Inside Uber's software factory
Six platform layers, an agent registry that makes every agent action traceable to a person, and the most honest published account of what AI measurement got wrong.
Uber at a glance
The company
| Sector | "Uber's mission is to create opportunity through movement" 11 |
|---|---|
| Employees | Approximately 34,000 globally, in over 70 countries and more than 15,000 cities (Dec 31, 2025) 12 |
| Customers | 208m monthly active platform consumers, 3.867bn trips in the quarter 11 |
| Revenue | $14.191bn revenue, $58.022bn gross bookings (Q2 2026) 11 |
Employee count is the 10-K figure for Uber and its subsidiaries and is not broken out by function; no engineering headcount is disclosed in any source 12.
The engineering organisation
| Engineering size | Not disclosed. Sources say only "thousands of engineers" across large monorepos 4 |
|---|---|
| AI tooling since | August 2025 is the earliest dated first-party account of an agent in the SDLC 2 |
| Tool policy | Central platform, multiple models and harnesses; spend tiers require manager sign-off 1 |
| Agents in the SDLC | Code review, test generation, background PRs, CI self-healing, on-call triage 1,2,4 |
| Reported adoption | 7x growth in weekly active users of agentic tooling, February to August 2026 1 |
| Published metrics | Cost per session, cost per 1,000 requests, comment address rate, per-language test success rates 1,2,4 |
The 7x adoption figure is deduplicated across tools and counts all employees, engineers and non-engineers alike, not engineers only 1.
People
What they set out to solve
Thousands of Uber engineers work in large shared monorepos 4, and by March 2026 the company's AI-related costs had risen sixfold since 2024 9. Adoption kept climbing: weekly active users of agentic tools grew sevenfold between February and August. The problem Uber set out to solve was what all that use cost, and Uday Kiran Medisetty, a Distinguished Engineer, broke it into six multiplied terms 1:
Total spend = users × sessions/user × turns/session × requests/turn × tokens/request × price/token
The first two terms measure adoption, which Uber wants to keep growing. The middle three measure "the work the agent does on its own behalf, on top of the request an engineer actually made", and those are the terms Uber set out to cut 1.
Three concrete failures underlay the arithmetic 1. The first was schema overhead nobody had counted: with more than 100 tools installed, pre-loading their definitions "added approximately 50K-70K tokens of schema overhead to the initial prompt, which was subsequently re-sent on every context turn." The second was that ungrounded agents burn money slowly rather than failing fast: "An ungrounded agent fails slowly rather than cheaply, repeatedly sending an expanding context window to search one more location," a failure mode serious enough to motivate the context graph described below. The third was that third-party tools proved worse than internal ones: "Managing third-party software proved significantly more challenging than our internal servers. Vendors design MCP servers to expose full product capabilities because they can't anticipate specific customer usage." A workspace suite shipped 49 tools in one server, and messaging and project tracking vendors shipped 34 and 46.
A second problem is identity. The current identity model "doesn't describe agency", and "execution context (originating user, intermediate agents) is dropped across agent hops" 3. An agent calling an agent calling a service left nobody accountable at the end of the chain.
The third is toil. Anshu Chada, Engineering Director on the Dev Platform, frames the payoff as satisfaction before speed: "when we push some of the boring stuff to AI...not only does it result in much higher satisfaction from our engineers, but they're able to push our product" 9. The Minion platform is described as targeting exactly that, "the boring work that steals engineering focus", rather than novel work 8.
For code review, the stated goal was to "augment the code review process with a second AI reviewer", "not as a substitute for human insight, but as a scalable partner" 2.
Maturity level
Assigned by testing published facts against fixed criteria, and capped by what the sources state.
How Uber's software factory works
Uber describes six connected layers 6.
A Model Gateway serves more than 800 internal projects and over 100 million model requests a day 6. Model selection runs against an internal benchmark, the Uber SWE Benchmark, which tests frontier and open-weight models across task types, and the selection criterion is stated as Pareto efficiency across "cost/completed task, output quality, and model reliability" 1.
