📦 Repomix is a powerful tool that packs your entire repository into a single, AI-friendly file. Perfect for when you need to feed your codebase to Large Language Models (LLMs) or other AI tools like Claude, ChatGPT, DeepSeek, Perplexity, Gemini, Gemma, Llama, Grok, and more.
This report summarizes scanner evidence for yamadashy/repomix, a TypeScript project with 29,098 GitHub stars. SynthScan examined 176,417 lines of code across 1107 source files, recording 114 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 1.1 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 91 finding(s).
Are imports declared and package/API names verified? 22 finding(s).
Are wrappers, guards, and repeated structures necessary? 16 finding(s).
Which changes need focused human review? 114 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 114 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/core/treeSitter/parseFile.dart.test.ts | 18 | print('Hello, $name!'); | CODE |
| HIGH | tests/core/treeSitter/parseFile.dart.test.ts | 147 | print('walking'); | CODE |
| HIGH | tests/core/treeSitter/parseFile.dart.test.ts | 162 | print('nickname is $value'); | CODE |
| HIGH | tests/core/treeSitter/parseFile.swift.test.ts | 42 | print("Circle deinitialized") | CODE |
| HIGH | tests/core/treeSitter/parseFile.swift.test.ts | 92 | print("Total area: \\(totalArea)") | CODE |
| HIGH | tests/core/file/fileManipulate.test.ts | 311 | return True | CODE |
| HIGH | tests/core/file/fileManipulate.test.ts | 323 | return True | CODE |
| HIGH | tests/core/file/fileManipulate.test.ts | 360 | return True | STRING |
| HIGH | tests/core/file/fileManipulate.test.ts | 369 | return True | STRING |
| HIGH | tests/core/file/fileManipulate.test.ts | 381 | return True | STRING |
| HIGH | tests/core/file/fileManipulate.test.ts | 389 | return True | STRING |
| HIGH | tests/core/file/fileManipulate.test.ts | 423 | return True | STRING |
| HIGH | tests/core/file/fileManipulate.test.ts | 435 | return True | STRING |
| HIGH | tests/core/file/fileManipulate.test.ts | 598 | return True | STRING |
| HIGH | tests/core/file/fileManipulate.test.ts | 607 | return True | STRING |
| HIGH | tests/core/file/fileManipulate.test.ts | 750 | print('Hello'); | CODE |
| HIGH | tests/core/file/fileManipulate.test.ts | 758 | print('Hello'); | CODE |
| HIGH | tests/core/file/fileRead.test.ts | 38 | print("Hello, World!") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | website/server/tests/packEventSchema.test.ts | 1 | import * as v from 'valibot'; | COMMENT |
| LOW | …server/tests/processZipFile.gitConfigExecution.test.ts | 1 | import { execFileSync } from 'node:child_process'; | COMMENT |
| LOW | website/server/src/middlewares/turnstile.ts | 41 | isProduction: () => boolean; | COMMENT |
| LOW | website/server/src/middlewares/turnstile.ts | 61 | // - siteverify success: false → 403 with `outcome: turnstile_failed`. | COMMENT |
| LOW | website/server/src/utils/clientInfo.ts | 41 | COMMENT | |
| LOW | website/server/src/actions/packEventSchema.ts | 1 | import * as v from 'valibot'; | COMMENT |
| LOW | website/client/composables/useTurnstile.ts | 1 | import { onBeforeUnmount, ref } from 'vue'; | COMMENT |
| LOW | website/client/composables/useTurnstile.ts | 41 | // copy and the timeout/callback closures verify it before mutating shared | COMMENT |
| LOW | website/client/composables/useTurnstile.ts | 101 | pendingReject(new Error(`Turnstile error: ${errorCode}`)); | COMMENT |
