Orbit Navigator

A GitLab Duo skill that traces any software event — a production deployment, a failed pipeline, or a vulnerable dependency — back to the merge request behind it, using GitLab Orbit's knowledge graph.

Comment

Inspiration

When something breaks in a GitLab project — a security finding, a failed pipeline, a production deploy — you end up correlating data across the Security tab, CI/CD, Environments, and Merge Requests by hand. GitLab's built-in agents (Security Analyst, CI Expert) each help within their own lane, but none of them connects the dots across domains. I wanted a single query that traces any event back to the merge request behind it — and can act on what it finds.

What it does

Orbit Navigator is a GitLab Duo skill that uses GitLab Orbit's knowledge graph to answer cross-domain questions in one query, and then takes action:

  • Which merge request shipped what's currently in production?
  • Why did the pipeline fail, and which job?
  • What breaks if I change this shared library (blast radius)?
  • Who resolved these vulnerabilities?
  • /guardian --remediate --apply — finds vulnerable dependencies and opens a draft merge request that bumps them to fixed versions.

How we built it

It's a single skill file (skills/orbit-navigator/SKILL.md) — no backend, no vector database. The skill holds verified Orbit query recipes (the exact graph traversals), a strict operating procedure (check the live schema first, never guess relationships), and a /guardian action that uses GitLab's native tools (Create Commit, Create Merge Request) to open a draft fix. It runs through the GitLab Duo CLI with the Orbit MCP connected, so the agent calls query_graph directly on the live knowledge graph.

Challenges we ran into

Honestly, a lot:

  • The query DSL has real gotchas. The TRIGGERED edge over-counts pipelines unless you filter source=merge_request_event. Vulnerability and Pipeline live in disconnected graph components — you simply can't trace "which pipeline detected this vulnerability."
  • Security findings are ephemeral in the beta. Finding nodes get purged, so the "which pipeline detected this" trace returns empty. I pivoted to durable Vulnerability nodes (accountability, risk surface) instead.
  • Custom agents don't get Orbit by default. It took real work to connect the Orbit MCP so the agent could call query_graph.
  • A silent skill-name bug. The skill was named with an underscore, which the spec rejects — the agent silently fell back to guessing instead of loading the recipes, which caused a lot of churn until I caught it.
  • An honest overstatement. The deployment query only returns MR-linked deployments, so it initially read as "the only deployment" when there were several. I tightened the recipe and the wording.

Accomplishments that we're proud of

  • /guardian --remediate --apply doesn't just report a problem — it opens a real draft merge request that fixes it. One graph query to a fix a human reviews.
  • Every query recipe is verified live against the actual graph, not just documented.
  • The agent is honest: when the graph can't answer (the beta gaps), it says so instead of making things up.

What we learned

  • The Orbit ontology's real shape differs from the docs in important ways — the live schema (glab orbit remote schema) is the only source of truth.
  • There's a meaningful difference between durable nodes (Vulnerability) and ephemeral ones (Finding) — queries have to target the durable ones to return data.
  • For custom agents, Orbit access comes through the MCP, not natively.

What's next for Orbit Navigator

  • Expand remediation beyond dependency bumps — patch actual code for SAST and secret-detection findings.
  • Richer blast-radius across more projects (the graph already supports it).
  • More /guardian actions — file issues, post review comments, link fixes to vulnerabilities.
  • Tighter time-to-resolve and remediation-velocity reporting.

Links (fill in before submitting)

Built With

  • agent
  • duo
  • gitlab
  • mcp
Share this project:

Updates