GitLab

Connect GitLab.com or self-managed GitLab so agents can read projects, merge requests, and pipelines, and Review can comment

Connect GitLab and CloudThinker agents can read your projects, merge requests, issues, and CI/CD pipelines, and Review can post AI code reviews on merge requests. You sign in with OAuth on GitLab.com, or paste a project or group access token for GitLab.com or a self-managed instance.

Prerequisites

• Access to the GitLab projects you want agents to read.
• For the token method: the Maintainer or Owner role on the project or group, so you can create access tokens.
• For Review: the Maintainer role on the project or group, because GitLab only lets Maintainers add webhooks. The token itself can stay at Developer.
• The Admin role in your CloudThinker workspace, which can add and edit connections. See Roles.

Choose a method

Method	Use it when	Comments appear as	GitLab tier
OAuth	You’re on GitLab.com and want the fastest setup	The GitLab user who signed in	Any tier on GitLab.com
Access Token	You run self-managed GitLab, or you want access limited to one project or group	A bot user tied to the token	GitLab.com: Premium or Ultimate. Self-managed: any tier

OAuth is available only on GitLab.com. Self-managed instances use an access token.

Setup

Open the connection first. In the sidebar, click More → Workspace settings → Connections. On the Builtin Connections tab, search for GitLab and click Connect. The Connect GitLab dialog opens with two tabs.

OAuth

1. Start the sign-in

   On the OAuth tab, click Connect to GitLab. GitLab opens and lists what CloudThinker asks for: read and write repository access, API access for webhooks and merge requests, and your profile (email, username).

2. Authorize CloudThinker

   Sign in as a GitLab user who can see the projects you want, then click Authorize. Review posts its comments as this user, so consider a dedicated GitLab account.

   Success state: you land back in CloudThinker with GitLab Connected! and GitLab shows Connected on the Builtin Connections tab.

Access Token

1. Create the token in GitLab

   In GitLab, open the project or group and go to Settings → Access Tokens. Click Add new token and set:

   • Role: Developer or higher
   • Scopes: api
   • Expiration date: a date that matches your rotation policy. GitLab caps tokens at 365 days by default, and a self-managed admin can set a shorter limit

   Click Create and copy the token. It starts with glpat-.

2. Enter the connection details

   In the Connect GitLab dialog, open the Access Token tab and fill in the fields from Connection details.

3. Validate and connect

   Click Validate Token. CloudThinker shows Token works and the number of projects the token can see. Click Connect.

   Success state: CloudThinker shows Connected to GitLab and GitLab shows Connected on the Builtin Connections tab.

Unlike GitHub and Bitbucket, CloudThinker doesn’t register GitLab webhooks for you. Before Review can comment, a Maintainer adds a webhook in the project or group by following Configure webhooks. Agent questions work without it.

Connection details

These fields appear only on the Access Token tab. OAuth has no fields: GitLab issues the credentials and CloudThinker stores them.

Field	Description	Example
GitLab URL	Your instance URL with no trailing slash. If GitLab runs under a relative path, include it	https://gitlab.com, https://gitlab.example.com, or https://example.com/gitlab
Token Type	Project Access Token reaches one project. Group Access Token reaches every project in the group	Group Access Token
Access Token	The token you created in GitLab	glpat-<your-token>

Required permissions

Method	What decides access
OAuth	Everything the signed-in GitLab user can see
Project or group access token	The api scope plus the token’s role, limited to that project or group

A token needs the Developer role or higher. Guest and Reporter tokens can read but can’t post comments on merge requests, so Review can’t post its findings.

Use a group access token for the group that owns your services. Access stays inside that group, comments come from a bot user instead of a teammate, and revoking it affects nothing else.

Control access in CloudThinker

Two settings on the connection’s detail panel narrow what agents do. Open More → Workspace settings → Connections, select GitLab, and look under Settings.

Setting	Options	What it does
Repository access	All or Selected	All lets agents read every project the credential reaches, including new ones. Selected limits agents to the projects you pick, and new projects stay excluded until you add them.
Allow writes	On (default) or off	On: agents can propose changes, and your Rules and Approval mode decide each one. Off: agents can only read, and every change is refused.

These settings only narrow what GitLab already grants. Choosing which projects Review runs on is a separate step in Review setup.

Agent capabilities

Reads run without asking. Writes need Allow writes on and pass through your Rules and Approval mode first.

Capability	What agents can do
Projects	List the projects the connection reaches and read their code and history
Merge requests	Summarize open merge requests, their approvals, and discussion
Pipelines	Find failing pipelines and read job logs to explain the failure
Issues	Read issues for triage and delivery context
Changes	Create branches, comment, or open merge requests, through your Rules and Approval mode

Verify the connection

List the GitLab projects you can reach and how many open merge requests each one has

A working connection names your real projects and counts. If projects are missing, compare the token type with where those projects live.

Example prompts

Which open merge requests in the platform group have had no review for more than 3 days?
Why did the latest pipeline on main fail in the api project?
Summarize the merge requests merged into main across our GitLab projects this week

Troubleshooting

Validate Token fails

The token is expired or revoked, lacks the api scope, or the GitLab URL is wrong. Check that the URL has no trailing slash and includes any relative path, create a new token with the api scope and the Developer role, and validate again.

GitLab at your host did not respond in time

CloudThinker couldn’t reach your self-managed instance. Confirm the URL opens from outside your network, or allowlist CloudThinker’s egress IPs in your firewall. These docs don’t publish CloudThinker’s egress IP list: ask your CloudThinker contact, or contact us. See Reaching private services for other options, then try again.

An agent can't find a project

A project token reaches one project, and a group token reaches only that group and its subgroups. Use a group token for the owning group, or sign in with OAuth as a user who can see the project. Then check that Repository access includes it.

Connected, but Review doesn't comment on merge requests

The webhook is missing or incomplete, or the token’s role is below Developer. Add the webhook from Configure webhooks and check the token’s role.

Reconnect GitLab to renew its OAuth credentials.

GitLab no longer accepts the saved sign-in, for example after the user revoked CloudThinker’s access. Open the connection and click Connect to sign in again.

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• Prefer project or group tokens. They keep access inside the projects you choose and post as a bot user, so no one’s personal account speaks for CloudThinker.
• Set an expiration date. Rotate the token before it lapses, or Review and agents lose access on that day. GitLab’s token isn’t a saved field in More → Workspace settings → Connections, so the pencil icon and Replace… there don’t apply. To swap in the new token, open Review → Settings, open the Connection actions menu (⋯) in the Connection section, and click Update token.

Related

Set Up Review

Choose projects and start AI code reviews on merge requests

Provider Authentication

Add the GitLab webhook and compare other Git providers