GitLab Duo Code Review Review (2026)

GitLab Duo Code Review Overview

GitLab Duo Code Review is AI merge request review built into GitLab itself rather than installed alongside it. That one structural fact is the entire argument, and it is why this page exists: most of this market writes GitHub-first, treats GitLab as a secondary integration, and omits the reviewer GitLab ships natively.

For a GitLab shop the economics are not the ones a GitHub-centric roundup assumes. There is no second vendor, no second data processor, no second SOC 2 review, no app install, and no new surface for your security team to sign off. Code Review Flow requires no add-on at all and bills through GitLab Credits, of which Premium includes $12 per user per month at $29 per user per month billed annually (verified 2026-10-19).

Three things make it genuinely competitive beyond convenience. GitLab Duo Self-Hosted has been generally available since GitLab 17.9 and serves Mistral, Llama, Claude and GPT families through vLLM, AWS Bedrock or Azure OpenAI, with a single-tenant AI Gateway option on Dedicated. GitLab holds ISO/IEC 42001:2023, certified 2025-09-04 - one of only 7 of the 26 vendors in our trust-centre check. And GitLab Credits pool across the organisation with spend caps settable by subscription, group or user, which is better cost control than most of this category offers.

One thing to say immediately, because it is the biggest hole here: there is no published benchmark of any kind for GitLab Duo Code Review. Not an independent one, and not a self-published one either. Details below.

Feature Deep Dive

Two review features, one job, confusing names. This is the first thing to understand. GitLab ships Code Review Flow, which requires no add-on, runs on the GitLab Duo Agent Platform, uses multi-step reasoning, can start a fresh review on every push, and bills through GitLab Credits. It also ships GitLab Duo Code Review, which requires the quote-only GitLab Duo Enterprise add-on and which GitLab’s own documentation describes as single-pass, unable to use earlier threads for a follow-up review, and scoped to the merge request diff rather than broader repository context.

Counter-intuitively, the option that costs no add-on is the more capable one on paper. Which one runs is not a project setting: GitLab’s docs state that if the initiating user has a Duo Enterprise seat, GitLab Duo Code Review runs, and if not, Code Review Flow runs. Group Owners can override that and force Code Review Flow for everyone, which on current documentation is what most teams should probably do.

Version history, quoting GitLab’s docs as of 2026-10-19: comment interactions moved to the Duo Agent Platform in 19.1, Code Review Flow was introduced with a configuration option in 19.2, and it reached general availability in 19.3.

Automatic review triggers. Merge request created and not a draft, draft merge request marked as ready, and new commits pushed to the source branch when Start a new review on push is enabled, which is Code Review Flow only. Code review is offered on GitLab.com, GitLab Self-Managed and GitLab Dedicated. We looked specifically for a GitLab.com-only restriction on automatic review and could not confirm one, though GitLab notes the configuration procedure differs between GitLab.com and self-managed instances.

Self-hosted models. GitLab Duo Self-Hosted is, quoting the docs, generally available in GitLab 17.9 - introduced in 17.1, enabled on Self-Managed in 17.6. It requires the Duo Enterprise add-on, is offered on GitLab Self-Managed and GitLab Dedicated for Government, and documents Mistral (Codestral 22B, Mistral Medium 3.5 128B), Llama (3 8B and 70B, 3.1, 3.3), Claude (Sonnet 5.5, Haiku 5.5, Opus 4.8) and GPT (4 Turbo, 4o, 5), plus Nemotron, Kimi, GLM, Qwen, CodeGemma and DeepSeek Coder. Serving via vLLM, AWS Bedrock or Azure OpenAI.

One caveat we are obliged to flag. Code Review is not named in GitLab’s self-hosted supported-features list, which names code completion, code generation, non-agentic Duo Chat and the Duo Agent Platform. Since Code Review Flow runs on the Agent Platform it is plausibly covered, but GitLab does not say so explicitly, and we are not going to assert it on your behalf. Confirm before committing an air-gapped rollout. For the wider picture see self-hosted AI code review tools.

The other merge request features. Resolve a discussion with Duo, summarise a code review, generate a merge commit message, generate a description by summarising code changes. Several of these carry a Duo Enterprise add-on requirement; the merge commit message generator also works with GitLab Duo with Amazon Q, which is relevant if you already run Amazon Q Developer.

One policy detail worth knowing. GitLab allows a maximum required_approving_review_count of 100, against GitHub’s range of 0 to 6. If you are modelling AI review into an approval policy, GitLab gives you far more room, and the separation-of-duties question is correspondingly more flexible.

