Repomix

Name: Repomix
Author: yamadashy

repomix · by yamadashy

📦 Repomix is a powerful tool that packs your entire repository into a single, AI-friendly file. Perfect for when you need to feed your codebase to Large Language Models (LLMs) or other AI tools like Claude, ChatGPT, DeepSeek, Perplexity, Gemini, Gemma, Llama, Grok, and more.

26.7k GitHub npm

No known CVEs

MIT license

Actively maintained

Last commit 2d ago

Works with most clients

Transport: stdio, sse, http

0 tools

Grade F

Edit this pageView history

Developer Tools

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "repomix-docker": {
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/yamadashy/repomix",
        "--mcp"
      ],
      "command": "docker"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/repomix)](https://mcppedia.org/s/repomix)

Read me

What Repomix does

Available for MacOS, Linux, & Windows

Test This Server

This server supports HTTP transport. Be the first to test it — help the community know if it works.

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

53/100across 5 weighted dimensions

How we score →

0255075100

−47

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

2 fixed

CVE-2026-49988info · fixed

repomix: attach_packed_output can bypass file-read secret scanning for supported local files

# `attach_packed_output` can register arbitrary `.json/.txt/.md/.xml` files and bypass the MCP file-read safety check ## Summary Repomix's MCP server exposes a normal `file_system_read_file` tool that reads absolute paths only after running the project's secret check. However, the `attach_packed_output` plus `read_repomix_output` flow can read arbitrary local `.json`, `.txt`, `.md`, or `.xml` files without the same safety check and without verifying that the file is actually a Repomix packed o

Affected: >= 0Fixed in 1.14.1source →

CVE-2026-49987high · fixedCVSS 8.8

repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection

### Vulnerability Metadata | Field | Detail | | --- | --- | | **Affected Component** | `src/core/git/gitCommand.ts` (`execGitShallowClone`) | | **Impact** | Arbitrary Command Execution / Security Control Bypass | ### Summary The `--remote-branch` CLI option in `repomix` is vulnerable to argument injection. User-supplied input is passed directly to `git fetch` and `git checkout` subprocesses via `child_process.execFileAsync` without sanitization, `--` delimiters, or validation. An attacker ca

Affected: >= 0Fixed in 1.14.1source →

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Repomix safe to use?: Repomix has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.
How do I install Repomix?: Repomix supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with Repomix?: Repomix is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is Repomix actively maintained?: Repomix is actively maintained — last commit was 2 days ago. It has 26,744 GitHub stars.

Similar servers

Others in developer-tools

View all →

XcodeBuildMCP97

A Model Context Protocol (MCP) server and CLI that provides tools for agent use when working on iOS and macOS projects.

6.0k 2

XcodeBuildMCP97

XcodeBuildMCP provides tools for Xcode project management, simulator management, and app utilities.

6.0k 1

Supabase MCP Server97

Manage Supabase projects — databases, auth, storage, and edge functions

2.8k 4

Jscpd97

Copy/paste detector for programming source code, supports 223 formats. AI-ready with token-efficient reporter, skill and MCP server.

5.8k 1

MCP Security Weekly

Get CVE alerts and security updates for Repomix and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

{ "mcpServers": { "repomix-docker": { "args": [ "run", "-i", "--rm", "ghcr.io/yamadashy/repomix", "--mcp" ], "command": "docker" } } }

Frequently Asked Questions

Is Repomix safe to use?

Repomix has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.

How do I install Repomix?

Repomix supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What AI clients work with Repomix?

Repomix is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is Repomix actively maintained?

Repomix is actively maintained — last commit was 2 days ago. It has 26,744 GitHub stars.

Repomix

Install in your client