What Is GitLab Duo Code Review?
GitLab Duo code review is GitLab’s built-in AI review for merge requests. Duo reads the changes in a merge request (MR), posts comments and suggestions, and can follow review instructions stored in the project.
GitLab now runs most Duo reviews through the agentic Code Review Flow on the GitLab Duo Agent Platform. An older, non-agentic Duo Code Review still exists for GitLab Duo Enterprise.
Teams use Duo review as a first pass inside GitLab. Many also add a separate reviewer, especially when they run more than one Git platform or want rules checked the same way everywhere.
What Changed in GitLab Duo Code Review in 2026
GitLab spent 2026 moving Duo review from an add-on feature to the default agentic flow, and widening who gets it and how it’s configured.
The agentic flow became the main path. GitLab made Duo Agent Platform generally available, including the Code Review Flow (January 15, 2026, GitLab).
Access widened beyond paid tiers. GitLab 18.10 made Duo Agent Platform available on the GitLab.com Free tier (March 19, 2026, GitLab).
Review instructions moved up the hierarchy. GitLab 19.0 added group-level review instructions, and GitLab 19.1 added instance-level instructions for Self-Managed and Dedicated (May 21 and June 18, 2026, GitLab).
Automatic review became the default for newcomers. GitLab 19.1 turned on automatic Code Review Flow reviews by default for new GitLab.com Duo trials (June 18, 2026, GitLab).
Reviews started to remember earlier threads. GitLab 19.5 added follow-up reviews on all tiers, so Duo builds on its earlier comments and your replies (October 15, 2026, GitLab).
The same platform now writes and reviews MRs. Duo’s agent flows can open an MR and the Code Review Flow can review it, on one platform and model family, which raises the question of where an independent check fits, and that’s where Qodo’s take starts.
What Is GitLab Duo?
GitLab Duo is GitLab’s family of AI features, including Duo Chat, code suggestions, vulnerability explanations and the Duo Agent Platform, where agents and flows run tasks such as code review across the software lifecycle.
The Duo Agent Platform runs flows as jobs on GitLab runners. Self-managed instances need runners with the gitlab--duo tag for flows such as Code Review.
How GitLab Duo Code Review Works
A developer asks for a Duo review by assigning @GitLabDuo as a reviewer, or with the /assign_reviewer @GitLabDuo quick action. Projects and groups can also turn on automatic reviews.
| Part | How it works in Duo |
|---|---|
| Trigger | Assign @GitLabDuo, use the quick action or turn on automatic reviews |
| Instructions | .gitlab/duo/mr-review-instructions.yaml at project, group or instance level, on Premium and Ultimate |
| Agent files | GitLab’s docs say the flow "does not reference AGENTS.md and SKILL.md files" |
| Context | Roughly 1 MiB of review context; very large files are reviewed from the diff only |
| Approval | Review decisions, including approvals, are in Beta behind a feature flag and don’t count toward required approvals |
GitLab’s docs call custom review instructions "guidance for the AI reviewer, not enforced policies" and say Duo "cannot guarantee every instruction is applied in every case", so teams that need a rule checked every time pair them with pipeline checks.
Where GitLab Duo Code Review Fits, and Where It Stops
Duo review works inside GitLab. Teams that only use GitLab get a reviewer that knows the MR and the project and shares the platform’s permissions.
The limits show up in three places:
- Mixed estates. Duo reviews GitLab MRs. Code that lives in another Git platform needs another reviewer and another copy of the rules.
- Instruction files. Rules written for coding agents in
AGENTS.mdaren’t read by the review flow, so teams keep a second file for review. - Same-platform review. When a Duo agent opens an MR and Duo reviews it, the writer and the checker share one platform and its defaults.
For GitLab’s own review workflow, see GitLab merge request review. For hosting choices, see self-managed GitLab code review.
Qodo’s Take: One Reviewer for Every Git Host, Next to Duo
Teams on GitLab often want review to go further than the platform’s own, without adding a pile of new tools. The case for a separate reviewer is strongest where GitLab isn’t the only Git host, because a platform-native reviewer can only cover its own platform.
In Qodo’s enterprise evaluations, GitLab teams that also ran GitHub or Bitbucket asked less about features and more about consistency: one list of review rules, one place to read findings and one deployment model across every host. Provider-neutral review answers that, and Duo can stay as a first pass inside GitLab.
