# GitLab Duo Agent Platform

GitLab's agents and flows for planning, coding, security and CI/CD

**Verdict: conditional.** GitLab Duo Agent Platform is the natural agent layer for teams already running GitLab: event-triggered flows and CI, security and review agents live where the code and pipelines are. The deciding caveat is cost and trust. Usage is metered in credits, the included allowance is promotional, and a critical CVSS 9.9 flaw hit self-hosted AI Gateways. Right for GitLab shops that patch fast; skip it if your code lives elsewhere. Last verified 2026-10-03.

GitLab Duo Agent Platform is, per GitLab's docs, "an AI-native solution that embeds multiple intelligent assistants ('agents') throughout the software development lifecycle", and the docs page (docs.gitlab.com/user/duo_agent_platform/) lists Agentic Chat and Code Suggestions among its features. It reached general availability in GitLab 18.8 after a beta that began in 18.2; it is offered on GitLab.com, Self-Managed and Dedicated. Tier availability: our sources conflict on whether Free is included. The docs page metadata reads "Tier: Premium, Ultimate" and GitLab's product page says capabilities are available to Premium and Ultimate subscribers on 18.8 or later; but the same docs page says "Features available on the Free tier require the purchase of GitLab Credits" and lists Agentic Chat, Code Suggestions, Planner Agent and Data Analyst Agent across Free, Premium and Ultimate, while the pricing page says Free gets "Access to a set of Duo Agent Platform features" via separate GitLab Credits purchase. Per the docs, external agents and the Flow Creator Agent need Premium or above; the Security Analyst Agent and SAST vulnerability resolution flows are Ultimate only. Foundational agents listed in the docs include Planner, Data Analyst, CI Expert, Security Analyst and Flow Creator; foundational flows include Developer Flow, Code Review Flow, Software Development Flow, Fix CI/CD Pipeline Flow, SAST Vulnerability Resolution and Secret False Positive Detection. GitLab's product page adds an AI Catalog for activating and managing agents and flows, event-driven flow execution triggered by GitLab events, policy-driven control and traceability of flow sessions, and, for Self-Managed, self-hosted LLMs. Usage is metered in GitLab Credits ($1 per credit, pooled across the organization); the pricing page lists included credits of $12 per user per month on Premium and $24 on Ultimate and says included credits are "a promotional offer available for a limited time". A 60-day trial with no credit card is offered. Security: GitLab's patch-release notice for the self-hosted AI Gateway describes CVE-2026-90970 (CVSS 3.1 9.9, critical): an "Improper Neutralization issue in custom flow prompt template" that let an authenticated user with Duo Agent Platform access escape the prompt template sandbox through a crafted flow configuration, leading to arbitrary command execution on the AI Gateway. Affected: 18.1.6 through 19.2.3, 19.3.0 through 19.3.1, and 19.4.0. Patched: 19.2.4, 19.3.2, 19.4.1. GitLab-hosted instances (GitLab.com, Dedicated) were already protected.

## Strengths

- Teams already on GitLab who want agents and flows triggered by GitLab activity such as mentions or assignments, without a separate vendor (the product page lists Premium and Ultimate; the docs also describe Free-tier features with purchased credits)
- Regulated Self-Managed shops that need self-hosted LLMs and policy-driven control with traceability of flow sessions
- CI/CD and security work through prebuilt flows (Fix CI/CD Pipeline, SAST Vulnerability Resolution, Secret False Positive Detection)
- Self-hosted AI Gateway operators who cannot patch quickly (CVE-2026-90970, CVSS 9.9, fixed in 19.2.4, 19.3.2 and 19.4.1)
- Budget forecasting beyond the promotional credit allowance (the pricing page says included credits are for a limited time and cost per request varies by model)
- Teams whose repositories live outside GitLab (the platform sits inside GitLab plans; no standalone offering appeared on the pages we read)

## Pricing

- Model: paid
- Free: $0/user/mo
- Premium: $29/user/mo (billed annually)
- Ultimate: Custom (contact sales)

Website: https://about.gitlab.com/gitlab-duo-agent-platform/

## Sources

- [GitLab pricing page](https://about.gitlab.com/pricing/)
- [GitLab Duo Agent Platform](https://about.gitlab.com/gitlab-duo-agent-platform/)
- [GitLab AI Gateway 19.4.1 patch release](https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/)
- [GitLab Duo Agent Platform docs](https://docs.gitlab.com/user/duo_agent_platform/)

Canonical: https://neomanex.com/directory/gitlab-duo-agent-platform