Repomix packs a repository into one file: what the pack leaves out

Five routes to the same binary, and only one of them re-resolves the version

The quickest path needs no install at all, running straight from a project directory:

npx repomix@latest

For repeated use, four global installers are offered:

# Install using npm
npm install -g repomix

# Alternatively using yarn
yarn global add repomix

# Alternatively using bun
bun add -g repomix

# Alternatively using Homebrew (macOS/Linux)
brew install repomix

# Then run in any project directory
repomix

Each global route writes a permanent repomix command that stays on whatever version you installed, while the npx path re-resolves the latest release on every run. The container route states its own contract explicitly: the Dockerfile starts FROM node:22-slim, installs git and ca-certificates, runs npm ci together with npm link and npm prune --omit=dev, and then runs repomix --version and repomix --help as build steps. A broken binary therefore fails the image build instead of waiting to surprise you on the first pack.

The default artifact is one file named repomix-output.xml

Running the CLI with no arguments writes repomix-output.xml into the current directory, and that filename is the only default output the quick start names. The file is built to travel straight into an assistant with a short prompt:

This file contains all the files in the repository combined into one.
I want to refactor the code, so please review it first.

The browser version at repomix.com makes output format a choice, offering XML, Markdown, or Plain Text, along with an instant token count estimate before you pack. So the .xml filename is a CLI default rather than a fixed format.

Include and ignore take glob patterns, and the project's own scripts use plain names

What lands in the pack is decided by two flags. You can point the tool at a directory:

repomix path/to/directory

name files with glob patterns:

repomix --include "src/**/*.ts,**/*.md"

or drop paths entirely:

repomix --ignore "**/*.log,tmp/"

The repository's own package.json scripts show the same flag in a simpler form, passing one --include argument with comma separated targets such as 'src,tests' and 'website'. Remote repositories work through a separate flag:

repomix --remote https://github.com/yamadashy/repomix

# You can also use GitHub shorthand:
repomix --remote yamadashy/repom

Secretlint removes files matching known credential formats, and nothing beyond them

Credential handling leans on Secretlint, and its reach is narrower than the word security implies. Repomix uses Secretlint to detect files matching known credential formats and leave them out of the output, and the repository carries both a .secretlintrc.json at the root and a lint script that runs secretlint across the tree with .gitignore as its ignore file. That covers files whose contents match patterns Secretlint already knows about. A token pasted into a comment, a key inside a format with no matching rule, or a secret sitting in a path the patterns never reach still gets written into repomix-output.xml, because the project claims detection of known formats only. The pack then travels to whichever assistant you send it to, so the gap belongs to you to close.

--compress preserves structure and discards the bodies with it

The compression option runs Tree-sitter to extract key code elements, reducing token count while preserving structure. Structure is precisely the boundary. Once code is reduced to its key elements, an assistant working from the pack is reasoning over a skeleton, and any claim it makes about behavior, error paths, or a specific changed line has to come from something other than the code you removed. The practical move is to pack twice, once plain and once compressed, and compare what each version of the assistant tells you about the same file.

Ignore rules decide what the model never sees

Three ignore files steer the pack automatically: .gitignore, .ignore, and .repomixignore, and Repomix respects all of them. That is what keeps whatever your repository already treats as noise out of the output, and it is also the quietest way to lose context. The contents of repomix-output.xml are therefore also decided by ignore files you may not remember writing. Anything excluded there is simply absent, including files the project needs, and the model has no way to signal that they were never offered. Check which ignore rule drops a file before you accept an answer about a file you know exists.

Token counts are reported, but nothing splits the pack

Counting is a first-class output: Repomix provides token counts for each file and for the entire repository, aimed at LLM context limits, and the website adds an instant estimate before a single file is generated. Read the total before you paste, and remember what a count does not tell you: a file that fits the window on its own says nothing about what is left once the assistant has spent room on your prompt and the conversation so far.

The MCP name, browser add-ons, and a VSCode runner maintained by someone else

Outside the terminal there are three more entry points, and they carry different weight. The package declares an MCP server name of io.github.yamadashy/repomix, the Chrome extension and Firefox add-on add a Repomix button to GitHub repository pages, and the VSCode extension called Repomix Runner is community-maintained by massdo and reads your existing repomix.config.json. Two consequences follow. The browser add-ons work from GitHub repository pages, so they cover only repositories you can already open in a browser window, which leaves local and private work to the CLI. And Repomix Runner is a separate project, so its config handling and output naming can drift from the CLI's behavior with no change on this side. The CLI itself stays busy: the last push landed 2026-11-01 and v1.18.1 shipped 2026-09-21. For Python and data science work, the project points you at Gitingest, which it calls better suited to those workflows.

Editorial conclusion

Repomix fits quick audits of a repository and the moment right before you paste a codebase into a prompt, and its commit cadence supports relying on the CLI: the last push landed 2026-11-01, with v1.18.1 released 2026-09-21 after v1.18.0 on 2026-08-08. Before trusting a pack, open repomix-output.xml and confirm your ignore rules did not drop a file the answer depends on, compare the total token count against your model's context limit, and scan the output yourself, because Secretlint only removes files matching known credential formats. For line-accurate review work, stay in your editor, since --compress keeps key code elements rather than the full source.

Frequently asked questions

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes