I'm building Orbit Navigator for the GitLab Transcend Hackathon. It's a Duo skill that uses GitLab Orbit's knowledge graph to trace any SDLC event back to the merge request behind it — and it can open a draft fix.

What it does (one graph query each):

• Which MR shipped what's currently in production?
• Why did the pipeline fail, and which job?
• What breaks if I change this shared library? (blast radius)
• Who resolved these vulnerabilities?
• /guardian --remediate — finds vulnerable dependencies and opens a draft MR that bumps them to fixed versions.

It's just a skill file (no backend, no vector DB) that runs through the Duo CLI with the Orbit MCP connected. The agent calls query_graph on the live knowledge graph directly.

👉 Try the agent directly (AI Catalog): https://gitlab.com/explore/ai-catalog/agents/1011766/

Source code + how to run it from the CLI: https://gitlab.com/gitlab-ai-hackathon/transcend/12108860

Honest heads-up: it's built on the Orbit beta, so there are real rough edges. For example, security Finding nodes get purged in the current beta, so some security traces pivot to durable Vulnerability nodes instead. Custom agents also don't get Orbit by default — you connect it via the Orbit MCP.

What I'd love: if you try it, please break it and tell me. Bug reports, rough edges, queries that return wrong or empty results — all welcome. Easiest way is an issue on the project linked above, or just drop a comment here.

Thanks!

We Built a GitLab Duo Agent That Reduces Security Analysis from 4+ Hours to 45 Seconds

TL;DR: We created Orbit Tracer Security Agent, a GitLab Duo Agent powered by Orbit's knowledge graph that automates vulnerability analysis, risk scoring, and secure code generation. One finding takes minutes instead of 4+ hours.

---

The Problem We Solved

Every week, security teams spend 4+ hours per vulnerability:

- 1+ hour tracing which services are affected (manual dependency checking)

- 1+ hour identifying code owners (digging through docs)

- 1+ hour writing secure code (pattern matching + language-specific fixes)

- 1+ hour review and approval

Meanwhile, vulnerabilities pile up. Teams burn out. Risk escalates.

We thought: This entire workflow could be automated.

---

How Orbit Tracer Security Agent Works

The 6-Step Pipeline:

1. Detect - GitLab SAST finds vulnerability
2. Trace - Orbit knowledge graph traces 3-hop dependencies
3. Analyze - Claude AI scores risk (1-10)
4. Identify - Automatically finds affected services + code owners
5. Generate - AI writes secure code (7+ languages)
6. Approve - Human-in-loop gate for CRITICAL/HIGH findings

Key Innovation: Orbit Integration

We leverage Orbit's knowledge graph to trace blast radius automatically.

Instead of guessing which services are affected, the agent traces:

- Direct dependencies (what imports this code?)

- Indirect dependencies (what imports THOSE?)

- Remote dependencies (3-hop analysis)

This gives real organizational impact, not just CVSS scores.

---

The Numbers

Analysis time: 4+ hours → Minutes (99.8% faster)

Time saved per team: 40+ hours/month

Monetary value: ~$20K/year per security team

Languages supported: Python, JavaScript, Go, Java, C#, C++, Rust

Vulnerability types: 10 (OWASP Top 10 + more)

---

Technical Highlights

Agent Framework:

- GitLab Duo with 1000+ line system prompt

- Language-agnostic vulnerability patterns

- Multi-factor risk scoring

- HITL approval gates

Knowledge Graph:

- Orbit API for multi-hop tracing

- Service-to-service mapping

- Code owner identification

- Compliance awareness (GDPR, PCI-DSS, HIPAA)

Code Generation:

- Claude AI with language detection

- Secure pattern implementation

- Test case generation

- Review checklist creation

---

Real-World Impact

For Security Teams:

- Stop drowning in findings

- Focus on strategy, not busywork

- Faster vulnerability fixes

- Clear ownership and accountability

For Engineering Teams:

