GitLab in Discovery

The same Discovery as GitHub, for GitLab projects: which projects build with AI and with what (dependency manifests), who owns them (CODEOWNERS at the root, in docs/ or .gitlab/, else the personal namespace), the MCP servers they declare, and AI keys committed to them (masked and fingerprinted, never stored). Reading the code (the deep pass) streams one archive per AI project: where code calls a provider directly or through Intertrace, keys in any file, model files checked from their bytes, the skills, plugins and agent files committed to it, and AI agents in .gitlab-ci.yml (and the CI files it includes locally).

A CI agent is a job that installs or runs Claude Code, Codex, Gemini CLI, PR-Agent or Aider, or uses an AI provider's key as a CI/CD variable. It is flagged when it hands the agent text a contributor writes (CI_MERGE_REQUEST_TITLE, CI_MERGE_REQUEST_DESCRIPTION, commit messages, TRIGGER_PAYLOAD, or the AI_FLOW_INPUT / AI_FLOW_CONTEXT variables Claude Code's GitLab guide fills from a comment), and when it pushes code or changes merge requests with a token. A job that runs an agent on a schedule with neither is listed, with no such reason.

1. 1

   Create a token with read_api

   A personal access token, or a group access token with at least the Reporter role, with the read_api scope. GitLab documents read_api as read access to the API for the token's scope; Intertrace only calls the REST API (project list, repository tree, blobs and the repository archive), so read_repository (Git over HTTP and the repository files API) is not needed. Intertrace reads the token's scopes from GET /personal_access_tokens/self when GitLab answers it and refuses one without read_api or api.

2. 2

   Connect it in Discovery

   Discovery → GitLab → Connect. Enter https://gitlab.com or your instance's public https address and paste the token. Intertrace lists one project with it first; a refused token reads "Couldn't read GitLab" and nothing is saved. The token is stored encrypted and is never shown again. Test connection repeats the one read; Disconnect deletes the token.

3. 3

   Scan, then read the code

   Every scan lists the projects the token is a member of (archived and empty ones are left out) and reads a few small files from each. Read the code downloads each AI project's archive. On gitlab.com GitLab allows 5 archive downloads a minute, so Intertrace waits between them and a large group is read over several passes.

Only GET requests, with the token in PRIVATE-TOKEN, to the address you saved: checked again as a public https address before every request, and a redirect is a failure, never followed. Nothing is written to GitLab. Archives are read as they stream (at most 80 MB and 3,000 text files per project) and dropped; what is kept is what Discovery shows: the findings, masked keys and fingerprints, model-file verdicts and the skills inventory.