RepoLens MCP reads source files from repositories you explicitly index and stores derived metadata in a local SQLite database. It does not send repository content to a hosted service.
The default walker ignores common generated, binary, dependency, cache, and .repolens directories. You should still review results from:
repolens-mcp architecture
repolens-mcp search secret
repolens-mcp search api_keybefore committing any generated memory artifacts.
Open a private security advisory or contact the maintainer if you find a vulnerability involving secret exposure, unsafe file traversal, or MCP tool behavior.