNewswire
AI · SaaS
AI agents have changed how much code a team can produce in a day. Review queues haven’t kept up, and delivery stalls while changes wait for a closer look. The usual workarounds (reminders, reviewer rotations, assigning a team) buy a little time and then burn people out.
Client-side review with AI helps the author by catching issues as the code is being written, before a merge request even opens. But it only goes so far. A review that only checks quality still leaves the organization without enforceable policy on the way to production, since comments on a diff do not decide whether a change can merge or reach production.
Every merge request still needs a consistent certification step tied to pipelines, security findings, code owners, approval rules, and audits. Review in the author’s environment cannot standardize that work across all your projects, route policy-bound changes to the right person, or show leaders what the agent did before the change merges. As agents write more of the code, automated reviews need to happen in the platform that already tracks each change from plan to production, and where identity, policy, and oversight controls are already in place.
Earlier this year, we made Code Review Flow generally available on GitLab Duo Agent Platform, bringing that sign-off to the merge request and making agentic review part of the same platform where code ships. Teams can turn it on so every change is automatically addressed under rules you set once, at $0.25 per review, delivering an estimated 100x ROI. That predictable unit cost is low enough to leave automatic review on for every merge request, which is how reviews move at machine speed while staying cost-efficient at organizational scale.
Agentic reviews, built for how you ship
Code Review Flow is native to GitLab merge requests, so it covers your whole environment. It runs as a CI/CD job on your runners, whether GitLab-hosted or your own, so review executes in the same environment as the rest of delivery. It works the same way on GitLab.com, GitLab Dedicated, and GitLab Self-Managed, keeping inference under your control with self-hosted models when air-gapped or regulated environments require it. You also have the flexibility to choose which model acts as the foundation for agentic code review: GitLab-managed or your own self-hosted models.
When certification is the default on the merge request, teams get coverage, control, and follow-through in one place. Here are the key highlights for agentic code review with GitLab Duo Agent Platform:
Every merge request is reviewed, without anyone having to ask. Turn on automatic reviews at the project, group, or instance level and settings cascade. Authors don’t have to remember to request a first pass.
Standards you set once for how the group ships. Custom review instructions capture language conventions, security practices, and path-specific rules. A group can point the Code Review Flow at a template project so those standards travel with the work. Pair guidance with GitLab’s enforced security and compliance controls when a requirement must always hold.
Follow-through on every finding. Follow-up review rechecks what GitLab Duo Agent Platform already flagged, verifies fixes, and avoids repeating the same points. At that price, you can leave automatic reviews everywhere.
The right human, when policy requires one. Code owners and relevant approval rules still apply. Recommend Reviewers Flow suggests the smallest group that can satisfy those rules based on their level of expertise, workload, availability, and timezone.
How agentic code review works in GitLab
Within GitLab, code review happens on the merge request, next to your pipelines, security findings, and approvals.
A merge request opens (or becomes ready). Automatic review can start the Code Review Flow, or an author assigns GitLab Duo.
The flow runs as a CI/CD job on your runners, analyzes the change with repository and merge request context, guided by your custom review instructions and the models your group selected, and comments on the diff.
Authors and their coding agents push fixes. Follow-up review verifies Duo’s prior findings and carries context forward from the earlier pass.
When a human must approve, Recommend Reviewers Flow proposes who should take the request; you assign from the merge request.
Pipelines, security findings, approval rules, and the session record stay in the same place, so “reviewed” means certified on the path to production.
Watch agentic code review in GitLab in action:
What’s ahead
Our platform roadmap for agentic code review includes:
Deeper review when the change warrants it. An extended analysis pass will pull in calling code and tests for high-complexity merge requests, under your model-selection controls.
Clearer decisions on the merge request. GitLab Duo will be able to approve or request changes under settings you control.
Focus on risk. Risk assessment on the merge request will help teams see which changes deserve more attention.
Review before the merge request opens. Local review in Duo CLI will let developers run project review guidance against working-tree changes before the merge request runs the organization’s official check.
As agents write more of your code, you need reviewed code reaching production, with every change held to your standards and your reviewers focused on the changes that need a person. Every improvement on this roadmap is built to help you get there.
Getting started
If you are new to GitLab Duo Agent Platform, you can get access with a free trial. If you already are a GitLab Premium or Ultimate customer, you can simply turn on Duo Agent Platform and use the GitLab Credits included with your subscription.
This blog post contains "forward‑looking statements" within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934. Although we believe that the expectations reflected in these statements are reasonable, they are subject to known and unknown risks, uncertainties, assumptions and other factors that may cause actual results or outcomes to differ materially. Further information on these risks and other factors is included under the caption "Risk Factors" in our filings with the SEC. We do not undertake any obligation to update or revise these statements after the date of this blog post, except as required by law.
