
Research
GemStuffer Campaign Abuses RubyGems as Exfiltration Channel Targeting UK Local Government
GemStuffer abuses RubyGems as an exfiltration channel, packaging scraped UK council portal data into junk gems published from new accounts.
@gitlab/duo-cli
Advanced tools
GitLab Duo for your command line. An AI-powered CLI tool that brings GitLab Duo's capabilities to your terminal.
Install globally using npm:
npm install -g @gitlab/duo-cli
After installation, the CLI can be run using the duo command.
You can run the CLI directly without installing it globally:
npx -y @gitlab/duo-cli
To update to the latest version:
npm install -g @gitlab/duo-cli@latest
Start the interactive terminal UI:
duo
On first run, you'll be prompted for a GitLab authentication token. Your token must have the api scope granted.
The run command is ideal for non-interactive CI environments or integration with scripts and automated workflows. For example, you can run an eslint command and pipe any errors to Duo: duo run --goal "Fix these errors: $eslint_output"
Note that each time you execute duo run it will start a fresh workflow, so Duo won't know what the previous conversation or context was.
Run a workflow in non-interactive mode:
duo run --goal "Your goal or prompt here"
Additional options for headless mode:
--ai-context-items <contextItems> - JSON encoded array of additional context items--existing-session-id <sessionId> - Resume an existing sessionEdit the CLI configuration:
duo config edit
View and manage logs:
duo log last # Open the last log file
duo log list # List all log files
duo log tail [args...] # Tail the last log file (supports standard tail arguments)
duo log clear # Remove all existing log files
-C, --cwd <path> - Change working directory--log-level <level> - Set logging level (debug, info, warn, error)--gitlab-base-url <url> - Base URL of GitLab instance (default: https://gitlab.com)--gitlab-auth-token <token> - Authentication token for GitLab instance-v, --version - Display version number--help - Display help informationDuo CLI supports connecting to local or remote MCP servers using the same MCP configuration as the GitLab IDE extensions. Configuration instructions can be found at MCP Documentation
You can also configure the CLI using environment variables:
GITLAB_URL or GITLAB_BASE_URL - GitLab instance URLGITLAB_TOKEN or GITLAB_OAUTH_TOKEN - Authentication tokenLOG_LEVEL - Logging levelDUO_WORKFLOW_GIT_HTTP_USER - Git HTTP authentication usernameDUO_WORKFLOW_GIT_HTTP_PASSWORD - Git HTTP authentication passwordDisplay help for any command:
duo --help # Global help
duo run --help # Help for a specific command
See Development Guide for information on contributing to this project.
See the License for details.
FAQs
GitLab Duo for your command line
The npm package @gitlab/duo-cli receives a total of 50,742 weekly downloads. As such, @gitlab/duo-cli popularity was classified as popular.
We found that @gitlab/duo-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
GemStuffer abuses RubyGems as an exfiltration channel, packaging scraped UK council portal data into junk gems published from new accounts.

Company News
Socket was named to the Rising in Cyber 2026 list, recognizing 30 private cybersecurity startups selected by CISOs and security executives.

Research
Socket detected 84 compromised TanStack npm package artifacts modified with suspected CI credential-stealing malware.