Pricing and Plans

Tier	Price	Included AI credits	AI code review
Free	$0, 5 users per top-level group	None	Requires a purchased Credits add-on
Premium	$29/user/month billed annually	$12/user/month	Code Review Flow, no add-on
Ultimate	Custom pricing, no published per-user figure	$24/user/month	Code Review Flow, no add-on
Duo Enterprise add-on	Quote only	Not published	Unlocks GitLab Duo Code Review and Self-Hosted models

All figures verified at GitLab’s pricing page on 2026-10-19.

Two notes a buyer should not miss.

Ultimate no longer publishes a per-user price. The pricing page asks you to get custom pricing. Any $99 per user per month figure in third-party listings is stale. That is a meaningful change for anyone building a budget off a comparison table.

GitLab does not publish a per-review credit price. We cannot give you a cost per review and will not invent one. What you can do is model real merge request volume against the included allowance during the trial - and pay attention to Start a new review on push, because a fresh review on every push changes the arithmetic substantially. See the AI code review price book for every vendor normalised and what AI code review costs for team-level totals.

The credit controls are a genuine strength. Credits pool across the organisation and spend caps are settable by subscription, group or user. Compare Greptile, whose credits are per author and do not pool, or Qodo, whose credit packs do not roll over.

How Good Is It, Honestly

There is no benchmark. At all. GitLab Duo Code Review appears in none of Martian Code Review Bench, GitHub ReviewBench, SWE-PRBench, CR-Bench, CRBugBench or c-CRAB, and GitLab has not published a self-benchmark either (checked 2026-10-19). That is unusual. In this category almost every vendor publishes a benchmark it wins: Greptile scored itself 82%, DeepSource 84.51% F1, Qodo 60.1%, Propel 64%, Macroscope 48.31%, CodeAnt runs a 300K-PR benchmark that recommends CodeAnt, and Entelligence publishes a benchmark in which Entelligence places first. GitLab has published nothing, which means we cannot discount a self-serving number but we also have nothing to work with.

What GitLab does tell you is where the weaker variant falls short, and credit where it is due, because very few vendors document their own limitations this plainly. For GitLab Duo Code Review: single-pass analysis rather than multi-step reasoning, no follow-up review using earlier threads, and scope limited to the merge request diff rather than broader repository context. Diff-only scope is the architectural property that most reliably separates thin review from useful review, so take that limitation seriously and prefer Code Review Flow where you can.

The standing caveat, which applies to every tool on this site: no party without a commercial stake has published a false-positive rate, precision figure or noise measurement for any shipping commercial AI code reviewer. SWE-PRBench and CR-Bench do publish false-positive data, but for bare models in fixed harnesses rather than products you can buy. See every AI code review benchmark compared for the provenance map and our Noise Index methodology for the measurement we are running to close the gap.

Where GitLab is ahead of the field is compliance. ISO/IEC 42001:2023, certified 2025-09-04, held by only 7 of 26 vendors we checked - the AI-specific standard covering model integrity, training-data security and AI pipeline risk, none of which SOC 2 or ISO 27001 was designed to assess. One honest caveat: GitLab’s own certifications page returned a 404 for us on 2026-10-19, so verify the live certificate at GitLab’s trust centre rather than trusting this table. See fake compliance certifications in dev tools for why that instruction is not boilerplate, and AI code review tools for regulated software teams for what auditors actually ask for.

A documentation-churn warning. Our own internal notes going into this review said self-hosted models reached GA in GitLab 18.4 and Code Review Flow in 18.8. GitLab’s live documentation says 17.9 and 19.3 respectively. We have published what the docs say and corrected ourselves. The broader lesson for a buyer: GitLab’s Duo documentation moves fast enough that any version number you read in a comparison article, including this one, should be re-checked at source before it goes in a rollout plan.

Who Should Use GitLab Duo Code Review

A strong fit if: you are already on GitLab Premium or Ultimate and the AI credits are sitting there unused; you run GitLab Self-Managed and want the model in your own network with vLLM, Bedrock or Azure OpenAI; your security team would rather not onboard a second data processor; you need ISO/IEC 42001:2023 in the vendor file; or you want organisation-wide pooled credits with per-group spend caps rather than per-author credits that do not pool.

Look elsewhere if: you want measured review quality, where CodeRabbit at 51.2% F1 on Martian Code Review Bench is the only GitLab-capable option with a score from someone who does not sell a reviewer; you need a free option, where Kodus is AGPLv3 and free to self-host at any size and PR-Agent is MIT, both covering GitLab Self-Managed; you want deep per-language linter coverage, which is CodeRabbit’s 50-plus tool map; or you are not on GitLab, in which case this product does not exist for you.