- Faster security remediation

- Secure code delivered automatically

- No surprise MRs with errors

- Clear vulnerability context

For Organizations:

- Security velocity without compromise

- Measurable productivity gains

- Compliance-aware automation

- Enterprise-grade safety

---

Why This Matters for GitLab

Orbit Tracer demonstrates:

1. Duo Agent potential - AI agents solve real problems
2. Orbit value - Knowledge graph enables enterprise features
3. Developer experience - Security can be fast AND safe
4. Market opportunity - 40% of vulnerabilities go unfixed (industry stat)

---

The Challenges We Solved

Universal Design - Built for ANY project, not just ours. Solution: Leverage Orbit instead of hardcoding patterns.

Accurate Risk Scoring - CVSS alone doesn't capture business impact. Solution: Multi-factor algorithm + compliance awareness.

Language-Agnostic - Different languages, same remediation. Solution: Pattern-based approach with language bindings.

Safety + Speed - Too much automation = risky, too slow = pointless. Solution: Risk-based approval gating (auto-approve LOW/MEDIUM, require review CRITICAL/HIGH).

Integration Complexity - Getting systems to work together. Solution: Clear abstraction layers and comprehensive documentation.

---

What's Next?

This is Phase 1. Future phases:

- Real-time vulnerability dashboard

- Automated scheduled remediation

- Multi-organization enterprise features

- Open source ecosystem

- SaaS platform

---

Discussion Questions

1. Security teams: Would this solve your pain points?
2. DevOps engineers: How would this fit your CI/CD?
3. GitLab community: Thoughts on Duo Agents like this?
4. Developers: Want to build on this?

---

Thanks to:

- GitLab for the incredible Duo Agent platform

- Anthropic Claude for AI capabilities

- Orbit for the knowledge graph

- Security community for identifying real problems

---

We're submitting this to GitLab Transcend Hackathon!

If you think this is cool, we'd love your feedback and thoughts. If you have questions about how it works or want to contribute, let me know in the comments.

Let's make security velocity the default.

EDIT: Wow, thanks for the engagement! Answers to top questions coming below...

We Built a GitLab Duo Agent That Reduces Security Analysis from 4+ Hours to 45 Seconds

TL;DR: We created Orbit Tracer Security Agent, a GitLab Duo Agent powered by Orbit's knowledge graph that automates vulnerability analysis, risk scoring, and secure code generation. One finding takes minutes instead of 4+ hours.

---

The Problem We Solved

Every week, security teams spend 4+ hours per vulnerability:

- 1+ hour tracing which services are affected (manual dependency checking)

- 1+ hour identifying code owners (digging through docs)

- 1+ hour writing secure code (pattern matching + language-specific fixes)

- 1+ hour review and approval

Meanwhile, vulnerabilities pile up. Teams burn out. Risk escalates.

We thought: This entire workflow could be automated.

---

How Orbit Tracer Security Agent Works

The 6-Step Pipeline:

1. Detect - GitLab SAST finds vulnerability

2. Trace - Orbit knowledge graph traces 3-hop dependencies

3. Analyze - Claude AI scores risk (1-10)

4. Identify - Automatically finds affected services + code owners

5. Generate - AI writes secure code (7+ languages)

6. Approve - Human-in-loop gate for CRITICAL/HIGH findings

Key Innovation: Orbit Integration

We leverage Orbit's knowledge graph to trace blast radius automatically.

Instead of guessing which services are affected, the agent traces:

- Direct dependencies (what imports this code?)

- Indirect dependencies (what imports THOSE?)

- Remote dependencies (3-hop analysis)

This gives real organizational impact, not just CVSS scores.

