# AI code review for GitLab merge requests MergeHarbor reviews every merge request with the context of your whole codebase and posts verified findings as discussions on the diff, with a commit status you can require before merging. It works on GitLab.com and on GitLab Self-Managed. [Start free trial](https://app.mergeharbor.com/signup) [GitLab setup guide](https://mergeharbor.com/docs/gitlab) 14 days of the Team plan, no card needed. .mergeharbor.yml ``` # Review every push to a merge request review: trigger: pushes strictness: medium min_severity: minor ignore_paths: ["vendor/**", "**/*.pb.go"] merge_gate: enabled: true mode: advisory # report first, enforce later ``` ## What MergeHarbor does on GitLab and GitLab Self-Managed Discussions on the diff Findings are posted as merge request discussions positioned on the changed lines, each with severity, confidence and a suggested fix where one applies. A summary note describes the change, and comments GitLab cannot position on the diff are listed there instead of being lost. A commit status, and a merge gate Each review reports a commit status. The merge gate adds a second status, MergeHarbor / merge gate, with one verdict and a checklist. On GitLab Ultimate you can add it as an external status check. Your whole codebase as context Each project is indexed into a code graph, a text index and a semantic index, so the reviewer can follow callers of a changed function and read related code, not only the diff. Reviews start before indexing finishes. Every finding verified first A second pass tries to disprove each finding, citing the code it checked. Findings it disproves are never posted, and duplicates are merged into one comment. Commands in the merge request Comment @mergeharbor review to review again, @mergeharbor review deep for a deeper pass, or @mergeharbor remember to teach a rule. A comment that starts with mergeharbor review, without the @, works too. Learns from your team Award emoji on MergeHarbor's comments, replies in its threads and points your own reviewers keep raising feed learning. Proposed rules wait for an admin to approve them. ## Set up GitLab in a few minutes 1. ### Connect GitLab Choose GitLab, or GitLab Self-Managed and enter your instance URL, and authorize with OAuth. Or paste a group or project access token with the Developer role and the api scope. 2. ### Choose projects Pick the projects to review. MergeHarbor registers a webhook on each one for merge request, comment and push events, and starts indexing in the background. 3. ### Open a merge request The next merge request gets a review. Tune strictness, categories and paths in the console or in .mergeharbor.yml, and make the commit status required when you trust it. [Read the full gitLab setup guide](https://mergeharbor.com/docs/gitlab) ## What MergeHarbor needs from GitLab

Connection	OAuth, or a group or project access token
Scope	api (GitLab has no narrower scope that allows posting merge request comments or commit statuses)
Token role	Developer or higher; an administrator's token is not needed
Webhook events	Merge request, comments and push, registered for you
Self-managed OAuth	Your administrator registers an OAuth application (scope api) or enters an existing one's ID and secret
Private networks	Instances not reachable from the internet need a self-hosted MergeHarbor deployment

Documentation: [GitLab and GitLab Self-Managed](https://mergeharbor.com/docs/gitlab) [Code host permissions](https://mergeharbor.com/docs/permissions) [Merge gate](https://mergeharbor.com/docs/merge-gate) [CI and builds](https://mergeharbor.com/docs/ci#gitlab-ci) [Configure reviews](https://mergeharbor.com/docs/configuration) ## Other code hosts - [Bitbucket Cloud and Bitbucket Data Center](https://mergeharbor.com/ai-code-review/bitbucket) - [Azure DevOps Services and Server](https://mergeharbor.com/ai-code-review/azure-devops) - [GitHub and GitHub Enterprise Server](https://mergeharbor.com/ai-code-review/github) - [Gitea and Forgejo](https://mergeharbor.com/ai-code-review/gitea) - [Perforce Helix Core and Helix Swarm](https://mergeharbor.com/ai-code-review/perforce) - [All integrations](https://mergeharbor.com/integrations) Running your code host on a private network? See [self-hosted AI code review](https://mergeharbor.com/ai-code-review/self-hosted). ## Further reading [Guide · 9 min read How to set up AI code review on GitLab merge requests Connect GitLab.com or GitLab Self-Managed, choose projects, and get AI review comments, a commit status and a merge gate on every merge request. Read the guide](https://mergeharbor.com/guides/gitlab-merge-request-setup) [Guide · 8 min read Merge gates: safe-to-merge checks for pull requests What a merge gate is, how it turns findings, tests, risk and approvals into one safe-to-merge verdict, and how to roll one out on each code host. Read the guide](https://mergeharbor.com/guides/merge-gates) ## Frequently asked questions Does MergeHarbor work with GitLab Self-Managed? Yes. Choose GitLab Self-Managed in the console and enter your instance URL, then connect with an OAuth application your administrator registers or with an access token. An instance that is not reachable from the internet needs a self-hosted MergeHarbor deployment inside your network. Why does MergeHarbor need the api scope? GitLab has no narrower scope that allows posting merge request discussions or commit statuses: read\_api is read-only and write\_repository only covers Git pushes. Use an access token with the Developer role so the token can still do only what that role allows. Can the review block a merge? Yes. The merge gate posts a commit status named MergeHarbor / merge gate. It starts in advisory mode, which reports without failing; switch it to enforce when the team trusts it. On GitLab Ultimate you can also add an external status check whose name contains MergeHarbor, and MergeHarbor answers it as passed or failed for each commit. Does it read GitLab CI results? Yes, if you turn on GitLab CI under Integrations. It uses your existing GitLab connection. When a job fails on the merge request's head commit, MergeHarbor reads the end of its log and points the review at the changed lines it names, without an extra model call. What happens if we disconnect GitLab? Reviews stop at once and MergeHarbor removes its webhooks from GitLab. The projects' reviews, index and settings are kept for 7 days and then permanently deleted; reconnecting within those 7 days brings them back with their history. Revoking the token on GitLab alone stops reviews but deletes nothing, so remove the connection in the console as well. How do we try it? Sign up and connect a code host. Every new organization gets the Team plan free for 14 days with no card, including the Deep review tier and the merge gate. If no one subscribes, reviews pause when the trial ends and nothing is deleted. Have another question? [Ask our support team](https://mergeharbor.com/contact?topic=support) ## Review your next GitLab merge request with MergeHarbor Connect GitLab in a few minutes. Reviews start on the next merge request, and codebase context is added as indexing completes. [Start free trial](https://app.mergeharbor.com/signup) [Book a demo](https://mergeharbor.com/contact?topic=sales&source=demo)