An MCP Gateway is the single entry point to more than 1,000 MCP servers, internal and third-party SaaS alike, "enabling centralized authentication and policy enforcement" 1. It is also the policy enforcement point for agent identity, performing "tool access checks and redaction of sensitive data" against an internal risk classification before proxying a call onward 3.
The gateway exists because teams were building MCP integrations independently, which left tooling fragmented, infrastructure duplicated, and tools hard to discover or operate. Its fix rests on one observation: existing APIs are the fastest way to give an agent tools, so services need not be rewritten. A registry is the control plane and a proxy is the data plane 14.
The registry fills itself. AutoCrawler, a Cadence workflow, scans Uber's IDL registry on a schedule, upserts a virtual MCP server for each Protobuf or Thrift service, has an LLM write agent-friendly tool descriptions from the IDL's method names and doc comments, and registers every tool disabled. Native servers built with MCPFx emit heartbeats, which AutoCrawler watches before calling listTools and wrapping them in a virtual proxy server, also disabled. Ownership stays with the service team. "Discovery doesn't imply exposure": the owner must review and enable each tool, and any change to a tool description becomes a config diff the owner approves, deploys, or rolls back 14.
At runtime the proxy pulls configuration from the registry on a fixed cadence, so changes need no restart. It serves each virtual server at a /<service-name>/mcp endpoint, translates JSON into Protobuf or Thrift bytes, and forwards them through Muttley, the service mesh sidecar, so no downstream service changes. Authorization runs through Uber's Access Control System with charter policies for humans, services, and agents, set per server with tool-level overrides, and PII is redacted from responses by default. For third-party servers such as Jira and Google, the gateway relays the caller's user token and applies the same authorization, rate limiting, and redaction, and the vendor side exchanges it for an external token 14.
Scale produced a second set of problems. The gateway hosts more than 800 MCP servers and over 5,000 tools 14, where the August efficiency post counts more than 1,000 servers 1; neither source says what it counts as a server. MCP has no cross-server search, and wiring in hundreds of servers would fill the model's context. Omni MCP answered with one proxy exposing four tools, discover_server, discover_tools, get_tool_schema, and invoke_tool, so an agent loads only what it needs under the same access control. Response Projection injects a field into a tool's request schema so the model lists the nested paths it wants, and the gateway trims the response to them. Code Mode, delivered through the aifx CLI as mcp list, mcp search, and mcp call, lets a coding agent write output to files and grep them, and is now the default way coding agents use MCP tools 14.
DevPods give agents pre-provisioned environments rather than a cold checkout 6, the layer Nikhil Ramakrishnan describes as years of prior investment in remote environments, CI, and developer tooling finally paying off for something other than humans 8.
A skills marketplace holds more than 3,600 skills running over 30,000 executions a day 1. At the World's Fair talk the same marketplace was described as 2,500 skills at 20,000+ daily executions 6, so growth is roughly visible even though neither source defines what one skill execution counts as.
The AI Context Graph unifies 24 million nodes and 80 million edges drawn from more than 30 internal systems 1. It exists to stop the slow-failure mode: grounded, an agent answered in 38 seconds where the ungrounded run took 20 minutes 9 seconds and got it wrong 1.
Cortana, a company-wide assistant, is available in Slack, CLI, and web, and runs more than 20,000 sessions a day 6.
Identity binds the layers together. An Agent Registry links every AI agent to its Kubernetes workload, agents fetch cryptographically signed SPIRE workload credentials, and a Security Token Service mints "short-lived, scoped tokens for every hop", each carrying an actor chain and an audience claim valid only for that destination. P99 latency on that token exchange stays under 40 milliseconds, with most values below 10 3. The practical effect is that a multi-hop agent-to-agent delegation still resolves to a responsible human in the logs.
What runs without a human starting it
This is the sentence that places Uber, and it is first-party 1:
As we progress on that vision, a growing share of sessions aren't initiated by humans, but by automated managed agents handling code review, self-healing CI failures, completing E2E PRs with visual validation, triaging on-call alerts, debugging incoming bugs, and handling a variety of code maintenance tasks with human reviews/escalations.