| LOW | website/client/composables/turnstileSubmit.ts | 1 | // Helpers for translating Turnstile token-acquisition outcomes into the | COMMENT |
| LOW | website/client/composables/usePreMintDebounce.ts | 1 | import { onBeforeUnmount, type Ref, watch } from 'vue'; | COMMENT |
| LOW | website/client/composables/useTurnstileTokenCache.ts | 1 | // Token cache for Cloudflare Turnstile. Decoupled from widget lifecycle so | COMMENT |
| LOW | website/client/composables/useTurnstileScript.ts | 21 | size?: 'normal' | 'compact' | 'flexible'; | COMMENT |
| LOW | website/client/.vitepress/config.ts | 1 | import { defineConfig } from 'vitepress'; | COMMENT |
| LOW | website/client/utils/botDetect.ts | 1 | import { isbot } from 'isbot'; | COMMENT |
| LOW | website/client/components/api/client.ts | 61 | } | COMMENT |
| LOW | tests/core/file/dotIgnoreSpec.test.ts | 1 | import fs from 'node:fs/promises'; | COMMENT |
| LOW | tests/core/file/fileSearch.gitignoreBackslash.test.ts | 1 | import fs from 'node:fs/promises'; | COMMENT |
| LOW | tests/core/file/emptyDirectorySpec.test.ts | 1 | import fs from 'node:fs/promises'; | COMMENT |
| LOW | tests/core/file/binaryDetectionSpec.test.ts | 1 | import fs from 'node:fs/promises'; | COMMENT |
| LOW | tests/core/file/processOrderSpec.test.ts | 1 | import { describe, expect, it, vi } from 'vitest'; | COMMENT |
| LOW | tests/core/file/processOrderSpec.test.ts | 61 | output: { showLineNumbers: true }, | COMMENT |
| LOW | tests/core/file/fileRead.test.ts | 141 | // Regression: prior to the UTF-8-first reorder, certain valid-UTF-8 | COMMENT |
| LOW | tests/core/file/fileSearch.gitignoreSpec.test.ts | 1 | import fs from 'node:fs/promises'; | COMMENT |
| LOW | tests/core/security/securityScanSpec.test.ts | 21 | } from '../../../src/core/security/workers/securityCheckWorker.js'; | COMMENT |
| LOW | tests/core/packager/multiRootSpec.test.ts | 21 | // path via a Map, which silently collapsed entries when the same relative path | COMMENT |
| LOW | tests/testing/vitestSetup.ts | 1 | // Disable the token-count disk cache by default for the entire test suite so | COMMENT |
| LOW | scripts/bench-cores.sh | 1 | #!/bin/bash | COMMENT |
| LOW | .github/workflows/npm-publish.yml | 1 | name: npm-publish | COMMENT |
| LOW | .github/workflows/mcp-registry-publish.yml | 61 | # The registry verifies npm ownership by reading `mcpName` from the | COMMENT |
| LOW | src/core/metrics/tokenCountCache.ts | 221 | * cannot leave a torn JSON file. Caller should await this so newly produced | COMMENT |
| LOW | src/core/file/fileRead.ts | 81 | // This halves the number of I/O operations per file. | COMMENT |
| LOW | src/core/security/workers/securityCheckWorker.ts | 1 | import perf_hooks from 'node:perf_hooks'; | COMMENT |
| LOW | src/core/security/workers/securityCheckWorker.ts | 21 | // of pure profiler bookkeeping per worker with zero functional benefit — | COMMENT |
| LOW | src/core/security/workers/securityCheckWorker.ts | 41 | // other code in the main process that relies on the Node built-in. By | COMMENT |
| LOW | src/core/git/gitMetadataEndpoint.ts | 1 | import { RepomixError } from '../../shared/errorHandle.js'; | COMMENT |
| LOW | src/mcp/tools/packCodebaseTool.ts | 161 | output: outputFilePath, | COMMENT |
| LOW | src/shared/urlRedact.ts | 41 | // each iteration consumes exactly one '@' — so it cannot backtrack quadratically | COMMENT |
| LOW | src/cli/actions/defaultAction.ts | 41 | // the user's own project. A remote clone is a throwaway temp dir whose legacy | COMMENT |