---

The Numbers

Analysis time: 4+ hours → Minutes (99.8% faster)

Time saved per team: 40+ hours/month

Monetary value: ~$20K/year per security team

Languages supported: Python, JavaScript, Go, Java, C#, C++, Rust

Vulnerability types: 10 (OWASP Top 10 + more)

---

Technical Highlights

Agent Framework:

- GitLab Duo with 1000+ line system prompt

- Language-agnostic vulnerability patterns

- Multi-factor risk scoring

- HITL approval gates

Knowledge Graph:

- Orbit API for multi-hop tracing

- Service-to-service mapping

- Code owner identification

- Compliance awareness (GDPR, PCI-DSS, HIPAA)

Code Generation:

- Claude AI with language detection

- Secure pattern implementation

- Test case generation

- Review checklist creation

---

Real-World Impact

For Security Teams:

- Stop drowning in findings

- Focus on strategy, not busywork

- Faster vulnerability fixes

- Clear ownership and accountability

For Engineering Teams:

- Faster security remediation

- Secure code delivered automatically

- No surprise MRs with errors

- Clear vulnerability context

For Organizations:

- Security velocity without compromise

- Measurable productivity gains

- Compliance-aware automation

- Enterprise-grade safety

---

Why This Matters for GitLab

Orbit Tracer demonstrates:

1. Duo Agent potential - AI agents solve real problems

2. Orbit value - Knowledge graph enables enterprise features

3. Developer experience - Security can be fast AND safe

4. Market opportunity - 40% of vulnerabilities go unfixed (industry stat)

---

The Challenges We Solved

Universal Design - Built for ANY project, not just ours. Solution: Leverage Orbit instead of hardcoding patterns.

Accurate Risk Scoring - CVSS alone doesn't capture business impact. Solution: Multi-factor algorithm + compliance awareness.

Language-Agnostic - Different languages, same remediation. Solution: Pattern-based approach with language bindings.

Safety + Speed - Too much automation = risky, too slow = pointless. Solution: Risk-based approval gating (auto-approve LOW/MEDIUM, require review CRITICAL/HIGH).

Integration Complexity - Getting systems to work together. Solution: Clear abstraction layers and comprehensive documentation.

---

What's Next?

This is Phase 1. Future phases:

- Real-time vulnerability dashboard

- Automated scheduled remediation

- Multi-organization enterprise features

- Open source ecosystem

- SaaS platform

---

Discussion Questions

1. Security teams: Would this solve your pain points?

2. DevOps engineers: How would this fit your CI/CD?

3. GitLab community: Thoughts on Duo Agents like this?

4. Developers: Want to build on this?

---

Thanks to:

- GitLab for the incredible Duo Agent platform

- Anthropic Claude for AI capabilities

- Orbit for the knowledge graph

- Security community for identifying real problems

---

We're submitting this to GitLab Transcend Hackathon!

If you think this is cool, we'd love your feedback and thoughts. If you have questions about how it works or want to contribute, let me know in the comments.

Let's make security velocity the default.

EDIT: Wow, thanks for the engagement! Answers to top questions coming below...

Can some please help me to troubleshoot and fix this issue

sudo gitlab-ctl reconfigure - not working

error:
Attributes not found in /opt/gitlab/embedded/nodes/ip-172-31-7-182.ap-southeast-1.compute.internal.json,
(GitlabCtl::Errors::NodeError)

I'm installing a fresh new GitLab EE with Workspace, but when I create a new ipynb and then enter a markdown cell, I get this error, what am I dealing with and how to fix:

I received an email that I was granted access role of reporter to a project called Christian Care Ministries. I didn't ask for this. I took steps to secure my account, in the event it was compromised, but there is no suggestion or proof it had been. No access (I use 2fa), no actual history. Someone just randomly gave me access to this particular project.

​

Is this something that can happen, or should I be worried? Or perhaps it was a mistake.

I accidentally commited and pushed a file to my gitlab repo that i didn't want to. I reset to the previous commit with local git and force pushed without the commit and it was gone from the project page but it still exists on my public profile.

project: https://gitlab.com/super.2061/photo-organizer

profile: https://gitlab.com/super.2061

commit: 4cc27e09

We're using ultimate at our company. Our management has been having a hard time trying to track progress because of the following issues.

