
Security News
Rust RFC Proposes a Security Tab on crates.io for RustSec Advisories
Rust’s crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.
@gitlab/duo-cli
Advanced tools
GitLab Duo for your command line. An AI-powered CLI tool that brings GitLab Duo's capabilities to your terminal.
Install globally using npm:
npm install -g @gitlab/duo-cli
After installation, the CLI can be run using the duo command.
You can run the CLI directly without installing it globally:
npx -y @gitlab/duo-cli
To update to the latest version:
npm install -g @gitlab/duo-cli@latest
Start the interactive terminal UI:
duo
On first run, you'll be prompted for a GitLab authentication token. Your token must have the api scope granted.
The run command is ideal for non-interactive CI environments or integration with scripts and automated workflows. For example, you can run an eslint command and pipe any errors to Duo: duo run --goal "Fix these errors: $eslint_output"
Note that each time you execute duo run it will start a fresh workflow, so Duo won't know what the previous conversation or context was.
Run a workflow in non-interactive mode:
duo run --goal "Your goal or prompt here"
Additional options for headless mode:
--ai-context-items <contextItems> - JSON encoded array of additional context items--existing-session-id <sessionId> - Resume an existing sessionEdit the CLI configuration:
duo config edit
View and manage logs:
duo log last # Open the last log file
duo log list # List all log files
duo log tail [args...] # Tail the last log file (supports standard tail arguments)
duo log clear # Remove all existing log files
-C, --cwd <path> - Change working directory--log-level <level> - Set logging level (debug, info, warn, error)--gitlab-base-url <url> - Base URL of GitLab instance (default: https://gitlab.com)--gitlab-auth-token <token> - Authentication token for GitLab instance-v, --version - Display version number--help - Display help informationDuo CLI supports connecting to local or remote MCP servers using the same MCP configuration as the GitLab IDE extensions. Configuration instructions can be found at MCP Documentation
You can also configure the CLI using environment variables:
GITLAB_URL or GITLAB_BASE_URL - GitLab instance URLGITLAB_TOKEN or GITLAB_OAUTH_TOKEN - Authentication tokenLOG_LEVEL - Logging levelDUO_WORKFLOW_GIT_HTTP_USER - Git HTTP authentication usernameDUO_WORKFLOW_GIT_HTTP_PASSWORD - Git HTTP authentication passwordDisplay help for any command:
duo --help # Global help
duo run --help # Help for a specific command
See Development Guide for information on contributing to this project.
See the License for details.
FAQs
GitLab Duo for your command line
The npm package @gitlab/duo-cli receives a total of 5,601 weekly downloads. As such, @gitlab/duo-cli popularity was classified as popular.
We found that @gitlab/duo-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Rust’s crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.

Security News
/Research
Socket found a Rust typosquat (finch-rust) that loads sha-rust to steal credentials, using impersonation and an unpinned dependency to auto-deliver updates.

Research
/Security Fundamentals
A pair of typosquatted Go packages posing as Google’s UUID library quietly turn helper functions into encrypted exfiltration channels to a paste site, putting developer and CI data at risk.