GitLab Transcend: Goal-Driven Flows, Orbit and Artifact Central Target Agentic Software Delivery

Orchestration: agents that run a change end to end

GitLab says that today each step in an agentic workflow still waits for a person to approve it before the next one starts. Goal-driven flows (/goal) are meant to change that. They take a stated objective and run it through review, tests, security scans and approvals, from the Duo CLI, headless mode or Agentic Chat. The feature is due to reach general availability this month.

Custom Flows, already generally available, let teams chain agents to match the process they already follow. GitLab for Slack, also due this month, starts a flow from the channel where a conversation is happening. The MCP Server, again due this month, lets external AI applications and coding agents access a GitLab instance under the same policy GitLab's own agents follow.

GitLab also offers hosted open-weight models, named in the announcement as GLM 5.3, Kimi 3 and MiniMax 3, for workloads that do not need a frontier model. The company claims that at similar task-completion rates, some open-weight pairings deliver up to 8x more model calls per GitLab Credit than their frontier counterparts.

Context, cost and usage controls

GitLab argues that every agent task starts by re-deriving the same context, which drives up retries and token use. Its answer is GitLab Orbit, a context graph of the entire software lifecycle. The company says Orbit delivers up to 45x fewer retries and up to 4.5x fewer tokens used. During its beta, Orbit was used by more than 3,500 organizations running over 280,000 queries. General availability is planned for next month.

For spend visibility, Duo Agent Platform Impact Analytics, in early access, shows the cost and impact of AI investment by team, task and model. Credit and usage controls, generally available, let administrators set caps at the subscription, group or user level. Alerts fire at 50%, 80% and 100% of spend, and usage pauses automatically once the cap is reached.

Artifacts, dependencies and secrets

GitLab notes that much of what ships is assembled from open source packages, base images and libraries rather than written by the team. GitLab Artifact Central, now in beta, replaces a separate registry per team with a single place to publish and pull, built next to source code and CI pipelines. It supports Maven, npm, Docker and OCI packages directly from CI, with PyPI and NuGet coming at general availability. It reuses source-code identity and permissions, and offers virtual repos, native CI/CD authentication and full build provenance. According to GitLab, early results show roughly 50% lower total cost of ownership compared to alternative tooling.

GitLab Dependency Firewall, in early access, sets rules on package age, vulnerability severity, malicious package detection and license compliance. Actions are block, quarantine or warn, enforced on existing registries. It works with Artifact Central and is compatible with JFrog Artifactory and Sonatype Nexus Repository.

GitLab Secrets Manager, due this month, scopes each build-time secret to the job that needs it and allows one-click revocation of a leaked credential. GitLab claims up to 50% savings compared to hosting a separate vault.

Security standard and Claude Mythos

The GitLab Security Standard, available today, sets out five stages for hardening agentic development: authorizing every actor's access, isolating workspaces and their inputs, verifying the checks that judge the work, releasing exactly what was verified, and responding fast when something looks wrong. All of it rests on policy, audit and ownership.

Next month, Anthropic's Claude Mythos 5 and 5.1 are expected to power new security flows on GitLab Duo Agent Platform, aimed at helping organizations with approved environments find and fix vulnerabilities.

Buying and getting started

GitLab Flex is a single annual commitment that covers new capabilities as they ship, with seat and GitLab Credits spend adjustable monthly. Existing customers can use Duo Agent Platform with credits already in their subscription, and new trials include 30-day access. Orbit beta can be turned on for GitLab.com. GitLab Ultimate has a free trial, and a Secrets Manager trial is open to Ultimate and Premium customers.

For teams moving from GitHub, GitLab lists migration tools, custom migration services and an offer of one year free when signing a three-year contract. It is also running a three-week hackathon with Anthropic and Google Cloud.