Arctic Fox CodeRider

What is the Polar Fox CodeRider?

The current official name of Polar Fox CodeRider is “YuMa CodeRider”, and it is provided by Polar Fox GitLab.

It combines AI-powered programming agents with GitLab’s development processes, covering code writing, code review, issues, merge requests, and CI/CD.

Main functions

• Based on natural language for code generation and a complete task plan.
• Code completion for single or multiple lines is provided in the editor.
• Explain, annotate, modify, and optimize the selected code.
• Generate unit tests for functions or code snippets.
• Automatically summarize Issues and Merge Requests.
• Generate file-level AI code review suggestions.
• View the differences in the IDE and add review comments.
• Verify CI/CD configurations and manage pipelines.
• Question answering based on corporate document and code knowledge bases.
• Connect GitLab to other tools via MCP.
• Use rules, memory, workflows, and Agent Skills.
• It can be used in IDEs, terminals, or web Q&A platforms.

AI programming skills

Programming agents

CodeRider Agent can read files, suggest changes, execute commands, use a browser, and call MCP tools.

The standard process displays the recommended actions and code differences; execution proceeds only after the user reviews and approves them.

1. Define the task objectives, technology stack, and acceptance criteria.
2. Let the Agent first read the relevant files and project rules.
3. Examine the plans it proposes and their scope of impact.
4. Approve document modifications and terminal commands one by one.
5. Run tests, static checks, and security scans.
6. Check the final differences; don’t just read the summary.
7. Submit the merge request only after confirming everything is correct.

Operation mode

Different modes will remember the model they were last used with, and it is also possible to switch between them using slash commands.

AI DevOps Assistant

• Automatically generates an overview of Issue discussions.
• Summarize the merge request description and code changes.
• Perform file-level code review within VS Code.
• View the differences in the code before and after merging.
• Generates submission information and assists in creating merge requests.
• Verify the CI/CD configuration and check the pipeline status.
• Create, cancel, or retry a pipeline.
• Download the pipeline outputs.
• Search for Issues, MRs, Epics, code snippets, and vulnerabilities.
• Offers over 20 quick operations for GitLab.

AI recommendations will not change GitLab’s permission model; ultimate access is still determined by the permissions associated with accounts, projects, and branches.

AI code review

The team version can generate file-level review suggestions for merge requests, helping to identify issues related to logic, standards, maintainability, and security.

1. Ensure that the scope of the merge request is clear and that the changes are not excessive.
2. Let the AI first summarize the purpose of the modifications and the key documents.
3. Check whether each suggestion corresponds to actual code.
4. For security issues, combine scanning tools with manual verification.
5. View the differences before and after the modification in the IDE.
6. Only verified review comments should be submitted.
7. Run full tests and protection rules before merging.

AI-based review may lead to missed detections, false positives, or a failure to understand business constraints; it cannot replace experienced reviewers and automated testing.

Corporate documentation and code knowledge base

CodeRider can use cloud-based models or enterprise-owned private models to enhance query-and-answer functions for internal documents and code.

PDF support is currently marked as experimental; the performance of processing scanned documents and those with complex layouts needs to be tested first.

Knowledge base permissions

Companies should still check index synchronization, data retrieval in the event of employee departures, cross-project references, and the data processing boundaries set by model providers.

Model configuration

Individuals and enterprises can use the official models, or they can configure their own model providers if permitted by the administrator.

When using an API key of your own, apply the principle of least privilege, use separate projects, and employ credentials that can be rotated; do not commit the key to version control repositories.

Official model Token

• Statistics on the number of calls begin to be collected after using the official model for the first time.
• Free users receive a limited number of tokens.
• The personal version currently includes 30 million tokens per year.
• The balance can be viewed in the user center of the current organization.
• It is necessary to confirm the current organization before making a top-up.
• The cost of custom third-party models is not included in the CodeRider package.

MCP capabilities

CodeRider includes the official GitLab MCP service built-in, and it allows for the configuration of project-specific as well as global MCP services.

• The official GitLab MCP includes common tools such as Issue, branches, and MR management.
• The document states that there are currently around 47 built-in tools related to GitLab.
• The MCP configuration for the project is based on the current code repository, allowing project members to work together on its maintenance.
• The global MCP applies to multiple items on the current user’s device.
• There are upper limits on the number of valid project MCPs and global MCPs, respectively.
• The agent selects which tool to use based on its name and description.

An MCP server may have permissions to access external systems; before enabling it, it is necessary to review its origin, parameters, credentials, and the actions it can perform.

Agent Skills and Rules

CodeRider implements Agent Skills, and uses SKILL.md to encapsulate domain knowledge, scripts, and reusable workflows.

Skills may contain executable scripts; before installing third-party Skills, it is necessary to review their content just as one would review code dependencies.

