This release introduces sandbox mode for the MCP server, confining it to a single workspace directory, along with a set of security hardening changes across the MCP tool surface and remote repository processing!
What's New 🚀
MCP Sandbox Mode (#1753, #1754)
The MCP server can now be confined to a single workspace directory with the --sandbox flag:
# Confine to the current working directory
repomix --mcp --sandbox
# Confine to a specific directory
repomix --mcp --sandbox path/to/projectBy default the MCP server can read any path the host user can, which is convenient for a trusted local assistant but too broad when the server is exposed to an untrusted client or agent, such as when embedding Repomix in a hosted application. In sandbox mode:
- Every path is relative to the workspace root. Absolute paths,
~,.., and Windows drive/UNC paths are refused, and paths that resolve outside the root (including through symlinks) are dropped. - Results and error messages are virtualized, so host paths are never exposed.
- Only the read-only, root-confined tools are registered:
pack_codebase,read_repomix_output,grep_repomix_output,file_system_read_file, andfile_system_read_directory. Remote packing, skill generation, and attaching external outputs are disabled.
This is an application-level confinement of the tool surface, not an OS-level sandbox: when hosting the server for untrusted clients, still run it under your platform's usual isolation (containers, dedicated users).
See MCP Server – Sandbox Mode for details.
Special thanks to @huy-trn for designing and implementing this feature. Great to have a long-time contributor back! 🎉
Security Hardening 🔒
MCP File System Tools Are Now Sandbox-Only
The file_system_read_file and file_system_read_directory tools are now registered only in sandbox mode. Outside --sandbox they could read any path the process can, while their built-in Secretlint scan was presented as more protection than it provides: it recognizes known secret formats in file content, and nothing else. In sandbox mode the workspace root gives these tools a real access boundary, with the secret scan kept as an additional heuristic safeguard.
If your MCP setup relied on these two tools, add --sandbox [dir] to the server arguments to keep using them, confined to that workspace.
Tool descriptions and documentation have also been reworded across the board to describe the Secretlint scan as what it is: a best-effort content heuristic, not an access boundary.
See the security advisory for details. Thanks to @rafaelfiguereod-stack for the report! 🙏
https://github.com/yamadashy/repomix/security/advisories/GHSA-rpmv-562j-qxrv
Credentials in Repository URLs Are Redacted Before Logging
Remote URLs are routinely written with credentials inline (https://<token>@github.com/owner/repo.git), especially in CI. Repomix previously echoed such URLs as-is into console output, trace logs, error messages (git repeats the full command line in its failure output), and the MCP pack_remote_repository response, persisting the credential in terminal scrollback, CI build logs, and log aggregation systems. All of these paths now redact userinfo credentials and known credential query parameters (token, private_token, access_token, and similar) before the URL is written anywhere.
See the security advisory for details. Thanks to @kakashi-kx for the report! 🙏
https://github.com/yamadashy/repomix/security/advisories/GHSA-w8cw-mgw9-74h7
Cloud Metadata Endpoints Are Refused as Clone Targets
Remote packing now refuses to clone from cloud instance metadata endpoints (169.254.0.0/16, fd00:ec2::254, 100.100.100.200, metadata.google.internal), which serve credentials and host no git repository. Through the MCP server an AI agent chooses the URL, so an injected instruction could otherwise aim a clone at an address the user never asked for. Private networks (RFC1918) remain allowed, since cloning from self-hosted git servers is normal.
How to Update
npm update -g repomixAs always, if you have any issues or suggestions, please let us know on GitHub issues or our Discord community.