Three of those are separately documented.
Review. uReview covers roughly 90% of about 65,000 diffs a week across six monorepos, in Go, Java, Android, iOS, TypeScript, and Python 2. Specialised assistants generate comments, a secondary prompt scores each one's confidence, a semantic similarity filter merges overlaps, and a category classifier suppresses categories with historically low value 2. Developers rate each comment "Useful" or "Not Useful", and that feedback tunes the system 2. Median latency per commit is four minutes 2. Whether it can block a merge is not stated 2.
Tests. AutoCover generates about 11% of all new tests reviewed and added to the codebase 4. It is a LangGraph pipeline with sub-graphs for preparation, generation, execution, and validation and repair, offered in three modes: CLI for scripting, Headless for sharded backfills that open merge requests on their own, and IDE for human-in-the-loop work 4. Success rates are published per language and are not flattering by design: about 20% for Java, 40% for Go, and 80% for Python 4.
Background PRs. Minion is an internal background agent platform with monorepo access and optimized defaults 9, aimed at "the boring work that steals engineering focus" 8. Its share of merged pull requests is one of two conflicting figures for agent involvement in PRs, examined below 8.
Operating the software factory: teams, roles, and skills
Spend governance is where the operating model is most explicit, and it works through visibility and friction rather than hard limits 1. A live cost counter sits in the harness status line, tracking spend per harness and across all harnesses for each user, and Slack notifications fire at 50, 80, and 100% of expected spend, a design meant "so engineers have time to plan" rather than cutting them off outright. One shared tier covers all interactive harnesses, deliberately not split into per-tool budgets, with separate tiers reserved for managed agents, and moving to a higher tier needs manager sign-off, though the approval flow itself is described as quick.
Defaults do the rest of the work: automatic compaction triggers at 400,000 tokens even on million-token context windows, and reasoning effort defaults to Medium. A session analysis dashboard classifies runtime behaviour into 16 anti-pattern categories 1.
The agent surface reaches past engineering. uSpec connects an agent in Cursor to Figma over MCP to produce anatomy, API, accessibility, and token documentation for the Base design system, generating full screen-reader specifications in under two minutes and serving thousands of engineers across seven implementation stacks. The whole pipeline runs locally so proprietary design data never leaves the network 10.
Implementation journey
The public record runs roughly in this order.
- Before agentsRamakrishnan's framing is that remote environments, CI, and developer tooling were built first, and background agents became possible because that groundwork already existed 8.
- August 2025uReview publishes, the earliest dated account of an agent operating continuously in the SDLC 2.
- March 2026An external inside look names Minion, Shepherd, uReview, Code Inbox, AutoCover, the MCP Gateway, Uber Agent Builder, AIFX CLI, and Agent Studio, and reports 84% of developers using agentic coding tools, 92% using agents monthly, and 65-72% of code in IDE-based tools AI-generated. Claude Code usage nearly doubles from 32% in December to 63% in February 9.
- April 2026
- May 2026
- 2026, at the AI Engineer World's FairThe six-layer factory is presented publicly 6.
- August 2026The efficiency post reports weekly active users up 7x and weekly agentic requests up 9.4x from February to August 1.
- October 2026The MCP Gateway's design is published, with 800+ servers, 5,000+ tools, and Code Mode as the default for coding agents 14.
Measuring the software factory
Uber is the only company in this corpus to publish a peer-reviewed threats-to-validity section about its own tooling. AutoCover's authors state plainly that "coverage ≠ effectiveness", that code coverage is an imperfect proxy mitigated with scenario coverage and mutation testing, and that a target-selection bias is possible because "developers may have targeted particularly hard-to-test legacy code." They also state a deliberate trade: they favour external and ecological validity over internal validity, because tight experimental control and real deployment are at odds 4.