Memory function

• The user’s memory stores personal preferences and common settings.
• The project memory keeps track of the repository context and team rules.
• User memories can be manually uploaded or downloaded to achieve synchronization across devices.
• The content of memory can affect subsequent responses and actions.
• Do not memorize passwords, tokens, or client secrets.
• Expired instructions should be deleted promptly after project changes.

Guide to using Arctic Fox CodeRider

1. Register for a Polar Fox GitLab account or obtain an enterprise instance account.
2. Install the official plugins in VS Code, JetBrains, Android Studio, or Xcode.
3. You can also install CodeRider CLI and choose to log in using PAT or OAuth.
4. Verify the instance address, organization, and Token balance.
5. After opening the project, select the Ask mode to learn about the repository.
6. Generate plans using the Architect pattern and verify them manually.
7. Switch to Code mode to carry out a small-scale task.
8. Examine item by item file reading, modification, and terminal commands.
9. Run tests, format, scan, and build.
10. Use GitLab’s features to create an MR and generate a summary.
11. Let AI review the changes, with the developer performing the final approval.
12. Production projects are automatically approved for shutdown, and sensitive files are protected.

CLI installation and login

CodeRider CLI can be installed using the official installation script or the Node package manager, and it provides commands for upgrading and uninstalling.

Once created, a PAT usually cannot be viewed again; it should be stored securely and revoked immediately in the event of a data leak or employee departure.

Version and price

The prices listed on the official website were verified on August 31, 2026; for group purchases and Token top-ups, the terms of settlement or the contract apply.

Even without a limit on tokens, there may still be constraints related to deployment capacity, fair usage, and the specifications outlined in the contract; these details should be specified at the time of purchase.

Comparison of features across versions

Security approval and YOLO mode

Automatic approval reduces the number of confirmation steps, but it also expands the agent’s permissions regarding files, terminals, browsers, and external tools.

The authorities explicitly advise against using the YOLO mode in production code, sensitive projects, and scenarios where errors carry high costs.

Key points for corporate procurement

• Confirm per-person permits, organization tokens, and excess fees.
• Specify the model deployment location and the code transmission path.
• Define mechanisms for indexing, backing up, and deleting knowledge bases.
• Check project permissions, audit logs, and post-termination recovery.
• Use real warehouses to test code completion and assess quality.
• Include availability, response time, upgrades, and security incidents in the SLA.
• Define the responsibility boundaries between third-party models and MCP.

Privacy and code security

1. It is prohibited to include passwords, keys, and production credentials in the prompt.
2. Use rules to block environment files and certificate directories.
3. Use minimal permissions along with regular rotation for the model keys that are provided.
4. Check whether the model provider is allowed to retain or train the inputs.
5. Conduct license and supply chain scans for reliance on AI-generated content.
6. All writes and command executions are subject to review records.
7. Sensitive enterprises are given priority in assessing privatization and local models.
8. Run high-risk tasks in isolated branches, containers, or sandboxes.

The boundary between APIs and open source

Usage restrictions

• Code generated by AI may have logical, performance, and security flaws.
• Code reviews may miss errors or report false positives.
• The personal version of Token has an annual limit.
• Using built-in models incurs third-party costs and data risks.
• There are limitations on the knowledge base format, file size, and permissions.
• Automatic approval and YOLO mode may carry out high-risk operations.
• Private deployment requires a continuous operation and maintenance model as well as servers.

Frequently Asked Questions

Are Polar Fox CodeRider and YuMa CodeRider the same product?

Yes, its current official name is CodeRider, provided by GitLab; it was formerly referred to as GitLab CodeRider, and that name is still often used in various documents.

Is the personal version of CodeRider free?

It’s free; the current price for Personal is 0 yuan per person per year, and it includes 30 million tokens, which allow for features such as code completion and Agent programming.

How much is the Team version of CodeRider?

The Team plan currently costs 2,399 yuan per person per year and includes the Polar Fox GitLab Team version, AI-based code review, an enterprise knowledge base, as well as dedicated support.

Which development environments is CodeRider compatible with?

It supports VS Code, JetBrains IDEs, Android Studio, Xcode, and the CLI; it also offers an enterprise Q&A platform that does not rely on any IDEs.

Can CodeRider use its own models?

Yes, it is possible to configure models such as DeepSeek, Moonshot, Zhipu, those compatible with OpenAI, Ollama, and LM Studio, provided that the administrator permits it.

Is the YOLO mode of CodeRider safe?

The risk is high; it automatically approves documents, commands, and tool operations, and should only be used in isolated, low-risk, and recoverable prototype environments.

Is CodeRider open source?

No, the basic version of Polar Fox GitLab comes with open-source code, but the complete source code for CodeRider has not been found yet; the two should not be confused.