Introducing GitLab Orbit (opens in new tab)
GitLab Orbit is a public-beta, queryable graph that connects code with merge requests, pipelines, deployments, vulnerabilities, incidents, and ownership. GitLab argues that this unified context makes AI agents faster, more accurate, and capable of answering cross-system questions that traditional file search or RAG cannot. In testing, Orbit improved code-review accuracy while reducing agent runtime, token use, and hallucinations. ## The Problem with Code-Only Agents - Agents often struggle to understand the systems surrounding code: - Related files and dependencies - Tests and pipelines - Deployments and environments - Vulnerabilities and ownership - Work items and merge requests - In large or multi-repository codebases, agents can waste tokens exploring irrelevant paths, miss dependencies, or run out of context. - This can produce code that appears correct but is later reverted or requires substantial human correction. ## Results from Compare the Market - Compare the Market tested four context-retrieval approaches across 79 real merge requests. - An Orbit-grounded AI reviewer: - Placed accurate inline comments about 70% of the time. - Outperformed RAG, which achieved roughly 58%. - Produced slightly better summaries of key changes: 68% versus 66%. - RAG performed worse than the other tested approaches, including using no additional context. ## Faster and More Efficient Coding Agents - Claude Code and other agents can connect to Orbit through the Model Context Protocol (MCP). - Instead of crawling a repository to infer relationships, an agent can query the graph directly for: - Where code is located - What depends on it - Which tests and pipelines cover it - GitLab reports up to: - 11× faster execution - 4.5× lower token usage - 45× fewer hallucinations ## Cross-System Engineering Workflows Orbit enables agents on the GitLab Duo Agent Platform to investigate relationships beyond source code. - **Pipeline failure triage** - Agents can identify merge requests associated with a failing job. - They can find other projects and in-flight changes likely to encounter the same failure. - This can help teams resolve shared incidents centrally rather than repeating investigations. - **Vulnerability blast-radius analysis** - Queries can trace vulnerable components through services, pipelines, environments, and owning teams. - Security teams can produce assigned remediation plans shortly after a CVE is discovered. - **Engineering metrics** - Teams can query relationships between cycle time, pipeline failure rates, and deployment frequency without waiting for custom dashboards or SQL analysis. - **Migration planning** - Orbit identifies dependent services, jobs, environments, and owners. - This reduces the risk of discovering hidden dependencies late in a migration. ## Architecture and Access - Orbit ingests lifecycle data through change-data capture into ClickHouse. - It parses code in 12 languages, including Ruby, Java, Python, TypeScript, Rust, Go, C#, C++, and PHP. - GitLab reports indexing more than: - 40,000 projects - 500 million nodes - 2 billion edges - The graph can be queried through: - A Cypher-like query language - MCP - REST - The GitLab CLI - An event-driven engine keeps the graph current as changes occur. - Indexing runs separately from GitLab, so query traffic does not burden the GitLab instance. - Authorization follows existing GitLab permissions, limiting agents to data their users can access. - Queries pass through validation, planning, optimization, and security stages before reaching the database. ## Engineer-Facing Data Explorer - The Data Explorer provides direct access to the same graph without an AI agent. - Engineers can use it to: - Investigate incidents - Trace dependencies across services - Diagnose recurring CI failures - GitLab positions it as a way to answer open-ended system questions in seconds rather than reconstructing the answer manually across multiple tools. GitLab Orbit is best suited to organizations where code, CI/CD, security, and ownership data are spread across large repositories or many projects. Its main recommendation is to use one permission-aware graph as shared context for both AI agents and engineers, rather than relying on repository search or disconnected tool calls.