Kiro Web integrates with GitLab so you can add a GitLab project to a session, have the agent make changes, and open a merge request on your behalf. This page covers how to connect, what the agent can access, and how to scope its permissions.
Kiro Web connects to GitLab using a personal access token (PAT):
Once connected, your GitLab projects are available to select when you create a session or add a repository mid-session.
Clones projects
The agent clones your authorized GitLab projects into its isolated sandbox environment, where it reads the code and makes changes.
Creates branches and commits
For each task, the agent creates a feature branch, makes commits with clear messages, and pushes to your project. The agent acts on your behalf and includes both you and itself as co-authors in every commit.
Opens merge requests
After completing work, the agent opens a merge request with a description of the changes, the implementation approach, and any trade-offs considered.
You can add both GitLab and GitHub repositories to the same session. The agent works across all selected repositories at once—reading code, making changes, and opening a merge request on GitLab and a pull request on GitHub as appropriate for each provider. This lets the agent coordinate changes that span projects hosted on different providers.
The agent's access to GitLab is scoped by what you grant your personal access token. GitLab offers two token types.
Fine-grained tokens use granular permissions instead of scopes, limiting the token to specific resources and repositories. When you create a fine-grained token, GitLab displays permissions in two sections. Under Group and project access, you select which groups or projects the token can reach and what it can do. Under User, you grant account-level permissions.
Grant the following:
| Section | Required permissions |
|---|---|
| Group and project | Code (Download, Push) · Merge Request (Read, Create) · Work Item (Read) |
| User | Project (Read) · User (Read) |
When creating the token, set the group and project access to include the repositories you want Kiro to work with.
Work Item (Read) covers reading issues and merge request comments.
The project picker lists all projects you are a member of, but the agent can only clone and push to repositories within the token's group and project access. A project can appear in the picker yet fail to clone if it is outside the token's selection. If that happens, edit the token's group and project access in GitLab to include the project.
GitLab personal access tokens can have an expiration date. When your token expires, Kiro Web loses access to your GitLab projects. You'll see a connection error when trying to use GitLab in a session.
To restore access, generate a new token in GitLab with the same permissions and update it in Settings > Agent.
Publicly hosted instances
If your GitLab instance is reachable over the public internet and uses IP allowlisting or firewall rules, you must allow inbound traffic from the following Kiro Web source IP addresses.
US East (N. Virginia) (us-east-1):
34.228.181.128 44.219.176.187 54.226.244.221
Privately hosted instances
Kiro Web does not yet support GitLab instances that are only accessible from within an AWS VPC.
GitLab