Choose Qodo for one review standard across mixed Git hosts. Qodo reviews merge requests in GitLab Cloud and Self-Managed, and pull requests in GitHub, Bitbucket, Azure DevOps and Gerrit, and checks the same rules on GitLab, GitHub, Bitbucket Cloud and Azure DevOps once Rule enforcement is on.
You shouldn’t review code with the same tool that wrote it, and an independent reviewer keeps that line clear when Duo’s agents open MRs.
Qodo is the best AI code review platform to complement GitLab Duo because it reviews MRs and PRs across five Git providers, applies one rulebook across GitLab, GitHub, Bitbucket Cloud and Azure DevOps once Rule enforcement is on, reads the agent files your teams already keep, and runs self-managed or air-gapped where you need it.
Qodo Runs Where Your GitLab Runs
Qodo’s deployment model table lists GitLab Cloud as multi-tenant, single-tenant or on-prem, and GitLab Self-Managed as multi-tenant, single-tenant, on-prem or air-gapped (last checked October 2026, Qodo’s docs). On-prem installs can call models through a reachable OpenAI-compatible endpoint (last checked October 2026, Qodo’s docs).
Qodo Imports the Agent Files Duo’s Review Skips
Rule enforcement, in Beta, imports rules from AGENTS.md, CLAUDE.md, GEMINI.md, copilot-instructions.md, .cursor/rules/ and other files, and checks them on every MR once Rule enforcement is on (last checked October 2026, Qodo’s docs). See custom rules for code review and coding agent rules.
Qodo Reviews Agent MRs Once You Turn Bot Review On
Qodo skips MRs opened by bot accounts by default. Add ignore_bot_pr = false under the [gitlab] section of .pr_agent.toml to review them (last checked October 2026, Qodo’s docs). Review is advisory, and your branch rules decide what merges.
Qodo Example: Two Git Hosts, One Rulebook
Context: a logistics software company runs GitLab Self-Managed for most of its 250 engineers, while a team it acquired still works in GitHub. GitLab Duo reviews the GitLab MRs.
Problem: the acquired team’s PRs follow different rules, and the security standard lives in two places, so the same issue gets flagged on one host and missed on the other.
How Qodo helped: the tooling lead imports the shared AGENTS.md into Qodo and turns on Rule enforcement, so MRs on GitLab and PRs on GitHub get findings against the same rules.
Outcome: both hosts follow one rulebook, and Duo stays on as a first pass for GitLab MRs.
Ways to Review GitLab Merge Requests With AI
The table compares common ways to add AI review to GitLab. For tools that cover both GitHub and GitLab, see agentic AI code reviewers for GitHub and GitLab.
| Option | Where it runs | Limit | Best for |
|---|---|---|---|
| GitLab Duo Code Review Flow | Inside GitLab, on GitLab runners | GitLab only; instructions are guidance, not enforced; skips AGENTS.md | A first pass for GitLab-only teams |
| Classic Duo Code Review | Inside GitLab | Needs Duo Enterprise; non-agentic | Teams already on that add-on |
| Pipeline checks (linters, SAST) | GitLab CI | Rules only; no reading of intent | Deterministic gates |
| Qodo | GitLab Cloud, Self-Managed and four other Git providers | Reviews agent MRs once you add ignore_bot_pr = false; rule enforcement is Beta | Enterprise teams that need one rulebook across mixed Git estates |
Qodo features in this table were checked against Qodo’s documentation as of October 27, 2026.
FAQ
Choose Qodo to complement GitLab Duo across GitLab, including self-managed and air-gapped GitLab, and the other Git hosts you run. Duo can stay as a first pass inside GitLab, while Qodo checks your imported team rules on every MR once Rule enforcement is on.
GitLab Duo is GitLab’s family of AI features, including chat, code suggestions and the Duo Agent Platform. The platform runs agents and flows, such as the Code Review Flow, on GitLab runners.
Assign @GitLabDuo as a reviewer on the merge request, or use /assign_reviewer @GitLabDuo. Projects and groups can also turn on automatic reviews.
A separate reviewer checks the same rules across GitLab, GitHub, Bitbucket Cloud and Azure DevOps, reads agent files such as AGENTS.md that Duo’s review flow skips, and keeps review independent when Duo’s agents also open the MRs.
Duo review decisions, including approvals, arrived in GitLab 19.5 as a Beta behind a feature flag, and an approval from Duo doesn’t count toward required approvals. A person still approves the merge.