What Is Repomix? Installation, Usage, MCP and Security Notes

To show your project to ChatGPT or Claude, you don't need to upload files one by one. You run a single command in the folder, and Repomix gathers all the code, the folder tree and the token count into one file; you upload that file to the chat and say "summarize this project." No installation needed: npx repomix@latest, Node.js 22 or later. With repomix --mcp, the same program also becomes an MCP server the assistant can use directly.

What it does: Packs a code folder into a single file
Type: Command-line tool (and MCP server)
Maker: Kazuki Yamada (independent developer)
CLI data: No telemetry collected
History: 5 published security advisories (fixed)
Turkish: CLI in English; the website offers a Turkish option
Cost: Free, MIT

What is Repomix for?

When you want to show a chat assistant your project's code, uploading files one by one is tedious. Repomix walks the folder and gathers the file contents, the directory tree and the token count into a single output file. If you like, it can pack a GitHub repository without downloading it (--remote), shrink the output (--compress) or split it into parts.

Give code to AI as one fileWhat you get: repomix-output.xml (default)Needs a separate setup

The same tool also runs as an MCP server: the assistant triggers the packing itself, searches the output and reads it. There are also official plugins for Claude Code.

Who it's for: Developers who want to load a large codebase into a chat assistant or have a repository analyzed quickly.

How does Repomix work?

Your folder

src/App.jsx
src/api.js
README.md
package.json

The folder where your code lives.

One command› npx repomix@latestYou run it inside the folder; no installation needed.

One filerepomix-output.xmlcode + folder tree + token countYou upload the file to the chat and have it summarize the project.

How do you install Repomix?

Requirements: Node.js 22.0.0 or later (plus Git for remote repositories). No account or key needed. The commands are taken from the Repomix installation page.

In the project folder› npx repomix@latest

The first run creates a repomix-output.xml file in the folder.

npm› npm install -g repomix

Homebrew› brew install repomix

Docker› docker run -v .:/app -it --rm ghcr.io/yamadashy/repomix

Add› claude mcp add repomix -- npx -y repomix --mcp

Restricted to one folder› repomix --mcp --sandbox path/to/project

For the Claude Code plugins: /plugin marketplace add yamadashy/repomix, then /plugin install repomix-mcp@repomix. The plugin runs repomix@latest, so it does not pin the version.

VS Code› code --add-mcp '{"name":"repomix","command":"npx","args":["-y","repomix","--mcp"]}'

For Cursor, Cline and Claude Desktop, add a repomix entry under mcpServers in the configuration file (command npx, arguments -y repomix --mcp).

To pin the version, type npx repomix@1.18.1; this is not a README example but this page's suggestion.

How do you use Repomix?

Command	What it does
repomix	Packs the current folder.
repomix --include "src//.ts,/.md"**	Packs only the matching files.
repomix --ignore "/.log,tmp/"*	Additional exclude patterns.
repomix --style markdown	Output format: xml (default), markdown, json, plain.
repomix --compress	Drops code bodies and keeps signatures (documentation: experimental).
repomix --remote user/repo	Clones and packs a GitHub repository.
repomix --token-count-tree	Token breakdown by folder.
repomix --copy	Also copies the output to the clipboard.
repomix --split-output 1mb	Splits the output into parts.

By default, .gitignore, .ignore, .repomixignore and built-in patterns (node_modules, .git, binary files) are applied. Write the paths you don't want packed into a .repomixignore file.

Have it analyze the repository"Read the attached repomix output. Summarize the project's architecture, its main modules and the areas that need attention. Don't repeat any password or key from the output."

Where does Repomix run?

Terminal (CLI)Yes	npx, npm, Homebrew or Docker.
Claude CodeYes	As MCP or with the official plugins.
Claude Desktop, VS Code (including Insiders), Cline, CursorYes	Configuration is in the MCP documentation.
Codex, GitHub Copilot and othersPartly	Only the repomix-explorer skill (Agent Skills); not MCP.
repomix.com websiteYes	Files go temporarily to the site's server.

What does Repomix access, and is it safe?

Reads

Files in the packed folder, the local git history (for sorting; diffs and the commit log if requested), and the GitHub repository given with --remote. In MCP mode, by default, every path the user can read.

Writes

A single output file; a clipboard copy if requested; a configuration file with --init; a skill folder under .claude/skills with --skill-generate.