| LOW | src/cli/actions/remoteAction.ts | 181 | // above. runDefaultAction rejects --force without --skill-generate, so | COMMENT |
| LOW | src/cli/prompts/remoteConfigTrustPrompt.ts | 21 | const CONFIG_LINE_PREFIX = '| '; | COMMENT |
| LOW | src/cli/prompts/remoteConfigTrustPrompt.ts | 221 | } | COMMENT |
| LOW | src/cli/prompts/remoteConfigTrustStore.ts | 1 | import { createHash } from 'node:crypto'; | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .agents/clawhub/SKILL.md | 75 | ### Step 1: Pack the Repository | COMMENT |
| LOW | .agents/clawhub/SKILL.md | 93 | ### Step 2: Check Command Output | COMMENT |
| LOW | .agents/clawhub/SKILL.md | 103 | ### Step 3: Analyze the Output | COMMENT |
| LOW | .agents/clawhub/SKILL.md | 126 | ### Step 4: Report Findings | COMMENT |
| LOW | .claude/plugins/repomix-explorer/agents/explorer.md | 76 | ### Step 1: Pack the Repository | COMMENT |
| LOW | .claude/plugins/repomix-explorer/agents/explorer.md | 116 | ### Step 2: Check Command Output | COMMENT |
| LOW | .claude/plugins/repomix-explorer/agents/explorer.md | 126 | ### Step 3: Analyze the Output File | COMMENT |
| LOW | .claude/plugins/repomix-explorer/agents/explorer.md | 144 | ### Step 4: Provide Insights | COMMENT |
| LOW | skills/repomix-explorer/SKILL.md | 66 | ### Step 1: Pack the Repository | COMMENT |
| LOW | skills/repomix-explorer/SKILL.md | 106 | ### Step 2: Check Command Output | COMMENT |
| LOW | skills/repomix-explorer/SKILL.md | 116 | ### Step 3: Analyze the Output File | COMMENT |
| LOW | skills/repomix-explorer/SKILL.md | 134 | ### Step 4: Provide Insights | COMMENT |
| LOW | src/core/skill/packSkill.ts | 218 | // Step 1: Generate skill references (summary, structure, files, tech-stacks) | COMMENT |
| LOW | src/core/skill/packSkill.ts | 237 | // Step 2: Calculate metrics from files section to get accurate token count | COMMENT |
| LOW | src/core/skill/packSkill.ts | 251 | // Step 3: Generate SKILL.md with accurate token count | COMMENT |
| LOW⚡ | src/cli/actions/initAction.ts | 23 | // Step 1: Ask if user wants to create a config file | COMMENT |
| LOW⚡ | src/cli/actions/initAction.ts | 26 | // Step 2: Ask if user wants to create a .repomixignore file | COMMENT |
| LOW | src/cli/prompts/skillPrompts.ts | 53 | // Step 1: Ask for skill location | COMMENT |
| LOW | src/cli/prompts/skillPrompts.ts | 77 | // Step 2: Check if directory exists and ask for overwrite | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | website/server/src/middlewares/cloudflareGuard.ts | 15 | export function cloudflareGuardMiddleware() { | CODE |
| LOW | website/server/src/middlewares/cloudflareGuard.ts | 16 | return async function cloudflareGuardMiddleware(c: Context, next: Next) { | CODE |
| LOW | website/client/composables/useTurnstileTokenCache.ts | 34 | export function createTurnstileTokenCache(mint: () => Promise<string>): TurnstileTokenCache { | CODE |
| LOW | website/client/components/Home/TryIt.vue | 201 | function updateUrlFromCurrentState() { | CODE |
| LOW | website/client/components/Home/TryItPackOptions.vue | 43 | function handleIncludePatternsUpdate(patterns: string) { | CODE |
| LOW | website/client/components/Home/TryItPackOptions.vue | 49 | function handleIgnorePatternsUpdate(patterns: string) { | CODE |
| LOW⚡ | website/client/components/Home/TryItPackOptions.vue | 61 | function handleDirectoryStructureToggle(enabled: boolean) { | CODE |
| LOW⚡ | website/client/components/Home/TryItPackOptions.vue | 67 | function handleRemoveCommentsToggle(enabled: boolean) { | CODE |
