Blast Radius Analyzer

• 

  architecture diagram

Inspiration

Every developer has pushed a change that broke something downstream — a function signature change that killed an import three projects away, a moved constant that crashed a service you forgot depended on it. CI caught it hours later. GitLab Orbit's knowledge graph makes it possible to answer the question every developer asks before landing a change: "What will this break?" I wanted to build the simplest possible interface to that answer — one mention, one report.

What it does

Blast Radius Analyzer is a GitLab Duo custom agent that helps developers understand the downstream impact of code changes before they make them. When a developer mentions @blast-radius with a file path in a GitLab issue or MR comment, the agent queries GitLab Orbit's knowledge graph to locate the file's definition, traverses all gl_reference edges to find every file/function/module that depends on it, recursively traces transitive dependencies, identifies cross-project impact, classifies risk as Low/Medium/High/Critical, and posts a structured risk report as an issue comment.

How we built it

Platform: GitLab Duo Agent Platform — custom agent hosting, invocation via issue/MR mentions, and tool enablement for posting comments.

Knowledge Graph: GitLab Orbit — the structured, queryable codebase representation. The agent uses get_graph_schema to discover node types and query_graph to traverse the dependency graph using Cypher-style queries.

Agent Skill: A reusable skill file (skills/blast-radius/SKILL.md) following the Agent Skills specification. Includes precise query patterns for direct dependencies, transitive traversal, cross-project impact, and risk classification rules.

Demo video: Terminal simulation showing the full flow — problem → @blast-radius invocation → Orbit graph queries → risk report.

Challenges we ran into

The AI agent features on GitLab are brand new (GA in 18.8), so documentation and API surface are still maturing. Agent creation is UI-only with no REST or GraphQL API, which meant we couldn't automate the full deployment pipeline the way we normally would. The Contributor Platform provisioning flow has a separate registration step beyond Devpost that isn't immediately obvious — you miss it and your project lands in the wrong namespace without AI features enabled. We also had to design the agent to fall back gracefully between Orbit Remote (requires Premium/Ultimate) and Orbit Local (CLI-based), since we didn't know which tier we'd have access to.

Accomplishments that we're proud of

The demo video was built entirely as a terminal simulation using Playwright — 5 scenes, auto-scrolling, color-coded roles and badges, rendered at 1280x720 and converted to H.264. No screen recording, no voiceover needed. The entire project from idea to working demo took under 24 hours. The agent skill file follows the Agent Skills specification with real Cypher-style Orbit queries — not placeholder pseudocode. Anyone can load the skill into their own Duo agent and get blast radius analysis.

What we learned

Orbit's knowledge graph is more capable than it looks from the outside. The gl_definition + gl_reference schema maps directly to the dependency traversal problem, and the query_graph interface supports recursive traversal with depth control and cycle detection. We also learned that the simplest interface wins in developer tools — @blast-radius with a file path is zero-config, zero-learning-curve. No UI to learn, no configuration file, no setup beyond enabling the agent. The interaction happens where developers already spend their time: inside GitLab issues and MRs.

What's next for Blast Radius Analyzer

Visual dependency graph rendering (Mermaid/Graphviz in the issue comment), CI gate integration that blocks merge if risk is Critical without review, IDE integration as a VS Code extension so developers see dependency impact as they type, historical hotspot analysis to identify files becoming dangerous hubs over time, and scheduled weekly audits of high-churn directories to surface risky patterns before they become incidents.

Built With

• gitlab
• gitlab-duo
• gitlab-orbit