GitLab 19.4, released September 17, 2026, introduces governance for MCP server tools alongside internal GitLab Duo Agent Platform tools, Advanced SAST support for Kotlin, Dart, and Scala languages, SPDX license expression support in dependency scanning, and a new /goal slash command in GitLab Duo CLI for delegated objective execution.
Snyk Agent Scan analyzed nearly 4,000 agent skills across major marketplaces and discovered credential theft, backdoors, and data exfiltration in publicly available skills. The company released Skill Inspector, a CLI tool that scans agent skills and MCP servers for malicious code and security vulnerabilities before installation, detecting risks like prompt injection, malicious code patterns, credential exposure, and supply chain attacks.