Oct 15 · 00:00·GitLab
SaaS · Jobs & workplace
Agents are working across your team's software development lifecycle, but most still operate as separate tools, leaving the context, handoffs, and permissions for your team to stitch together. When your agents use APIs for these disparate tools, they often guess at endpoints and use up their context window on extra calls. The GitLab MCP server, now generally available with GitLab 19.5, connects your team’s external agents to your entire software lifecycle — from planning through production.
The GitLab MCP server enables any MCP-compatible agent to run GitLab workflows from the client your team already works in, getting what it needs in fewer calls and with less context bloat. Agents can work across code, merge requests, work items, and pipelines, and hand work to agentic flows within GitLab Duo Agent Platform. Each action runs under your existing GitLab permissions.
Built for how agents work
APIs are built for developers writing code. An agent that uses one has to work out which endpoints to call and make several calls to assemble one answer. Model Context Protocol (MCP) is an open standard built for agents. An MCP server tells an agent what it can do and offers a curated set of tools designed around real workflows. Agents get the tools they need with more focused context, in fewer calls, and needing less data to carry through each task.
The GitLab MCP server applies that approach to your workflows across your projects, supporting all your team members within the GitLab permissions you already set.
Whether you're a developer handing a task to an agent or a team deciding how agents should work across your organization, your agents get tool coverage broad enough to complete the work, with access that follows each user’s GitLab permissions. Developers can even start GitLab Duo Agent Platform flows from the MCP-compatible coding agent they already use.
Here is Claude Code using the GitLab MCP server to start the Fix Pipeline flow in Duo Agent Platform:
More of your workflow, within reach of an agent
In addition to the tools announced in 19.4, the GitLab MCP server now includes more tools for working with code and pipelines, and for finding the right group or doc.
Code: add_branch starts a feature branch, get_repository_file reads a file at any ref, and semantic_search finds code by meaning, answering "where is this implemented?" without knowing the file or symbol name.
Pipelines: get_pipeline shows why a pipeline is red, with its jobs, downstream pipelines, and artifacts on request. list_pipelines surfaces patterns across recent runs, and get_artifact_file reads a single file from a job's artifacts, such as a log, report, or test fixture, without downloading the whole archive.
Orientation: list_groups lets an agent browse your group hierarchy to find the right group instead of guessing at identifiers, and list_wiki_pages, an opt-in tool, surfaces runbooks and docs before it answers a how-to question.
In 19.5, the MCP server tool catalog is also simpler to work with. Related tools are now consolidated, with fewer tools doing more. get_merge_request lets you ask your agent for a merge request’s commits, diffs, pipelines, conflicts, or notes. get_pipeline now includes get_pipeline_jobs, so you can ask for a pipeline’s jobs along with the pipeline itself. Your agents spend less time choosing the right tool and pull in only the details a task needs.
Toolsets let you choose which groups of tools the server returns. Each agent works from a focused set of tools that fits your team’s workflow instead of everything the server offers. A smaller set makes it less likely that an agent picks the wrong tool and has to retry. Most groups are on by default, and code security and wikis are available as opt-in groups. Browse the full catalog in the tools reference.
Start GitLab flows without leaving your client
Calling tools is one way an agent works with GitLab. Now, an agent can also hand a job to GitLab Duo Agent Platform and follow that job to the result without leaving your client. It can find the flows a project offers with list_duo_agents_and_flows, start a new flow from a goal in plain language with start_duo_session, and check progress with get_duo_session and list_duo_sessions. The work runs in a CI job inside GitLab, under the same context layer, policy checks, and audit trail as any other Duo Agent Platform session.
When a session needs a decision, it pauses for your input. With send_duo_session_input, you approve or reject the agent’s proposed action, or answer its question, and the session picks back up, keeping you in the loop. The duo_agent_platform toolset is included by default alongside the rest of the GitLab MCP server's tools.
Connect your agents to GitLab today
The agents supporting your software lifecycle will continue evolving. As your team adopts new agents, the GitLab MCP server connects each one to GitLab’s tools and flows, so they’re productive from day one.
You can connect the agents your team already uses by following the MCP server documentation, which includes setup instructions for Claude Code, Claude Desktop, Cursor, GitHub Copilot, OpenAI Codex, Gemini, Kiro, Zed, and other MCP-compatible clients. The GitLab MCP server is available on the Free, Premium, and Ultimate tiers, on GitLab.com, GitLab Self-Managed, and GitLab Dedicated. On GitLab.com, per-user rate limits are set at 60 calls per minute on Free and 600 on Premium and Ultimate.
