Overview

Bits Code integrates with source code providers to open, update, and iterate on pull or merge requests based on issues detected in Datadog. After completing setup, you can start using Bits Code.

Prerequisites

To set up Bits Code, you need the Bits Code Write (bits_dev_write) permission. This permission is included in managed Datadog roles such as the Datadog Standard Role.

If your organization uses custom roles, an admin must add this permission manually. For details, see Access Control.

Setup

Set up Bits Code for one of the supported source code providers.

Additional configuration

These optional configurations help you get the most out of Bits Code.

Configure telemetry tagging

Bits Code uses the service and version telemetry tags to match detected issues (such as errors or vulnerabilities) to the version of code that was running at the time.

To configure telemetry tagging, see Tag your APM telemetry with Git information.

You can also configure service-to-repository mapping manually in Bits Code settings under Repositories > Service Repository Mapping.

Enable auto-push

Auto-push allows Bits Code to create branches, push code, and open PRs or MRs when it detects something it can help you with. Auto-push only opens PRs or MRs and pushes changes; it never merges code. When auto-push is disabled, you must review code in Datadog before it gets pushed.

To enable auto-push, navigate to Bits Code > Settings > General.

Security considerations

Allowing any AI-based tool to read untrusted data can let attackers influence its output. Auto-push behavior depends on the type of data Bits Code works with: code-only workflows operate on source code the Agent can inspect directly, while telemetry-based workflows (such as errors or traces) may include untrusted runtime inputs.

To balance safety and automation, you can configure auto-push behavior in Datadog (for example, limiting auto-push to code-only workflows or requiring review when telemetry is involved). Datadog scans all Agent-generated code before pushing changes, but these safeguards are not foolproof.

Configure custom instructions

Bits Code ingests custom instruction files from your repository, including:

• AGENTS.md
• CLAUDE.md
• agent.md
• .cursorrules
• .windsurfrules
• copilot-instructions.md

You can also define global custom instructions that apply to all Bits Code sessions in Bits Code > Settings > General, in the Global Agent Instructions section.

A custom instruction file is a good place to mention custom skills you’d like Bits Code to use.

Environment setup

Configure Bits Code’s runtime environment, including network access policies and repository-specific tooling.

Configure internet access

By default, Bits Code has no internet access during agent execution. To configure which external domains agents can reach, navigate to Bits Code > Settings > General, and find the Internet Access section. Choose from the following access policies: No Internet Access, Default Allowlist, Custom + Default Allowlist, or Custom Allowlist.

The default allowlist includes the following domains. This list will evolve over time based on user feedback and ecosystem changes. To avoid changes, configure a custom allowlist.

Use Docker and Docker Compose

Bits Code sessions support Docker and Docker Compose commands. You can build images and run containers as part of repository setup, testing, and validation.

Access to container registries during a session is controlled by your organization’s internet access policy.

Configure repository environment

Configure a custom environment for Bits Code to install dependencies, formatters, linters, and build tools that are needed for your codebase. Each repository runs in its own isolated sandbox, and the environment defines the settings for that sandbox.

To configure a repository environment:

1. Go to Bits Code > Settings > Repositories, and find the Environments section.
2. Click Add Environment to create a repository configuration:
   1. Select a repository from the dropdown.
   2. (Optional) Under Pre-installed Languages, click Select Versions to specify the language versions the sandbox should use.
   3. (Optional) Define environment variables and secrets. Environment variables are available during both environment setup and Bits Code execution. Secrets are available as environment variables only during environment setup. A value defined here replaces the organization value with the same name.
   4. (Optional) Add a shell script with setup commands to execute (for example: pip install -r requirements.txt).
3. Run the setup command to verify that it completes successfully. You need write access to the selected repository.
4. Save the configuration.

Bits Code runs the setup command at startup and can use any tools installed in your environment. The setup command runs with network access enabled to download dependencies. After setup is complete, your internet access policy controls outbound network access during agent execution. Because setup commands execute against code in your repository, enable them only if you trust the repository’s code.

Note: For best results, add a custom instructions file (like claude.md) to your repository with instructions on how to build and test your code.

Configure organization environment variables and secrets

Define environment variables and secrets once for your organization instead of repeating them in each repository. Every repository environment inherits them. Organization environment variables are available during environment setup and Bits Code execution. Organization secrets are available as environment variables only during environment setup. A repository environment with no setup command still inherits organization environment variables, but not organization secrets.

To configure them, go to Bits Code > Settings > Repositories, and find the Environments section. Names must be valid shell environment variable identifiers. A repository environment can also opt out of an inherited environment variable or secret, which makes that name unavailable in the repository. Remove the opt-out to inherit the value again.

Managing organization environment variables and secrets requires one of the following permissions: Bits Code Write, Integrations Manage, User Access Manage, or Org Management. None of these permissions require source code access to repositories that inherit the values. Users with any of these permissions can influence environment setup and agent execution across all repositories in your organization. Grant these permissions only to users who need them.

Troubleshooting

Creation of GitHub PRs fails unexpectedly

In some cases, especially in repositories with many branches, GitHub does not run the permission check when creating a branch for the session. If you use a custom GitHub App, you can work around this issue by adding the workflows:write permission to your app in the GitHub integration.

Note: This permission allows Bits AI to create workflows in your repository and has security implications.

Further reading

Additional helpful documentation, links, and articles:

Turn Datadog findings into automated code fixes with Bits CodeBLOG