IntegrationsGitLab and GitLab Self-Managed
AI code review for GitLab merge requests
MergeHarbor reviews every merge request with the context of your whole codebase and posts verified findings as discussions on the diff, with a commit status you can require before merging. It works on GitLab.com and on GitLab Self-Managed.
14 days of the Team plan, no card needed.
What MergeHarbor does on GitLab and GitLab Self-Managed
- Discussions on the diff
- Findings are posted as merge request discussions positioned on the changed lines, each with severity, confidence and a suggested fix where one applies. A summary note describes the change, and comments GitLab cannot position on the diff are listed there instead of being lost.
- A commit status, and a merge gate
- Each review reports a commit status. The merge gate adds a second status, MergeHarbor / merge gate, with one verdict and a checklist. On GitLab Ultimate you can add it as an external status check.
- Your whole codebase as context
- Each project is indexed into a code graph, a text index and a semantic index, so the reviewer can follow callers of a changed function and read related code, not only the diff. Reviews start before indexing finishes.
- Every finding verified first
- A second pass tries to disprove each finding, citing the code it checked. Findings it disproves are never posted, and duplicates are merged into one comment.
- Commands in the merge request
- Comment @mergeharbor review to review again, @mergeharbor review deep for a deeper pass, or @mergeharbor remember to teach a rule. A comment that starts with mergeharbor review, without the @, works too.
- Learns from your team
- Award emoji on MergeHarbor's comments, replies in its threads and points your own reviewers keep raising feed learning. Proposed rules wait for an admin to approve them.
Set up GitLab in a few minutes
Connect GitLab
Choose GitLab, or GitLab Self-Managed and enter your instance URL, and authorize with OAuth. Or paste a group or project access token with the Developer role and the api scope.
Choose projects
Pick the projects to review. MergeHarbor registers a webhook on each one for merge request, comment and push events, and starts indexing in the background.
Open a merge request
The next merge request gets a review. Tune strictness, categories and paths in the console or in .mergeharbor.yml, and make the commit status required when you trust it.
What MergeHarbor needs from GitLab
| Connection | OAuth, or a group or project access token |
|---|---|
| Scope | api (GitLab has no narrower scope that allows posting merge request comments or commit statuses) |
| Token role | Developer or higher; an administrator's token is not needed |
| Webhook events | Merge request, comments and push, registered for you |
| Self-managed OAuth | Your administrator registers an OAuth application (scope api) or enters an existing one's ID and secret |
| Private networks | Instances not reachable from the internet need a self-hosted MergeHarbor deployment |
Other code hosts
- Bitbucket Cloud and Bitbucket Data Center
- Azure DevOps Services and Server
- GitHub and GitHub Enterprise Server
- Gitea and Forgejo
- Perforce Helix Core and Helix Swarm
- All integrations
Running your code host on a private network? See self-hosted AI code review.
Further reading
Frequently asked questions
Does MergeHarbor work with GitLab Self-Managed?
Yes. Choose GitLab Self-Managed in the console and enter your instance URL, then connect with an OAuth application your administrator registers or with an access token. An instance that is not reachable from the internet needs a self-hosted MergeHarbor deployment inside your network.
Why does MergeHarbor need the api scope?
GitLab has no narrower scope that allows posting merge request discussions or commit statuses: read_api is read-only and write_repository only covers Git pushes. Use an access token with the Developer role so the token can still do only what that role allows.
Can the review block a merge?
Yes. The merge gate posts a commit status named MergeHarbor / merge gate. It starts in advisory mode, which reports without failing; switch it to enforce when the team trusts it. On GitLab Ultimate you can also add an external status check whose name contains MergeHarbor, and MergeHarbor answers it as passed or failed for each commit.
Does it read GitLab CI results?
Yes, if you turn on GitLab CI under Integrations. It uses your existing GitLab connection. When a job fails on the merge request's head commit, MergeHarbor reads the end of its log and points the review at the changed lines it names, without an extra model call.
What happens if we disconnect GitLab?
Reviews stop at once and MergeHarbor removes its webhooks from GitLab. The projects' reviews, index and settings are kept for 7 days and then permanently deleted; reconnecting within those 7 days brings them back with their history. Revoking the token on GitLab alone stops reviews but deletes nothing, so remove the connection in the console as well.
How do we try it?
Sign up and connect a code host. Every new organization gets the Team plan free for 14 days with no card, including the Deep review tier and the merge gate. If no one subscribes, reviews pause when the trial ends and nothing is deleted.
Have another question? Ask our support team
Review your next GitLab merge request with MergeHarbor
Connect GitLab in a few minutes. Reviews start on the next merge request, and codebase context is added as indexing completes.