If you’re new to Duo Agent Platform, start a free trial. Already on Premium or Ultimate? Turn on Duo Agent Platform and use the GitLab Credits included with your subscription.
Oct 15 · 00:00·GitLab
SaaS · Nonprofits
The code is written. Now who reviews it?
The volume of code has never been greater, but delivery hasn’t kept pace. At Meta, code changes on internal platforms grew 220% year over year, while changes that reached users as new features grew only 36% (Reuters, August 2026). Every one of those changes has to clear review before it reaches users.
Automated review absorbs much of that load. Code Review Flow in GitLab Duo Agent Platform reviews merge requests as they arrive, follows custom review instructions you define per project, and costs a flat 0.25 GitLab Credits per review ($0.25 at list price). If a manual review takes about 15 minutes of a senior engineer’s time, that’s roughly $25 per review, so automated review cuts per-review cost by 99% (GitLab).
Automated review doesn’t take people out of the loop. Approval rules, CODEOWNERS, and compliance policies still require a person to sign off on many changes. For those merge requests, the first slowdown is often finding the right reviewer, and it happens before anyone reads a line. The right reviewer needs expertise in the code being changed, room in their queue, and availability in a time zone where they can respond quickly. When authors can’t see those factors, a few senior engineers carry most of the reviews while other qualified reviewers sit idle.
GitLab 19.5 removes that step with Recommend Reviewers Flow. When you create a merge request, GitLab recommends the best individual reviewer based on workload, time zone, availability, and expertise defined by approval rules and CODEOWNERS. The flow explains why it chose that reviewer and lets you assign them in one click. Across your engineering organization, reviews start sooner, review load spreads across every qualified engineer, and more of the code your team writes reaches users.
Watch Recommend Reviewers Flow in action:
Review is a routing problem, not a headcount problem
Teams often treat slow reviews as a people problem. They add reminders, review rotations, extended time zone coverage, and escalations. Those workarounds cost people time and can lead to burnout, and they leave the real cause untouched: routing. The expertise and capacity already exist; there’s just nothing to match them to each merge request as it arrives.
Without that match, the author has to answer questions GitLab already can. Who knows this part of the codebase? Who has room in their queue? Who is online right now? Authors fall back on habits that slow everyone down:
Assigning a whole group. Everyone gets notified, nobody feels responsible, and the merge request waits for a volunteer.
Defaulting to the same trusted reviewer. That person becomes a bottleneck, and their own work stalls.
Guessing across time zones. The reviewer you picked just signed off for the day, so your feedback arrives tomorrow.
Reviewers pay a price, too. Group assignments flood their notifications with merge requests they will never review, which makes the ones that need them easier to miss. And the reviewers everyone defaults to absorb a growing share of the queue on top of their own work, which wears them down faster.
How intelligent reviewer suggestions work
GitLab Duo Agent Platform runs Recommend Reviewers Flow on your merge request and does the research for you:
You create your merge request. A trigger starts the flow automatically when a merge request is created, whether in draft or ready state, so suggestions arrive from the start.
The flow evaluates eligible reviewers. It weighs each candidate’s workload, time zone, availability, and expertise as defined by approval rules and CODEOWNERS, to find the person best suited and positioned to respond.
You see the recommendation and the reasoning. The flow explains why it chose each reviewer, so you can approve the suggestion based on that context.
You assign with one click. Suggestions appear in a dedicated panel on the merge request. You decide who reviews and when.
This design keeps you in control of timing. You can finish iterating or address automated code review feedback first, then bring in a human reviewer when the change is truly ready. You set it up as a flow trigger in your project rather than a project setting, so it fits alongside the other agentic workflows your team already runs.
What your team gains
The right reviewer match means faster feedback, clearer accountability, and a more balanced workload. Recommend Reviewers Flow makes that call consistently, at scale, and with reasoning you can see and override.
Recommend Reviewers Flow also works alongside the other foundational flows in GitLab Duo Agent Platform that handle the work around a merge request:
Run Code Review Flow first, so automated feedback lands before a person is brought in.
Add Security Review Flow to check merge request changes for business logic vulnerabilities before they merge.
Use Fix CI/CD Pipeline Flow to diagnose and repair failed jobs, so a broken pipeline doesn’t hold up an approved change.
Use Custom Flows to build Recommend Reviewers Flow into the process your team already follows.
Each step from merge request to merge runs on the same platform, under the same policies, so more of the code your team writes actually reaches users.