Deletes

The documentation lists no command that deletes user files.

Data

According to the official privacy page, the CLI collects no telemetry or user data; the internet is used only for installation, --remote and update checks. The repomix.com website, however, uses Google Analytics and keeps uploaded files temporarily for processing, then deletes them. The AI service you later upload the output to is a separate data path.

In MCP mode, Repomix can by default read every path the user running the server can read. --sandbox limits this to a single folder, but the documentation says it is not an operating-system-level sandbox; --sandbox also disables remote packing and skill generation. The Secretlint scan is not a guarantee: there may be secrets it misses, so review the output before sharing it.

Past security advisories (GitHub, all fixed in 1.18.1 or earlier):

Advisory	Summary	Affected versions
GHSA-9mm9-rqhj-j5mx	High: command injection via the --remote-branch argument	Before 1.14.1
GHSA-4p5g-gh74-q524	High: a crafted repository's git configuration could execute commands	0.2.41–1.18.0 (fixed in 1.18.1)
GHSA-hwpp-h97w-2h3j	Medium: attach_packed_output could bypass the secret scan	1.14.0 and earlier
GHSA-w8cw-mgw9-74h7	Medium: a password or token in the remote repository URL was written to the log in plain text	1.17.0 and earlier
GHSA-rpmv-562j-qxrv	Low: the MCP file tools did not enforce the protections they claimed	1.17.0 and earlier

OSV returned no results for the current version, 1.18.1. That does not mean "safe." To avoid running an old cached npx version, use npx repomix@latest. The advisory summaries come from the GitHub security advisories page.

Is Repomix free?

Yes. Repomix is MIT-licensed open source; the documentation mentions no account, subscription or usage limit. Donations are only requested through GitHub Sponsors. The AI service you upload the output to has its own plan and limits. Prices are in US dollars.

Common problems and fixes

What's happening	What to do
npx repomix throws an error	Use Node.js 22.0.0 or later.
A file I want packed is missing from the output	gitignore and built-in patterns are applied; if needed, use the --no-gitignore and --no-default-patterns flags.
The output exceeds the assistant's upload limit	Shrink it with --split-output 1mb, --compress or --include.
Reported by users After --split-output, old parts get mixed into the new output	Open bug (#1920); delete the parts before running.
Reported by users With --mcp --verbose, the MCP client receives a broken response	Open bug (#1866); don't use --verbose with MCP.

How do you uninstall Repomix?

Global install: npm uninstall -g repomix or brew uninstall repomix (the package managers' standard commands; not stated in the official documentation).
MCP: In Claude Code, claude mcp remove repomix; in other clients, delete the entry from the configuration file.
Plugins: Remove repomix-mcp, repomix-commands and repomix-explorer from the /plugin menu.
Outputs: Delete the repomix-output files and the folder created by --skill-generate manually.

Frequently asked questions

What is Repomix?

It is an open-source command-line tool that packs a code repository into a single file to give to AI. It outputs the file contents, the directory tree and the token count in one file.

Is Repomix free?

Yes, it is MIT-licensed open source; no account or key is needed. The AI service you upload the pack to has its own plan and limits.

Does Repomix remove my secrets, and is it safe?

It uses Secretlint to remove content matching known credential formats from the output, but there may be secrets it misses; the official documentation says to review the output before sharing it. There is no safety stamp, and 5 security advisories have been published in the past, all fixed in 1.18.1 or earlier.

Does my code go to Repomix's servers?

Not with the CLI: the privacy page states that the CLI collects no user data or telemetry. If you upload files to the repomix.com website, they are kept on the server temporarily for processing and then deleted; the site uses Google Analytics.

How do I add Repomix to Claude Code as MCP?

Run claude mcp add repomix -- npx -y repomix --mcp in the terminal. Alternatively, you can install the official plugins with plugin marketplace add yamadashy/repomix. By default, MCP can read every readable path; the sandbox option limits it to a single folder.

Which Node version is required?

Node.js 22.0.0 or later. It can also be installed with Docker or Homebrew.

Related guides

Sources

Not clear in the official sources: Whether the plugin folders contain hooks (not stated in the official sources) · permissions of the browser extensions · how much of the site's documentation is in Turkish · Turkish language and local pricing details. Each is covered in the relevant section.