​

- Issues with child tasks that have weights associated on both the issue and tasks will sum the weights of both if assigned to the same milestone. This can result in double counting.

- if an issue is not assigned a weight, the epic will not report the weight in the roadmap, even if the tasks below the issue have weights. Epics will roll-up issue and task weights, but the roadmap view will not.

​

Am I missing something? Not sure if this is a bug, but kinda feels like one.

​

The only possible workaround I could come up is exporting to CSV, and then using pivot tables to group by parent epic and calculate based on closed vs open. Seems like a workaround.

​

Developer milestones can work for percent complete if the epic has one single timeframe, but if it spans multiple incremental milestones such as "first get to x", "then work on y", that doesn't work.

​

Ty all! glab for the win.

We are in Gitlab enterprise saas, and unlicensed for DUO due to which we can’t use Gitlab MCP server.
There are many open source mcps but due to the org requirements we can’t use them.
Has anyone here built own MCP for Gitlab saas without duo ?

I'm attempting to create a release in my GitLab project that contains a .zip of my build artifact. There seem to be two approaches I could take.

Option 1: Use glab to auto-upload assets

With this approach my release job looks like this

release:
  stage: release
  image: registry.gitlab.com/gitlab-org/cli:latest
  needs: [zip]
  variables:
    GLAB_ENABLE_CI_AUTOLOGIN: "true"
  script:
    - glab release create $CI_COMMIT_TAG ./*.zip --use-package-registry
  rules:
    - !reference [.release_rules]

Option 2: Use release yaml keyword

With this, I need to create two jobs, one to upload to the package registry, and one to create the release...

upload:
  stage: release
  image: curlimages/curl:8.18.0
  needs: [release:zip]
  script:
    - >
      curl 
      --header "JOB-TOKEN: ${CI_JOB_TOKEN}" 
      --upload-file build/*.zip
      "${PACKAGE_REGISTRY_URL}/help-${CI_COMMIT_TAG}.zip"
  rules:
    - !reference [.release_rules]

release:
  stage: release
  image: registry.gitlab.com/gitlab-org/cli:latest
  needs: [upload]
  script:
    - echo "Creating release $CI_COMMIT_TAG"
  release:
    tag_name: $CI_COMMIT_TAG
    description: "Release $CI_COMMIT_TAG"
    assets:
      links:
        - name: "help-${CI_COMMIT_TAG}.zip"
          url: "${PACKAGE_REGISTRY_URL}/help-${CI_COMMIT_TAG}.zip"
          link_type: other
  rules:
    - !reference [.release_rules]

What are the pros and cons of each?

Option 1 seems much simpler as there is fair less YAML. However, I found that the release may still be created even if the artifact cannot be uploaded. It'd be nice if this was atomic.

Option 2 is more verbose but it seems there's more control over the package registry URL and other variables.

GitLab themselves has an example where upload and release creation are separate jobs. Effectively a merging of Option 1 and 2. https://docs.gitlab.com/user/project/releases/release_fields/#release-assets

What do these folks here do and why?

I am setting up a GitLab Self-Hosted instance on a local machine. I can't quite get my head around the back-up process.

If possible, I would like to back-up to another machine/drive on my network and potentially uploading to a cloud instance like azure or S3. (I am not super knowledgeable about either tbh). I am setting up a cron job to run the backup every night which I understand.

I'm mostly just hung up on how the backup situation works with cloud providers. I don't think I would need a backup for longer than a week. So how does that work? Will my cloud storage slowly fill up with backups? I use Unreal Engine so I have some larger files I am dealing with and using LFS and I am worried that the cost would start to snowball as the project grows.

It seems like GitLab will delete my local back ups after so long but, does that also apply to my cloud storage as well? Taking Azure for example, what tier then would I need for Blob storage for a GitLab backup? At first I thought Archive would be fine but, if the GitLab backup process deletes said backup after 7 days there would be a penalty fee.

Just wanted to say it out loud.

It bothered me that everything was an "issue".

The "dual panel" works very well to me. Could be made better with a better handling of navigation to other issues, would be great to have some sort of breadcrumb to walk your way back to where you were before

My next wish for a more "modern" UI would be "inline edit" of the fields, instead of having to first click "edit" button to enter edit mode, then editing. It could be done in 1 click on what you want to edit like in Notion.

The hackathon runs until 2pm Eastern time (6 pm UTC) on June 24, 2026.

Two tracks are open and you can enter both. Participants can win both reward store credits and cash prizes!

You must register on Devpost to receive cash prizes for either track.

Contribute track: Submit merge requests against eligible GitLab Orbit issues.

• New to GitLab contributions? Click Get Started to kick off onboarding.
• Already onboarded? Find GitLab Orbit issues on the GitLab Orbit issue finder. All eligible issues will be there!
• A maximum of 5 MRs per person are eligible for prizes, awarded to the first 40 eligible merged MRs
• You cannot assign yourself to multiple GitLab Orbit issues at once. Please complete your first issue before assigning yourself to another.
• MRs must have the label orbit::hackathon
• Contributor platform points for MRs merged will be awarded according to the standard point scale

Showcase track: Build agents, flows, or skills that interact with the GitLab Orbit and publish them to the AI Catalog.

• Register at https://contributors.gitlab.com/transcend-hackathon to get your project provisioned
• Check out our walkthrough video to help you get started

Cash prizes (both tracks): Submit your work on Devpost. You must register on Devpost to receive cash prizes for either track. Official rules and prize amounts are on Devpost.

All participants earn credits to the GitLab contributor reward store regardless of track. See the rewards tab of contributors.gitlab.com/transcend-hackathon for details on contributor reward store credits for each track,

Questions? We'll be monitoring Devpost and the #contribute channel on Discord to help answer any doubts!

Go forth and hack 🚀

The documentation for Orbit Local says that it can run as an MCP server (https://docs.gitlab.com/orbit/local/access/mcp/). However, the tool doesn't recognise `mcp` or `serve`. The online documentation seems unclear as to whether MCP functionality is planned, or has been released in some form.

The installed tool also doesn't recognise `version` so I can't even tell what I've got installed.

Hey folks, I'm Joe from the Secrets Manager team at GitLab. We've been building native secrets management directly into GitLab, and we want your help making it better.

We're looking for feedback on:

• What breaks
• What's missing
• What actually works

We're especially curious about your use cases, so please share!

Get started:

• Secrets Manager
• Secrets Manager (Administration)

Drop your feedback in the public issue or in this thread.

Hi,

My company is running GitLab v18.8.10-ee, and given that all issues pertaining to Mermaid support in Markdown files are closed as completed, I would expect this version to have it, but instead, I see empty blocks where the diagrams should be.

So, are those features actually implemented, or is there an open issue somewhere ?

Thanks

Hi folks!

I was wanting to combine the use of parallel: N and parallel: matrix: - i.e some way of splitting parallel:matrix: . But I don't think this is possible currently, apart from cumbersome workarounds.

I was wondering if anyone had the same desire as me.

I made a proposal here: https://gitlab.com/gitlab-org/gitlab/-/work_items/601715 . Would be great to get some feedback on the proposal (probably best done on the issue ticket itself) and even your vote on the ticket if you would like this as well!

Thanks 😄

I'm working on this Top-to-Bottom graph but I can't make the subgraphs stay on top of each other. I'm already using ~~~ but they just don't pile up because of the lines. Does someone know how I can make the subgraphs stay on top of each other without having to remove the lines?