| LOW⚡ | website/client/components/Home/TryItPackOptions.vue | 73 | function handleRemoveEmptyLinesToggle(enabled: boolean) { | CODE |
| LOW⚡ | website/client/components/Home/TryItPackOptions.vue | 79 | function handleShowLineNumbersToggle(enabled: boolean) { | CODE |
| LOW⚡ | website/client/components/Home/TryItPackOptions.vue | 85 | function handleOutputParsableToggle(enabled: boolean) { | CODE |
| LOW | …src/vi/guide/development/using-repomix-as-a-library.md | 228 | async function processAndModifyOutput() { | CODE |
| LOW | browser/entrypoints/content.ts | 24 | function isRepomixButtonAlreadyExists(): boolean { | CODE |
| LOW | src/core/treeSitter/languageConfig.ts | 220 | export function getLanguageConfigByExtension(extension: string): LanguageConfig | undefined { | CODE |
| LOW | src/mcp/tools/attachPackedOutputTool.ts | 183 | function extractFileMetricsMarkdown(content: string): { filePaths: string[]; fileCharCounts: Record<string, number> } { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/core/skill/packSkill.ts | 218 | // Step 1: Generate skill references (summary, structure, files, tech-stacks) | COMMENT |
| LOW | src/core/skill/packSkill.ts | 237 | // Step 2: Calculate metrics from files section to get accurate token count | COMMENT |
| LOW | src/core/skill/packSkill.ts | 251 | // Step 3: Generate SKILL.md with accurate token count | COMMENT |
| LOW⚡ | src/cli/actions/initAction.ts | 23 | // Step 1: Ask if user wants to create a config file | COMMENT |
| LOW⚡ | src/cli/actions/initAction.ts | 26 | // Step 2: Ask if user wants to create a .repomixignore file | COMMENT |
| LOW | src/cli/prompts/skillPrompts.ts | 53 | // Step 1: Ask for skill location | COMMENT |
| LOW | src/cli/prompts/skillPrompts.ts | 77 | // Step 2: Check if directory exists and ask for overwrite | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/benchmark.yml | 116 | # Run comprehensive memory test | COMMENT |
| MEDIUM | src/core/git/gitLogHandle.ts | 7 | // Null character used as record separator in git log output for robust parsing | COMMENT |
| MEDIUM | src/core/git/gitLogHandle.ts | 33 | // This is more robust than splitting by double newlines, as commit messages may contain newlines | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/core/treeSitter/parseFile.ruby.test.ts | 38 | # Create a module method | COMMENT |
| MEDIUM | tests/core/treeSitter/parseFile.ruby.test.ts | 48 | # Create a user and greet | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .agents/agents/reviewer-code-quality.md | 82 | - **Do not flag**: Formatting, style, import ordering, naming conventions (unless genuinely misleading), TODOs (unless i | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | website/client/src/hi/guide/custom-instructions.md | 136 | { "id": 1, "name": "John Doe" }, | CODE |
| LOW | tests/core/file/emptyDirectorySpec.test.ts | 36 | await fs.mkdir(path.join(tmpDir, 'docs', 'placeholder'), { recursive: true }); | CODE |
| LOW | tests/core/file/emptyDirectorySpec.test.ts | 53 | await fs.mkdir(path.join(tmpDir, 'docs', 'placeholder'), { recursive: true }); | CODE |
| LOW | tests/mcp/tools/grepRepomixOutputTool.test.ts | 286 | expect(matches[0].line).toBe('user@example.com'); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/mcp/tools/sandbox.contract.test.ts | 28 | // ── escape variants the guard MUST reject (host-aware) ──────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/bench-cores.sh | 5 | # Usage: | COMMENT |