For the GitLab-specific landscape see GitLab code review tools, AI code review on GitLab, Bitbucket and Azure DevOps, and the CodeRabbit GitLab integration.

GitLab Duo vs Alternatives

	GitLab Duo	CodeRabbit	Kodus	GitHub Copilot
Native to the forge	Yes, GitLab	No	No	Yes, GitHub
Works on GitLab Self-Managed	Native	Yes	Yes	No
Extra cost on top of forge subscription	Credits only on Premium/Ultimate	$24/dev/mo annual	$0 self-hosted	Pro $10/mo upward
Self-hosted models	vLLM, Bedrock, Azure OpenAI	No	vLLM, Ollama, TGI, LiteLLM	No, service stays in GitHub cloud
Self-host the application	Native on Self-Managed	500+ seats only	Yes, AGPLv3	No
Can approve a pull request	Not documented	No	No	Yes, off by default
ISO/IEC 42001:2023	Yes, 2025-09-04	Not confirmed	No	Yes, cert 2026
Independent benchmark score	None	Martian, 51.2% F1	None	Martian 4th; ReviewBench rank is third-party reported
Published self-benchmark	None	None	None	None

All cells verified 2026-10-19 except the ISO/IEC 42001 and trust-centre entries, which come from our 26-vendor check of 2026-10-18. “Not confirmed” means we could not verify it at the vendor’s trust centre on that date, not that it is absent.

The cleanest way to read that table is as a mirror. GitLab Duo is to GitLab what Copilot code review is to GitHub, with two differences that favour GitLab: Duo can run on models inside your own network, while Copilot’s review service stays in GitHub’s cloud regardless of where your Actions runners live; and Copilot can submit an approving review that satisfies a required-approval rule, off by default, which weakens a single-approval separation-of-duties control rather than strengthening it. GitLab does not document an equivalent for Duo.

Against CodeRabbit, the trade is procurement simplicity and data path against measured quality and configurability. CodeRabbit is the only tool in this comparison with a score from a benchmark published by a party that does not sell a reviewer, it publishes a full language-to-linter map, and it reads competitors’ rule files by default including **/REVIEW.md, **/CLAUDE.md and **/AGENTS.md. It also costs $24 per developer per month annual on top of your GitLab bill and caps Essentials at one linked repository.

Against Kodus, the question is whether you want the native reviewer or the auditable one. Kodus is AGPLv3, free at any team size, and covers GitLab Self-Managed; Duo is inside the forge and holds ISO/IEC 42001:2023. A GitLab Self-Managed shop with a hard data-residency rule can reasonably run either, and could sensibly trial both since Kodus costs nothing to try.

Pros and Cons Deep Dive

Native is a real advantage and it is underrated. No second vendor, no second data processor, no second security questionnaire, no app install, no extra invoice. For a GitLab org that is weeks of procurement time, and procurement time is the actual bottleneck on most tool rollouts rather than feature fit.

The compliance position is ahead of the field. ISO/IEC 42001:2023 at 7 of 26 vendors is a short list, and it is the standard that actually addresses AI-specific risk. Re-verify at GitLab’s trust centre, since their certifications page 404ed for us.

Self-hosted models are a first-party path, not a workaround. GA since 17.9, with vLLM, Bedrock and Azure OpenAI documented and a single-tenant AI Gateway on Dedicated. Compare SonarQube’s AI CodeFix, which is the other strong air-gap-plus-bring-your-own-model story in this market, and note that Semgrep’s Network Broker and Snyk’s Broker are tunnels to the vendor’s cloud rather than on-premise deployments.

The credit controls are better than most. Pooled organisation-wide, spend caps per subscription, group or user. That is a straightforwardly better design than per-author credits that do not pool.

The two-feature split is the worst thing about it. Code Review Flow and GitLab Duo Code Review overlap, the selection depends on the initiating user’s seat type rather than a project setting, and the add-on-free option is the more capable one. Group Owners can force Code Review Flow for everyone, and on current documentation most teams should.

There is no evidence of quality, from anyone. No independent benchmark, no self-benchmark. That is a cleaner position than publishing a benchmark you win, but it leaves you with nothing to evaluate except a trial on your own merge requests. Run one. See how to evaluate an AI code reviewer for a protocol that does not take a vendor’s word for anything.

The documentation moves faster than the comparison articles. Our own notes were wrong on two version numbers before we checked at source. Re-verify anything version-specific.

For the shortlist in context see the best AI code review tools, the best AI PR review tools, and AI code review for enterprise. If you are new to the category, start with what is AI code review.