Get started
Intelligent reviewer suggestions are generally available in GitLab 19.5 for GitLab.com, GitLab Self-Managed, and GitLab Dedicated. To try them, add the Recommend Reviewers Flow trigger to your project, then create your next merge request. Learn more in our documentation.
New to GitLab Duo Agent Platform? Start a free trial today. Already a GitLab Premium or Ultimate subscriber? Turn on Duo Agent Platform and use the GitLab Credits included with your subscription.
Oct 15 · 00:00·GitLab
Crypto · SaaS
Credentials often start in an engineer's local dev environments, then get copied into unscoped CI/CD variables to keep pipelines running. Stored there as a raw value rather than a reference to a scoped secret, a signing key reaches every job in the pipeline — compromised or not.
Standing up a standalone vault narrows that exposure but requires mirroring every change to project membership, protected branches, and production environments. When the vault falls out of sync, a pipeline breaks or an agent’s service account keeps access it no longer needs.
GitLab Secrets Manager tightens credential security without a second permission model. It is now generally available in GitLab 19.5 for Premium and Ultimate on GitLab.com and GitLab Self-Managed, with GitLab Dedicated coming soon. Built on OpenBao, it stores build-time and runtime credentials under the same permissions and audit trail as your code. Platform teams can offer developers self-service secrets, and security teams get credentials scoped to the jobs that use them, plus the pipeline and job ID on every CI/CD read.
"GitLab Secrets Manager lets us centralize secrets across CI/CD, Kubernetes, and infrastructure as code without standing up multiple vaults or maintaining separate integration points. It also strengthens our supply chain security by tightening which users and pipelines can access a given credential." - Jeremy Nauta, Software Architect, OneTrust
How Secrets Manager scopes build-time secrets to each job
Agents can take actions no one anticipated, so security teams need to regard every job as if its agents will use any credential it can reach. Secrets Manager narrows what agents can reach with the context GitLab already holds about each job: its project, the branch it runs on, whether that branch is protected, and the environment it targets.
A developer declares the secret a job needs with the secrets: keyword in .gitlab-ci.yml, and GitLab injects the value only into jobs that declare it and fall within its scope. Scope conditions accept wildcards on branch and environment, and they combine, so one rule can require a protected branch and a production/* environment before a job receives the credential.
Inside the job, GitLab writes the value to a temporary file and exposes only its path, which limits exposure in subprocesses, crash dumps, and telemetry. GitLab masks the value in job logs and discards it when the job ends. Unlike a CI/CD variable, a secret is never readable in your project configuration.
OpenBao encrypts secrets at rest with AES-256-GCM, so a copy of the secrets database holds only ciphertext. Jobs fetch values straight from OpenBao with short-lived tokens bound to each job’s identity, which keeps plaintext secrets out of the GitLab application.
See how to get started with Secrets Manager:
Revoke and trace an exposed credential
When the axios npm package was compromised, a SANS advisory warned teams to "assume all environment variables on affected systems were exfiltrated" and extend investigations to CI/CD runners and build infrastructure. Responders had to work out which credentials each affected job could read, how to cut off access, and which runs read them.
With Secrets Manager, when a job runs a poisoned dependency, the exposure stops at the secrets that job declared and was authorized to read. To clean up, revoke and replace the leaked credential, update the value in Secrets Manager, and audit that one job while other pipelines keep running. Secrets Manager prompts you to set a rotation reminder when you create a secret. Dynamic credentials are coming soon and will provide ephemeral access without manual rotation.
GitLab streams every secret create, read, update, and delete event to your audit event destinations and records changes in the audit trail. Each pipeline read carries the pipeline and job IDs, which tie to the commit, the triggering user, and the merge request, when there is one. Incident responders and auditors can trace a read to the change behind it without correlating logs from a CI system, a vault, and an identity provider. Audit events never contain secret values.
Govern secrets with the permissions that govern your code
As agents take on more work, platform teams field more requests for pipelines and service accounts that need credentials. When those requests queue, teams fall back on broad grants and shared secrets.
Secrets Manager uses the GitLab namespace as its isolation boundary. Projects inherit secrets defined in the groups above them, so you define a shared credential once. Owners grant read, write, and delete permissions to specific users or default roles, using the same membership model that governs the code. Remove a person or an agent's service account from a project, and that identity's access to the project's secrets ends.
Developers reference secrets through the project access they already hold. When a secret reference breaks, they fix it in the same merge request as the code, with no second repository, approver, or access ticket. With a governed credential one line away, fewer secrets end up in over-scoped CI/CD variables, local files, or the repository.
