GL Duo AutoHealer: Autonomous Post-Code DevSecOps with MCP

An ambient, hands-off DevSecOps agent for GitLab Duo that autonomously detects pipeline failures, triages vulnerabilities, synthesizes atomic remediations, and cuts runner carbon emissions by >99%.

Comment

Inspiration

What it does

How we built it## Inspiration

Over 70% of developer cycle time is consumed after code is written: inspecting verbose CI logs, diagnosing brittle unit tests, triaging vulnerability scanners, and coordinating hotfix deployments. Traditional AI tools act merely as passive chat widgets. We built GitLab Duo AutoHealer to make post-code DevSecOps truly autonomous—a hands-off ambient agent that closes the loop between failure and production.

What It Does

GitLab Duo AutoHealer executes autonomously inside GitLab CI/CD across 5 core DevSecOps stages:

  1. Verify: Ingests failing pipeline logs and isolates assertion mismatches without human triage.
  2. Secure: Performs SAST dependency vulnerability inspection to prevent vulnerable code from entering production.
  3. Package & Remediation: Uses the GitLab Duo Agent Platform with MCP tools to synthesize and validate an atomic patch.
  4. Release & Deploy: Deploys verified containers directly to Google Cloud Run (deploy/cloud-run.yaml).
  5. Monitor & Sustainability: Measures Software Carbon Intensity (SCI) per ISO/IEC 21031, avoiding over 99% of debugging emissions compared to human developer workstations.

How We Built It

  • GitLab Duo Agent Platform: Configured using the official Flow Registry Framework v1 in .gitlab/duo/flows/post-code-healer.yml operating in environment: ambient.
  • System Instructions (AGENTS.md): Root-level agent rules and guardrails ensuring deterministic, non-breaking remediation.
  • Model Context Protocol (MCP): Created an MCP tool provider (agent/mcp-server.js) exposing diagnostic, patch synthesis, and carbon computation tools to the Duo Agent.
  • GitLab CI/CD: A unified 6-stage pipeline orchestrating verification, remediation, and Google Cloud delivery.
  • Sustainability Engine: An eco-calculator implementing the Green Software Foundation SCI formula.

Accomplishments We're Proud Of

  • A truly Hands-off (Level 3) agent flow that requires zero human intervention.
  • Coverage across 5 DevSecOps stages in a single coherent loop.
  • Built-in green software carbon intensity measurement showing 99.8% carbon avoidance.
  • Ready-to-deploy Google Cloud Run infrastructure.

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for GL Duo AutoHealer: Autonomous Post-Code DevSecOps with MCP

Built With

  • gitlab-ci
  • gitlab-duo
  • google-cloud-run
  • model-context-protocol
  • node.js
Share this project:

Updates

Submission history