Duo-Guardian: Production Intelligence in Every MR

Duo-Guardian: Stop guessing, start merging. Specialized AI agents that audit cost, security, and testing using real-time GCP signals. Native production intelligence for GitLab Duo

Comment

Duo Guardian: Your AI-Powered Production Auditor

The native GitLab agent that stops cloud cost-bugs and infrastructure risks before they ever reach production.

Inspiration: The "MR Anxiety"

Every developer knows the feeling. Your code compiles. Your unit tests pass. You hit "Merge."

But then the anxiety hits: Will this commit cause a $10,000 billing spike? Will it break our GCP infrastructure?

Standard CI/CD tells us if our code works. It doesn’t tell us if our code is financially disastrous or operationally risky. This gap between code logic and cloud reality is the "MR Blind Spot."

We built Duo Guardian to fix this.

What it is

Duo Guardian is a "Shift-Left" Mission Control. It is a squad of intelligent, autonomous AI agents operating entirely within the GitLab Duo Agent Platform. It transforms a standard code review into a multi-dimensional production audit.

Here is the team working behind the scenes on your Merge Request:

  • The FinOps Agent: Analyzes the code diff for "Cost-Bugs." It catches wild retry loops, heavy payload transfers, and unoptimized API calls before they appear on your GCP bill.
  • The DevOps Agent: Correlates your code diff with real-time Google Cloud (GCP) signals. It flags reliability risks and ensures your infrastructure can actually handle the change.
  • The Test Engineer: Auto-generates missing test suites based on the detected logic changes, executes them, and analyzes the results to guarantee functional safety.
  • The Analyzer Agent: Synthesizes these insights into a definitive "Go/No-Go" status, injecting actionable feedback directly into your MR description.

How it works: A Pipeline Designed for Reality

We built Duo Guardian to be 100% native to GitLab, powered by GitLab Duo and gemin 2.5 flash (via the GitLab AI Gateway). But the real magic is in our orchestrated pipeline.

We used LangGraph to build a reliable, stateful multi-agent system that avoids the hallucinations common in simple chatbots. Here is how our pipeline handles a PR:

  1. Context Extraction: The Analyzer Agent pulls the precise Code Diff.
  2. Parallel Auditing: The DevOps Agent evaluates the CI/CD pipeline and hits GCP APIs to check infrastructure limits, while the FinOps Agent calculates resource impact.
  3. Validation: Concurrently, the Test Engineer writes and executes pytest suites against the new logic, passing the test results back into the context.
  4. Action: LangGraph fuses this context cleanly, ensuring every MR comment is backed by real-world data and executed tests.

The Ultimate "Shift-Left": The MCP Server

We didn't just stop at the Merge Request. We built an MCP (Model Context Protocol) Server, allowing developers to run Duo Guardian locally in IDEs like Cursor or VS Code before they even commit. This brings true production intelligence directly to the developer's keyboard. This is a level of integration unique to our submission.

Accomplishments & Impact

We successfully proved that AI can "Shift-Left" financial operations. In our tests, catching a single infinite polling loop at the MR level proved that Duo Guardian can save thousands of dollars per PR. Delivering this via a fully working MCP Server alongside native GitLab functionality offers a development experience that is unmatched in current tools.

Together, these tools make for a brilliant, powerful developer tool based on GitLab, built for GitLab, built by GitLab Duo.

Challenges we ran into

Moving from a simple prompt-bot to a stateful LangGraph orchestrator was our biggest hurdle. Managing the context window when feeding a massive code diff alongside live GCP infrastructure logs required significant prompt-tuning and data truncation strategies to guarantee the LLM maintained sharp focus on the task at hand.

What we learned

We learned that context is everything. An LLM analyzing a Python script in isolation is mildly useful; an LLM analyzing a Python script while holding the GCP infrastructure context and your local IDE state is a superpower. We discovered the immense value of uniting development tools under a single, cohesive workflow.

What's next for Duo Guardian

  • Auto-Remediation: Evolving the FinOps Agent to not merely flag cost-bugs, but to autonomously author and commit highly optimized code replacements.
  • Multi-Cloud Context Expanding: Bringing our unified "Sentinel" integration beyond GCP to ingest AWS and Azure telemetry for a seamless multi-cloud auditing experience.

🛠️ Built With

  • GitLab Duo
  • gemin 2.5 flash (via GitLab AI Gateway)
  • LangGraph
  • Google Cloud Platform (GCP)
  • Model Context Protocol (MCP)

Built With

  • ci-cd
  • devops
  • finops
  • gcp
  • gemini
  • gitlab
  • gitlab-duo
  • gitlab-pipelines
  • gitlab-ui
  • langraph
  • nextjs
  • py-test
  • python
  • vertex-ai
Share this project:

Updates