One store for pipelines and runtime workloads
Kubernetes, Terraform, and scripts often get separate secret stores, each with its own access model and logs. Secrets Manager serves runtime tools from the same store as pipelines, under the same permissions and audit trail:
Kubernetes, through External Secrets Operator. ESO re-fetches the secret on a set interval and updates the Kubernetes Secret in place, so a rotated value reaches the cluster without a pipeline run.
Terraform and OpenTofu. They read a secret as a data source at plan or apply time and keep credentials out of .tfvars files and CI/CD variables.
OpenBao and Vault CLIs, through the Vault-compatible API. Teams keep their existing scripts and point them at Secrets Manager.
Other runtime tools, through the Secrets Manager API.
Each runtime tool authenticates with a service account or an access token, and that identity needs project membership and explicit read permission for the secret. GitLab then issues a separate token, valid for five minutes, that the tool uses to fetch it.
How Secrets Manager fits with GitLab's supply chain controls
GitLab’s governed software factory connects code, pipelines, packages, and secrets on one platform, with one identity model and one record of how a change reached production. Dependency Firewall decides which packages enter a pipeline, Secrets Manager limits which credentials the pipeline can reach, and Artifact Central governs what you ship.
Secrets Manager supports two of the five stages in the GitLab Security Standard, GitLab's framework for letting agents earn autonomy: For Authorize, it binds each job to the secrets its identity and scope allow, and for Respond, it streams every CRUD event.
Secret push protection blocks commits containing credentials before they reach the repository, and Secret detection finds the ones already in your code and history. GitLab Duo Agent Platform triages what those scans find and flags likely false positives, so your team revokes, rotates, and audits only real leaks.
GitLab's existing integrations for HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, and Google Cloud Secret Manager keep working alongside Secrets Manager, so you can migrate at your own pace.
Get started
GitLab Secrets Manager is a paid add-on for Premium and Ultimate, billed through GitLab Credits: 1 credit per secret stored per month, and 1 credit per 2,500 read operations. An enterprise license agreement is available for air-gapped environments.
On GitLab.com, top-level group Owners can try GitLab Secrets Manager free for 30 days or 500 evaluation credits, whichever ends first. Go to your top-level group, select Secure > Secrets Manager, then Start 30-day trial.
On GitLab Self-Managed, your administrator must install and enable Secrets Manager, following the documented sizing and high-availability guidance.
GitLab Dedicated support is coming soon.
To find the first credentials to move, run the secret audit tool for CI/CD variables, which flags variables likely to hold credentials. A migration workflow for CI/CD variables is in development.
Have suggestions or feedback? Share them in the Secrets Manager feedback issue.
Oct 15 · 00:00·GitLab
AI · SaaS
Tagshop AI, an AI-powered content creation platform built to help brands produce engaging visual content, has expanded its video generation capabilities with the addition of Kling 4.0.
Oct 15 · 00:00·1888 Press Release
AI · SaaS
Rabby's USA, Inc., the U.S. sales company for TuneAIBot, today invited U.S. tour operators to explore a 30-day evaluation of TuneAIBot, an AI customer-support platform developed by Japan-based Surge Craft Co., Ltd.
Oct 14 · 22:43·PRLog
SaaS · Education
USA Scheduler provides school scheduling software for K-12 districts, school administrators and counselors. The platform covers automated master schedule creation, class size balancing, student and course conflict resolution
Oct 14 · 22:41·freePRnow
Finance · AI
Funding will accelerate development of Horizon, which helps frontier AI labs train and evaluate models, and Recursion Managed Agents, which enables enterprises to deploy agents that improve through experience. SAN FRANCISCO, Oct. 14, 2026 -- Labelbox, the AI platform powering...
Oct 14 · 21:11·PR Newswire
AI · SaaS
New AI platform GenoMorph identifies candidate regulatory DNA linked to the dodo's distinctive craniofacial anatomy, while technologies adapted from earlier species programs advance Nicobar pigeon germ-cell development, chicken stem-cell chimeras and embryo gene editing. DALLAS, Oct. 14,...
Oct 14 · 21:00·PR Newswire
AI · SaaS
The TrueLoyal MCP, now in beta, lets loyalty teams ask questions about their members and purchases in plain language and build their own dashboards. SAN ANTONIO, Oct. 14, 2026 -- TrueLoyal, the loyalty and advocacy platform behind Rewards and Fan Club™, today announced that...
Oct 14 · 21:00·PR Newswire
SaaS
Bipartisan firm marks two decades of expertise-driven work, lasting client relationships, and a platform built for what's next WASHINGTON, Oct. 14, 2026 -- Twenty years ago today, Seven Letter began as a sole proprietorship in Washington, D.C. with a straightforward but – at...
Oct 14 · 20:51·PR Newswire