Repomix MCP Server Secret-Scanning Bypass via attach_packed_output/read_repomix_output

Technical Analysis

The Repomix MCP server exposes tools including file_system_read_file, which is protected by a runSecretLint() check and packed-output validation intended to prevent leakage of secrets from local files. The attach_packed_output and read_repomix_output flow, however, allows registering and reading arbitrary .json, .txt, .md, or .xml files through a separate code path that does not invoke runSecretLint() or the packed-output validation logic. An MCP caller (an LLM agent or a malicious/compromised client) can therefore request files outside the intended packing scope and receive their raw contents, including secrets like API keys or tokens, bypassing the security boundary the server was designed to enforce. This crosses the tool-layer trust boundary between the MCP host application and the underlying filesystem, effectively turning a read-scoped tool into an unrestricted file-read primitive.

Affected Systems

Repomix; protocols: MCP

Detection Signatures

• MCP tool calls to attach_packed_output or read_repomix_output referencing files outside expected repository/output directories
• Requests for .json, .txt, .md, or .xml files with paths traversing outside packed-output scope (e.g., ../, absolute paths to home/config directories)
• Absence of runSecretLint log entries correlated with file_system_read_file-equivalent access via these two tools
• Unexpected access to files like .env, credentials.json, or config files through Repomix MCP tool logs

Remediation Steps

1. 1

   Upgrade Repomix

   Update to Repomix version 1.14.1 or later, which fixes the bypass by enforcing runSecretLint() and packed-output validation across all file-read tool flows.

2. 2

   Restrict MCP server file access scope

   Configure the Repomix MCP server to operate within a strictly bounded directory and deny path traversal or absolute path requests regardless of tool entry point.

3. 3

   Audit MCP tool logs

   Review historical logs for attach_packed_output/read_repomix_output calls that accessed files outside the intended repository scope to identify potential secret exposure.

4. 4

   Rotate exposed secrets

   If any sensitive files (e.g., .env, credential stores) were accessible via this flaw prior to patching, rotate any credentials that may have been exposed.

5. 5

   Enforce defense-in-depth secret scanning

   Apply an independent secret-scanning proxy or gateway in front of MCP servers so that all tool outputs are scanned regardless of internal validation gaps.