What it is
Repomix turns a codebase into a single file you can paste into a chat model or hand to an agent. It walks your repo, respects .gitignore, and writes every file plus a directory tree into one XML, Markdown, JSON or plain-text output, with token counts per file and for the whole repo.
It runs as a CLI (npx, npm, Homebrew or Docker, Node.js 22 or newer), a web page where you paste a GitHub URL or upload a zip, a Chrome extension, a Node.js library, a GitHub Action and an MCP server. Kazuki Yamada maintains it under the MIT licence, funded by sponsors.
Our review
Repomix is the standard way to turn a repository into a single prompt, and its security record in 2026 is the thing to read before installing it. The project has about 29,000 stars and shipped v1.18.1 on 21 September 2026. That release fixed a high-severity advisory in which packing a directory with a crafted .git folder could run git config helpers; a May 2026 advisory fixed command injection through --remote-branch. Both are patched, but they show that pointing a packer at untrusted repos is not a neutral act.
The defensive features are otherwise thoughtful. Secretlint drops files that match known credential formats before they reach your output. Config files inside remote repositories are ignored unless you pass --remote-trust-config. The MCP server has a --sandbox flag that confines its file tools to one directory, though an August 2026 advisory found earlier MCP protections had been claimed but not implemented.
Tree-sitter compression is the feature that changes what fits. It keeps imports, classes and signatures and drops function bodies, which the site says cuts tokens by about 70%. Per-glob patterns let you keep full source for the files you are asking about and compress the rest, which is a better compromise than compressing everything.
The ceiling is the approach. Even compressed, a large monorepo will not fit, and agents such as Claude Code or Codex already read files on demand, so a dump duplicates work they do better. Search tools like grepai, or Sourcegraph at company scale, handle the big-repo case; Repomix remains the quickest route when a chat window, not an agent, is doing the reading.
Where it earns its place
A freelance developer using Claude or ChatGPT in the browser
Get a review of a 15,000-line side project in one conversation
Run `npx repomix --compress`, check the token count against the model's window and paste the XML. Free, takes under a minute, and Secretlint keeps a stray .env out of the chat.
A platform team at a 200-engineer company
Give an internal assistant a nightly snapshot of each service repo
A GitHub Action packs each repo with --split-output into chunks the assistant can load. No licence cost; the risk is the snapshot going stale, and repos from outside the company should be packed in a sandbox.
An engineering manager onboarding contractors
Hand over an architecture overview without granting repo access
Pack with compression so the output shows modules, classes and signatures but not implementation, and share the file. It costs nothing and exposes less code than a full clone, though it is still source.
Before you commit
- Setup
- `npx repomix@latest` in a repo writes repomix-output.xml in seconds; needs Node.js 22+. Homebrew, Docker and the website at repomix.com need no Node install.
- Integrations
- XML, Markdown, JSON and plain-text output; --remote for any GitHub URL, branch or commit; --mcp runs it as an MCP server; Node.js library, GitHub Action and Chrome extension.
- Data and privacy
- The CLI collects no telemetry and only goes online for --remote and installs, per its privacy policy. The website deletes uploads after processing and uses Google Analytics. Five GitHub security advisories in 2026, the latest fixed in v1.18.1.
- Cost at scale
- No paid edition. The real cost is model tokens: a packed repo is sent in full on every prompt, so compression and include/ignore patterns are what keep spend down.
- Limits
- No fixed size limit, but memory and the model's context window cap it; the website is meant for small public repos; watch mode cannot be combined with --remote or --split-output.
What's good
- Secretlint check leaves out files that look like credentials
- Tree-sitter compression, about 70% fewer tokens per the site
- Remote repo configs untrusted by default
- CLI, web, extension, library, GitHub Action and MCP server
What's not
- Five security advisories in 2026, two rated high
- Whole-repo dumps do not scale to large codebases
- Compressed output drops function bodies the model may need
- Redundant when your agent already reads files itself
Best for
Developers who want to hand a small or medium repo to a chat model in one file.
Alternatives
Repomix: common questions
- Is Repomix worth it?
- Repomix packs a small repo into one prompt better than anything else, and becomes the wrong tool the moment the repo outgrows the context window. We rate it 4.3 out of 5.
- How much does Repomix cost?
- Free and open source (MIT). The web version at repomix.com is free; there is no paid tier.
- What are the downsides of Repomix?
- Five security advisories in 2026, two rated high; whole-repo dumps do not scale to large codebases; compressed output drops function bodies the model may need; redundant when your agent already reads files itself.
- Who is Repomix best for?
- Developers who want to hand a small or medium repo to a chat model in one file.
- How much does Repomix cost for a team or in production?
- No paid edition. The real cost is model tokens: a packed repo is sent in full on every prompt, so compression and include/ignore patterns are what keep spend down.
- Is Repomix safe for company data?
- The CLI collects no telemetry and only goes online for --remote and installs, per its privacy policy. The website deletes uploads after processing and uses Google Analytics. Five GitHub security advisories in 2026, the latest fixed in v1.18.1.
- What are the best Repomix alternatives?
- The closest alternatives we have reviewed are code2prompt and grepai.
Answers checked Oct 23, 2026.
Make Repomix? Show this rating on your site
