https://gitlab.com, or your self-hosted instance's base URL.read_api scope (the app never writes to GitLab, so no other scope is needed). See the Security Policy for the recommended token type.
Each Jira project's connection is independent: every project has its own GitLab URL, source, and
token, so different projects can point at entirely different GitLab hosts (e.g. one at
gitlab.com, another at a self-hosted instance) or different groups/projects on the same host.
Repeat this setup once per Jira project that should show a dashboard.
Every open merge request past the stale threshold gets one of three diagnoses, shown as a colored badge throughout the dashboard.
Any open MR older than the 'Stale after' threshold. Every stale MR gets one of the three diagnoses below.
Stale, but with an ordinary quiet history: fewer than 5 comments and not silent long enough to be Forgotten. Nothing is wrong except the time it's taking.
At most 1 comment AND no activity longer than the silence threshold — nobody is looking at it. Any new activity — a comment, commit, reassignment, or any other update — moves it back to Old.
5 or more comments while still unmerged — review and rework loops without progress. This status doesn't clear with activity: the discussion history stays.
The comment counts above (5 for Churning, 1 for Forgotten) are defaults; configurable via the gear on the Summary card.
Both age/silence thresholds are configurable in the dashboard's filter bar: MR is Stale after (days) sets the age behind Stale/Old, and Mark Forgotten after (days of silence) sets the silence window behind Forgotten. Adjust them and click Apply filters to recompute every status.
Just your connection settings (GitLab URL, project/group ID) and the access token you enter — the token is stored in Forge Secret Storage, encrypted at rest and never exposed to the browser. Merge request statistics themselves are cached for up to 2 minutes in Forge's key-value store purely to avoid re-querying GitLab on every reload — nothing is retained beyond that window. See the Privacy Policy for the full details.
gitlab.com (SaaS) and self-managed GitLab CE/EE — anything that exposes the standard REST API v4. The app is actively validated against current GitLab releases, but since it only relies on long-stable v4 endpoints (projects, groups, merge requests, members, notes), reasonably recent self-managed versions work as well.
The dashboard reads merge requests from GitLab's list API, whose comment counter
(user_notes_count) is cached on GitLab's side and can lag behind reality by
several minutes after comments are added or deleted. The per-MR timeline loads the actual
comments live, so it may briefly disagree with the counter. This resolves on GitLab's side —
usually within minutes, or after the next update to the MR. Press Refresh afterwards and
statuses will recalculate. The Refresh button clears the dashboard's own 2-minute cache, but
it cannot speed up GitLab's internal counter.
Nothing was lost. Starting in version 3.0.0, each Jira project has its own independent GitLab connection instead of one connection shared across the whole site. If a connection was configured before the upgrade, that data is preserved and offered as a pre-filled draft the first time you open a project's settings page — but it only becomes active for that project once you press Save there. Every other project that never had a connection of its own naturally shows "Not connected" until someone configures it (which can now be a completely different GitLab URL/project per Jira project — see Setup above). Open Project settings → Apps → MR Dashboard, confirm the pre-filled values (or enter new ones), and Save.
Every group-mode load has a fixed time budget: the dashboard queries every project under the group for merge requests and members, and if there are enough projects that it can't finish within that budget, it returns whatever it already collected instead of failing outright — flagged with this banner. (This is a different condition from the separate "GitLab rate limit reached" banner — see Troubleshooting below for the distinction.) The most reliable fix is pointing the connection at a subgroup instead of the whole top-level group, if your team structure allows it: fewer projects to enumerate per load means the fetch reliably finishes in time. Narrowing the date range also helps, since GitLab has less data to return per project.