The measurement story on productivity is more interesting for what was thrown away. Abhishek Tibrewal describes a difference-in-differences design built around an explicit counterfactual, "if there was no Copilot, what would have the same developer shipped?" It produced a 19% lift among power users, an 8% cohort, with gains distributed unevenly by seniority and largest for junior-to-mid engineers. The speakers are careful that correlation among power users needed causal validation, since productive engineers may simply adopt tools first 7.
Then they dropped a metric on purpose. "Developer years saved" was abandoned for three stated reasons: it created anxiety about replaceability despite leadership's hiring intent, its baseline needed constant recalibration as tools changed, and business leaders wanted revenue and feature impact rather than a time-savings abstraction 7.
Cost is measured tightly. Cost per 1,000 requests fell almost 34% from its peak between February and July with the model held constant, and cost per session fell 52% from its June peak to August. Restructuring tool access into code mode cut tokens 55-71% on typical queries and close to 100% on a wide-table SQL query 1.
Three published figures carry caveats worth stating alongside them. uReview's "~1,500 hours weekly, about 39 developer-years annually" was published a year before Uber abandoned hours-saved framing internally, and its calculation's method is never disclosed 2,7. "Lines of code per engineer doubled year over year" rests on a proxy widely criticised elsewhere, and no source addresses whether agent-generated boilerplate inflates it 6. The third figure, the agent share of pull requests, is the entry's sharpest definitional problem, treated in full below.
The 11% and the 70% are not the same measurement
Both figures are first-party, both are recent, and they differ by a factor of six. They also count different things.
- 11% of PRs opened by agents, March 2026, counting pull requests an agent opened 9.
- 11% of merged PRs, May 2026, counting merged pull requests Minion is behind 8.
- More than 70% of PRs, at the 2026 World's Fair talk, counting pull requests that "involve local or cloud agents" 6.
- More than 70% attributed to agents, August 2026, stated as a share of all PRs with no definition given 1.
The reconciliation the sources support is that the low figure counts PRs a background agent authored end to end, and the high figure counts any PR an agent touched, including one an engineer drove from their own IDE. No source states that reconciliation, and no source defines what counts as agent involvement once a human edits the output. Present both with their dates and denominators, or neither.
Lessons learned
Grounding is a cost control, not just a quality one. An agent without shared context does not fail cheaply; it fails slowly, burning tokens on an ever-expanding search that the context graph exists specifically to short-circuit 1.
Vendor MCP servers are a scaling problem. Internal servers were easier to manage than third-party ones, because vendors design their servers to expose full product surfaces they cannot scope to one customer's usage 1.
Sometimes the answer is not AI. The largest migration in the record went deterministic. On migrating 75,000 test classes and 1.25 million lines from JUnit 4 to JUnit 5 in four months via 5,000+ automated diffs, the team states that "AI usage was limited to debugging test and build failures. Given our codebase's scale and custom testing patterns, a deterministic approach proved more practical than an AI-driven migration" 5. Shepherd orchestrated OpenRewrite transformations across thousands of test targets and validated each through CI 5.
The reviewer publishes its own limits. uReview's own post lists where it is weak: it cannot see past PRs, feature flags, schemas, or documentation, it is "better at catching bugs than assessing system design", and it struggles with readability comments engineers routinely reject 2. 75% of its comments are rated useful and 65% are addressed in the same changeset 2.
A measurement can be right and still worth deleting. The developer-years metric was dropped for its effect on engineers and its instability, not because it was wrong 7.
What's next for Uber's software factory
Uber states a direction rather than a roadmap: the shift toward agent-initiated sessions described above continues, with humans moving from initiators of work to reviewers and escalation points. On generalisability they are explicit that their numbers are theirs: "specific cost reductions we measure are unique to our environment and your mileage may vary depending on your codebase, team size, and agent workflows", with only the benchmarking methodology offered as portable 1.
The AutoCover authors name their own next steps from user feedback: tighter coverage-tool integration able to target only new or changed lines, and the ability to interject mid-generation to steer an agent that is close but not correct 4.