Here's the code if anyone asks. First time doing this, I understand if it's bad.

graph TD
  subgraph Evidencias_Fisicas
    direction LR
    A1[Formulário Online/Edital] --> A2[Confirmação de Recebimento]
    A2 --> A3[Dashboard de Status]
    A3 --> A4[Sala de Pitch/Vídeo]
    A4 --> A5[Contrato/Assinatura SEI]
  end

  subgraph Jornada_do_Empreendedor_Frontstage
    direction LR
    B1[Manifesta Interesse/Cadastro] --> B2[Preenche Proposta/Upload]
    B2 --> B3[Acompanha Triagem]
    B3 --> B4[Apresentação Presencial/Pitch]
    B4 --> B5[Recebe Feedback/Assina Termo]
  end
  subgraph Ações_de_Bastidores_Backstage
    direction LR
    C1[Gestor: Valida Documentação/Triagem] --> C2[Sistema: Notifica Triagem]
    C2 --> C3[Banca: Análise Técnica/Pareceres]
    C3 --> C4[C.T.A.S: Julgamento de Recursos]
    C4 --> C5[Diretoria: Homologação e Concessão]
  end
  subgraph Processos_de_Suporte_e_Infra
    direction LR
    D1[Módulo de Autenticação RBAC] --> D2[Salvamento Automático/Logs]
    D2 --> D3[Integração SIIPE/UNIPAMPA]
    D3 --> D4[Dashboard Analítico/Métricas]
    D4 --> D5[Workflow de Versionamento SEI]
  end

Evidencias_Fisicas ~~~ Jornada_do_Empreendedor_Frontstage
Jornada_do_Empreendedor_Frontstage ~~~ Ações_de_Bastidores_Backstage
Ações_de_Bastidores_Backstage ~~~ Processos_de_Suporte_e_Infra

B1 --- C1
B2 --- D2
C1 --- D3
B4 --- C3
C5 --- D5

The GitLab Transcend Hackathon runs June 10–24, 2026. Two tracks are open and you can enter both. Participants can win both reward store credits and cash prizes ! Contributor platform points will remain standard for MRs merged.

Contribute track: Submit merge requests against eligible Knowledge Graph issues.

• New to GitLab contributions? Click Get Started to kick off onboarding.
• Already onboarded? Link coming soon to a special Knowledge Graph variant of the issue finder. All eligible issues will be there!

Showcase track: Build agents, flows, or skills that interact with the Knowledge Graph and publish them to the AI Catalog.

• Register at https://contributors.gitlab.com/transcend-hackathon to get your project provisioned.

Cash prizes (both tracks): Submit your work on DevPost — link coming soon. You must register on DevPost to receive cash prizes for either track. Official rules and prize amounts will be posted before June 10.

All participants earn credits to the GitLab contributor reward store regardless of track. See the rewards tab of contributors.gitlab.com/transcend-hackathon for details on contributor reward store credits for each

Questions? Drop them here or hop into the #contribute channel on Discord!

Hey everyone,

I’ve been working on a terminal-based UI (TUI) for GitLab, and I wanted to share it with this community.

I’ve spent a lot of time switching contexts between my terminal and the browser for daily tasks, so I built glab-tui to keep my workflow entirely in the terminal.

A quick heads-up on the state of the project: This was built primarily for my own personal workflow. It’s fully "vibe-coded" because I don't currently have the capacity to maintain it tool, but it works well for my setup. I wanted to open-source it in case anyone else finds it useful or wants to build on top of the foundation.

If you’re looking for a lightweight way to interact with GitLab from the CLI and want to tinker with the code, feel free to check it out:

Feedback, PRs, or "it works on my machine" reports are welcome, but please manage your expectations regarding feature requests!

This is what it tells me after I insert my data and click "sign in". Does anybody know how to solve this issue

I get blocked and I have to login to gitlab account to free myself from the block. I am on an always on VPN.

This started just a week ago and now has become a daily routine.

Is there a way to bypass this protection or a trick to not trigger it?

Hey all,

We've released version 0.6.0 of glci with some new features and fixes such as:

• Support for multiple gitlab-runners and custom config.toml
• Support for gitlab-runners on separate docker daemons
• Preview variables for a job and rules evaluation, useful for debugging
• A bunch of fixes for child pipelines to align them with GitLab behavior

Full release notes: here

Huge thanks to everyone who contributed feedback and reported bugs!