This release moves the MCP server to SDK v2 with live progress and cancellation, makes --compress output far more accurate, and brings a big round of bug fixes from first-time contributors!
What's New 🚀
MCP Server on SDK v2 and the 2026-07-28 Protocol (#1952, #1954)
The MCP server now runs on the MCP TypeScript SDK v2. Clients that support the 2026-07-28 protocol negotiate it automatically, and existing clients work as before.
- The server exits cleanly when the client closes stdin, so no
repomix --mcpprocesses are left behind. - The install pulls in about half as many packages (171 to 84), since the v1 SDK brought HTTP transport dependencies such as Express that the stdio-only server never used.
For client authors: tool schemas now declare JSON Schema 2020-12 (bodies unchanged), and validation errors no longer start with MCP error -32602: .
MCP: Progress and Cancellation for Long-Running Packs (#1955, #1958)
pack_codebase, pack_remote_repository and generate_skill now send notifications/progress when the client passes a progressToken, so long packs show live status, and clients that reset their timeout on progress no longer cut them off. In --sandbox mode, messages carry only the stage name, never a host path.
Cancelling a call or disconnecting now stops the pack and cleans up its partial output.
Improvements ⚡
More Accurate --compress Output (#2003)
Golden tests for every supported language exposed a set of bugs, now fixed:
- Code from function bodies no longer leaks into the output as if it were a declaration.
- Duplicate lines are removed.
- Declarations that were silently dropped are kept, such as C/C++
typedefand#define, C# and Java fields, Rust struct fields, Rubyattr_*calls and CSS at-rules.
Output changes for C, C++, C#, CSS, Dart, Go, Java, JavaScript/TypeScript, Ruby, Rust, Swift and Vue. If you rely on --compress in a pipeline, expect a diff from v1.18.
Skill Generation: Better Tech-Stack Detection (#1995)
--skill-generate now reads dependencies from Gradle Kotlin DSL (build.gradle.kts) and from the PEP 621 and Poetry forms of pyproject.toml.
Warning When a Remote URL Path Is Ignored (#1980, #1984, #433)
A URL like https://github.com/owner/repo/tree/main/src/shared packed the whole repository and silently dropped the path. Repomix now warns and suggests an --include pattern:
The path "src/shared" in the remote URL is ignored, and the whole repository will be packed.
To pack only that path, add: --include "src/shared/**"
Bug Fixes 🐛
Ignore Patterns Ending in a Wildcard Now Exclude Files (#1963, #1876, #320)
Patterns such as **/npm-debug.log* and **/repomix-output.* only excluded directory contents, so files like npm-debug.log.1 and docs/repomix-output.xml slipped into the output. They are now excluded. Nothing that was excluded before becomes included.
.git/info/exclude Follows Git's Matching Rules (#1871, #1870)
A slash-free pattern such as secret.txt now matches at any depth, as in Git, so sub/secret.txt is no longer packed.
Special thanks to @sxh313 for this contribution! 🎉
Negated Custom Ignore Patterns No Longer Invert (#1975, #400)
!main.ts in ignore.customPatterns or --ignore excluded main.ts instead of re-including it. Negated patterns are now skipped with a warning until proper support lands (#400).
Split Output Files No Longer Packed into the Next Run (#1921, #1920)
With --split-output, files like repomix-output.1.xml from a previous run are no longer picked up as input.
Special thanks to @lorenzozanee for their first contribution! 🎉
--remove-comments Keeps URLs in CSS, SCSS, Less, Vue and Svelte (#1912, #1965, #1911)
url(http://example.com/logo.png) was cut to url(http: because // was treated as a comment. Each language now uses its own comment rules, and Vue and Svelte files are handled per <script>, <style> and markup section.
Special thanks to @plox-sumit for their first contribution! 🎉
Non-ASCII File Names in Git Logs and Diffs (#1940, #1979)
Names like 日本語.txt no longer appear as "\346\227\245..." in git logs and diffs, and output.git.sortByChanges now sorts these files correctly.
Special thanks to @feiiiiii5 for their first contribution! 🎉
--token-count-tree 0 Shows the Full Tree (#1941)
It printed nothing before; it now shows every file.
Special thanks to @feiiiiii5 for this contribution! 🎉
Nested --stdin Paths on Windows (#1922)
Piping paths such as src/(routes)/page[1].ts into repomix --stdin on Windows packed only root-level files. Nested paths now match.
Special thanks to @lux-liang for their first contribution! 🎉
Fatal Errors Visible Under --quiet and --stdout (#1875, #1874)
A failed pack under --quiet or --stdout exited with code 1 and printed nothing. The error now goes to stderr.
Special thanks to @sxh313 for this contribution! 🎉
MCP Server Fixes (#1867, #1866, #1865, #1864, #1869, #1868)
--mcp --verboseno longer writes diagnostics to stdout, where clients read them as protocol frames. (#1867)- Error logging is no longer silenced for the rest of the session after a
generate_skillorpack_remote_repositorycall. (#1865) grep_repomix_outputnow formats context likegrep -Cand handles very large outputs. (#1869)
Special thanks to @sxh313 for their first contribution! 🎉
Security Hardening 🔒
MCP pack_codebase Always Runs the Secret Scan (#1960)
A repomix.config.json in the packed directory could turn off the secret scan for MCP packs with security.enableSecurityCheck: false. The scan now always runs for MCP packs; plain CLI runs still follow the config file.
Documentation 📚
The MCP docs now state that without --sandbox, pack_codebase trusts the repomix.config.* in the directory it packs, just like running the CLI there. Use --sandbox when your assistant may pack untrusted directories, such as cloned third-party repositories. (#1961)
See MCP Server: Sandbox Mode and Why a config file is code.
How to Update
npm update -g repomixAs always, if you have any issues or suggestions, please let us know on GitHub issues or our Discord community.