# GitLab 19.4 introduces enhanced AI governance and security features New release brings improved MCP server controls and vulnerability management tools - **Source:** [GitLab](https://brifing.si/source/76101668-80db-4240-8676-e968d2b72546) - **Published:** 2026-09-18 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/62a1bc3e-37a1-4b6f-af07-b45892ae25f4 ## Enhanced AI governance controls GitLab 19.4 introduces unified governance for both internal GitLab Duo Agent Platform tools and third-party MCP server tools. Administrators can now set access modes for each tool from a single interface, ensuring AI agents operate within defined boundaries. The update allows restricting MCP server access by specific criteria, providing consistent controls across all environments where AI agents run. This feature is currently in beta, with feedback collected through issue #628378. ## Expanded language support for SAST Advanced SAST now extends its deep taint analysis to Kotlin, Dart, and Scala codebases, matching existing coverage for Java and Python. The Software Factory architecture delivers this capability through per-language front-ends with framework-aware rule gating. All new language support was verified using deliberately vulnerable real-code repositories, with findings reported as complete code flows from source to sink. ## Composite license management GitLab now fully supports SPDX license expressions like 'MIT OR Apache-2.0' in license data, addressing previous limitations where these appeared as 'unknown'. Composite licenses appear in dependency lists with their operators (AND, OR, WITH) and can be managed through approval policies. The update also synchronizes CycloneDX SBOM expressions with GitLab's license data, though offline instances require v3 license data download. ## Goal-driven CLI capabilities The new /goal slash command in GitLab Duo CLI enables governed, goal-driven flows that run locally. Users describe objectives while GitLab Duo handles implementation and verification, using an independent judge to determine completion. Users maintain control throughout, able to pause, update goals, or redirect agents. Requires GitLab 19.3+ and GitLab Duo CLI 9.17.0+. ## Slack integration for agent flows GitLab Duo's experimental Slack integration allows triggering agent flows directly through Slack mentions (@GitLab). The integration streams progress in real-time within Slack threads and includes feedback buttons. Users can create GitLab issues from conversations and get codebase answers without switching contexts. Feedback is collected through issue 624364. ## Visual flow builder for VS Code GitLab for VS Code extension introduces a visual flow builder for creating AI-native workflows. Users can compose flows from components (Agent, Custom tool, AI task) or edit underlying YAML directly. The beta feature includes testing via Run button and publishing to AI Catalog. Requires enabling gitlab.featureFlags.flowBuilder in VS Code settings. ## CI/CD tools for MCP clients New CI/CD tools enable agents to trigger, inspect, and control pipelines through MCP, addressing previous limitations. Merge request tools now support the full MR loop via MCP server, while new project/user tools provide necessary context for targeted work. Repository tools allow browsing project structure, reading commit history, and proposing changes. ## Work item management expansion The MCP server now exposes comprehensive work item tools for searching, reading, creating, and updating issues, epics, tasks, and other items. New functions include get_work_item for detailed reading, list_work_items for group/project searches, and save_work_item for updates. The introduction of save_note consolidates commenting functionality across work items and merge requests. ## Merge request trigger enhancement GitLab 19.4 adds 'Created' as a trigger action for merge requests, enabling flows or external agents to run immediately when MRs are opened. This supports first-pass reviews or adding context from related issues. Triggers can be configured in project AI settings or during flow enablement, addressing previous limitations that required external tools. ## Improved session details visibility The redesigned session details panel now clearly organizes status, timestamps, triggering user, and execution details. A new Linked items section separates session inputs from outputs, including merge requests and work items. In GitLab Duo side panel, details appear in a collapsible bar that remains accessible without obstructing workflow. ## Model selection flexibility GitLab Duo Agent Platform now supports independent model selection for Developer Flow, allowing administrators to choose specific AI models separately from other features. Three open-weight models are now available: GLM 5.3, Kimi K3, and MiniMax M3. Owners and administrators can set these as defaults for Agentic Chat and other agent features. ## Security enhancements GitLab 19.4 introduces malicious package detection in beta for Dependency Scanning, checking against GitLab malware advisories. Security dashboards now extend to organization level, showing vulnerability data across all top-level groups. New MCP server tools enable AI agents to perform vulnerability triage and remediation actions, while bulk due date assignment streamlines SLA compliance. ## Sources covering this story - https://docs.gitlab.com/releases/19/gitlab-19-4-released/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._