One packed file gives an AI a controlled view of a repository
Repomix turns a directory or remote Git repository into 1 output containing the file tree, selected source, and instructions for the receiving model. XML is the default, with Markdown, JSON, and plain text available. Include rules, ignore rules, and token budgets keep the result within a chosen scope. A budget breach returns a nonzero status but leaves the generated file available for inspection.
Our sandbox checkout contained 1,178 files, about 65,750 lines of source, and occupied 9.2 MB before installation. Those figures explain why selection matters even for Repomix itself. Sending every fixture and generated asset wastes context. The tool respects Git and project ignore files, then applies explicit patterns. The result is easier to trust when those rules are checked in and reviewed with the build configuration.
MCP v1.18.0 needs sandbox mode around untrusted agents
Repomix v1.18.0 added an MCP sandbox flag after tightening several access paths. Without it, the server can read any path available to its operating-system user. Sandbox mode confines paths to one workspace and removes remote packing, skill generation, and external-output attachment. The release notes call this an application-level boundary, so a hosted service still needs a container, dedicated user, or comparable isolation.
Installing the CLI in our Debian container pulled 371 npm packages and used 299 MB. Local packing needs no model API account, while MCP adds a long-running process and client configuration. A trusted desktop assistant is a reasonable place for the sandbox flag. A shared agent service should restrict the process at the OS level and mount only the repository it may read.
What happened when we ran it
Our sandbox installed Repomix at commit b79ca3b in 22 seconds. The build completed in 9 seconds, then Vitest finished in 32 seconds with 1,813 passed and 0 failed out of 1,813. The run used 3 CPUs, 8 GB of RAM, Node 22, and a fresh unprivileged Debian container with no secrets.
npm audit reported 0 known vulnerabilities across the 371 installed packages. The checkout also had 20 CI workflow files, a Dockerfile, and a tests directory. These results cover repository mechanics, not the factual quality of an AI answer produced from a pack. We did not measure model accuracy, token savings, or response quality. The receiving model and chosen files still decide whether a review is sound.
Compression removes bodies, so exact reviews need full source
The README labels Tree-sitter compression experimental. It keeps declarations and function signatures while replacing implementation bodies. Per-file patterns can mix full content, compressed content, and directory-only entries. That works for architecture questions where declarations matter most. It is a poor fit for debugging an off-by-one error, tracing authentication, or checking cleanup, because an omitted statement may contain the answer.
All 1,813 tests passed in our 32-second run, but that checks Repomix rather than the adequacy of a particular compressed pack. Keep full content for security review and bug diagnosis, or use the MCP search and partial-read tools to fetch exact regions after the first pass. Per-file output patterns can control this by directory, though that setting lives in configuration rather than a dedicated CLI flag.
Local configuration can execute commands
Two configuration features deserve the same caution as an npm script. JavaScript and TypeScript configuration files execute when loaded, and local file processors may run arbitrary commands. Remote configuration is disabled by default. Opting in can show the entry file and pin approval to its contents, but imported files and external processor scripts sit outside that hash. Read unfamiliar configuration before running Repomix in its checkout.
The 0-vulnerability audit from our install does not cover a command placed in input.processors. Secretlint is a content heuristic rather than an access-control system or a promise that every credential shape will be caught. Keep the scan enabled, review the suspicious-file list, and inspect the final pack before sharing it. A clean dependency audit and a clean secret scan answer different questions.
Two open reports affect split and truncated output
Open issue 1815 reproduces a v1.18.0 split-output problem: each part's directory section can show the whole repository even when that part contains only some files. Issue 1819 describes a separate static-analysis finding where base64 truncation can drop all but the last parameter from a data URI. Both reports concern the generated artifact that users hand to another tool.
Our b79ca3b checkout had 1,178 files and passed 1,813 tests, yet those results do not erase later reports against a release or another main-branch commit. If either path matters, compare every part's directory section with its file bodies and check URI prefixes before and after packing. A single full XML file without base64 truncation avoids these specific failure paths.
August 2026 activity makes Repomix easy to trial
GitHub recorded the last push on August 31, 2026, and v1.18.0 was released on August 8. The repository had 28,148 stars and 139 open issues and pull requests when fetched; an issue-only search returned 103 open issues. Recent work included MCP boundary changes and credential redaction. The dates show ongoing maintenance, while the combined open count is not a count of confirmed bugs.
The project backs that activity with 20 CI workflow files and the 1,813 tests that passed in our sandbox. Repomix earns a trial when a concatenation script has become too crude and you need repeatable filters, several formats, or agent-facing search. Its safest form is simple: pack trusted local code, keep the security scan on, and inspect what will leave the machine.