Skip to main content
You connect GitLab once at the MSP level, with the address of your GitLab and an access token.

​
1. Create an access token in GitLab

Neo works with any of GitLab’s three access tokens. Pick the narrowest one that covers what your agents need:
1

Open the token page

For a project access token, open the project, then Settings > Access tokens. For a group access token, the same in the group. For a personal access token, sign in as Neo’s user, click the avatar, then Edit profile > Access tokens.
2

Add the token

Click Add new token. Name it Neo, and set an expiry date: GitLab requires one, and Neo needs a new token when it passes.
3

Pick the role and scope

Select the api scope, or read_api for an agent that only reads. For a project or group token, pick the role: Developer can commit to branches that are not protected and open merge requests; Maintainer can also commit to a protected branch such as main and change settings. GitLab, not Neo, refuses what the role does not allow.
4

Copy the token

Click Create token and copy it. GitLab shows it once.

​
2. Add the token in Neo

1

Open Integrations

Open Integrations → GitLab in the Neo Dashboard. The card is under Project Management.
2

Save the address and the token

For GitLab URL, enter https://gitlab.com, or the address of your own GitLab server such as https://gitlab.example.com. A server under a sub-path takes its API address, such as https://example.com/gitlab/api/v4. Paste the Access Token and click Save. Neo saves the address as your GitLab’s API address, ending in /api/v4. Neo checks the token with GitLab before it saves, so a wrong or expired token is rejected straight away.

​
A GitLab server of your own

Neo calls your GitLab from the internet over HTTPS, with a certificate from a public authority. A server reachable only inside your network needs a reverse proxy that publishes the API path (/api/v4) and admits only Neo’s IP addresses. If GitLab refuses a token you know is right, check that the proxy passes the PRIVATE-TOKEN header through.

​
3. Turn GitLab on per agent

Open the agent from Agents, go to its Tools & Settings tab, click Project Management, and expand the GitLab block. Pick a preset, then change any group: each group can be Disabled, Read Only or Read / Write, and a Read / Write group can ask a technician before each change. In the agent’s instructions, name the project and branch it works in.

​
Keep a copy of your Neo workspace in GitLab

Create a scheduled agent, for example every night, that copies your whole Neo workspace into a repository: every agent, memory, skill (each file as its own file), intent and your tenant settings, one file per record, and one commit for each change:
  1. Create a project for the copy, such as neo-workspace, and a project access token for it with the api scope and the Maintainer role (or let Developers push to its default branch).
  2. Give the agent Neo API > Agents & Schemas, Agent Memories, Skills and Tenant Settings at Read Only, and GitLab > Repository at Read / Write.
  3. In its instructions, write: “Commit a copy of the Neo workspace into the folder neo on the main branch of the GitLab project my-group/neo-workspace, and delete the file of anything that no longer exists.”
A run with no change makes no commit, and a memory Neo only used, without changing it, is no change. Git keeps the history from the first copy on. To review a change before it lands, name a branch instead, and ask the agent to open a merge request into main.

​
Changes that always ask a technician

Whatever the profile: every Members & Access change that gives or restores access, a deploy key, the CI job-token allowlist, a fork, a transfer, protected branches, tags and environments, push rules, merge request approval rules and settings, unprotecting a branch, a status check’s response, approving a deployment, cloning or moving an issue, security settings, package and registry protection rules, the server’s application settings, a pull or push mirror, a webhook, an integration, an external status check, an export, a change of a project’s visibility, pull mirror, import URL, CI configuration path or merge gates, and deleting a project, a group or a user.

​
Request limits

gitlab.com allows 2,000 API requests a minute for each user, far more than an agent sends. A self-managed server sets its own limits. See GitLab API for what each profile does.