GitLab

Forge scans GitLab projects for AI application code and configuration, then projects each supported signal into Inventory with repository, revision, file, and confidence evidence.

Coverage

Capability	Implementation
Repository scope	GitLab group or user, with an optional project allowlist
Hosting	GitLab.com and HTTPS self-managed GitLab API endpoints
Authentication	Group, project, or service-account access token
Revision	Default branch and resolved commit
Output	Inventory items, source references, confidence, and posture findings

Detection

Asset class	Examples
AI applications	Provider SDKs, agent frameworks, orchestration code, and AI endpoints
Tooling	MCP servers, function tools, code execution, and database capabilities
Infrastructure	Containers, Terraform, deployment manifests, and model artifacts
Configuration	Gateway configuration, provider references, and environment key names
Data dependencies	Vector stores, connectors, and referenced cloud data services

Signals that are ambiguous in isolation require corroborating repository context. Every accepted observation retains the source path, line, content fingerprint, evidence quality, and confidence.

Scan contract

Limit	Behavior
Projects per run	Up to 25
Candidate files	Up to 300 per project
File size	Files larger than 256 KiB are skipped
Exclusions	Generated output, vendored dependencies, caches, lockfiles, and `.git`
Repository selection	When no allowlist is supplied, Forge lists projects visible to the token

Connection

Field	Description
Owner	GitLab group or user used to enumerate projects
Base URL	GitLab API v4 endpoint; Forge appends `/api/v4` when required
Authentication	`gitlab_group_access_token`, `gitlab_project_access_token`, or `gitlab_service_account_token`
Repositories	Optional project allowlist

Setup

Open Settings → Integrations → GitLab and save the namespace, API v4 base URL, authentication mode, and token.
Leave the project list empty to enumerate projects visible to the token, or provide an explicit project allowlist.
Run a sync. Forge records success, observationCount, canonicalInventoryCount, and blockers for each project.

Changing the base URL after a credential has been saved requires token rotation. Production endpoints must use HTTPS and cannot contain credentials, query strings, fragments, or path traversal.

Boundaries

GitLab scanning is static evidence. It does not establish live usage, user identity at runtime, prompt or response content, tool execution, or enforcement. Join it with endpoint, gateway, or cloud telemetry for runtime attribution.

Get started

Observe

Secure

Enable

Integrations

Resources

Coverage

Detection

Scan contract

Connection

Setup

Boundaries

​Coverage

​Detection

​Scan contract

​Connection

​Setup

​Boundaries

Coverage

Detection

Scan contract

Connection

Setup

Boundaries