Remotion: Make Videos With React Code or an AI Agent (GitHub, Scanned)

Remotion treats a video as a React app. Each frame is a component rendered at a given time, so animation is ordinary code driven by the frame number, and anything you can build for the web (charts from live data, captions, 3D, maps) can go into an MP4. A studio lets you preview and scrub the timeline, the Player embeds videos in web apps, and renders run on your own machine, in AWS Lambda or a Vercel sandbox for batch jobs that produce thousands of personalised videos.

It has been around since 2020 and has about 62,000 stars, but its recent jump in attention comes from AI agents: Remotion publishes Agent Skills that teach Claude Code, Codex or Cursor its best practices, and prompt-to-video workflows built on it are a steady topic on TikTok and YouTube. It is made by Jonny Burger and a small team. The licence is not standard open source: individuals, non-profits and companies with up to three employees use it free, including commercially, while larger for-profit companies need a paid company licence.

• Repository: github.com/remotion-dev/remotion
• Licence: custom (Other)
• Language: TypeScript. Stars: 61.6K. Forks: 4,755. Last push: Oct 3, 2026.
• Scan: safe, Oct 3, 2026, commit b74a8b8

Who it is for

Developers who want data-driven or templated videos, creators who would rather describe an animation to a coding agent than keyframe it, and teams building video features into a product.

Getting started

1. Create a new project from a template (Node.js required)

npx create-video@latest

2. Add Remotion's Agent Skills for Claude Code, Codex or Cursor

npx skills add remotion-dev/skills

3. Start the studio to preview and render

npm run dev

Rendering uses a headless Chrome and FFmpeg that Remotion downloads and manages for you. Check the licence before using it at a company with more than three employees.

Safety scan

We cloned remotion-dev/remotion at commit b74a8b8 on Oct 3, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• One secret hit in 14,628 files and 1.7 million lines: a Google Maps Embed API key in packages/docs/src/components/GoogleMaps.tsx, a browser key that shows Remotion's Zurich office on the docs site. Embed keys are public by design and meant to be restricted by referrer.
• Three very long lines, all explained: packages/whisper-web/main.js is Emscripten glue with whisper.cpp's WebAssembly inlined as base64 (1.3 million characters), and the two open-in-editor helpers contain a 7,000-character Unicode regular expression for matching file paths. The npm prepare script only points git at the repository's hooks folder.
• 78 committed binaries: the remotion compositor executable plus FFmpeg's libavcodec, libavformat and libavfilter for Linux (glibc and musl), macOS and Windows, a few Windows runtime DLLs, and composer.phar in a PHP example. They are what makes rendering work without installing FFmpeg, and you are trusting Remotion's own builds of them.
• Only the Rust and Go lockfiles were checked: 128 packages with 10 advisories of unknown severity, mostly unmaintained crates and old AWS SDK and golang.org/x versions in the Lambda Go client and its example. The JavaScript packages users install are locked in bun.lock, which this scan does not parse.
• Six workflows. discord.yml uses pull_request_target only to post a notification and does not check out code; 1 of 29 third-party actions is pinned to a commit. Licence and contributing guide present; no security policy, Dependabot or CodeQL.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: TypeScript 1.4M, Markdown 165.1K, JSON 95.4K, JavaScript 21.8K, Rust 4,557, CSS 4,392.

Questions

Is Remotion free?

For individuals, non-profits and for-profit companies with up to three employees, yes, including commercial use. Larger for-profit organisations need a company licence from remotion.pro. Reselling a modified Remotion is not allowed under either licence. Cloud rendering on Lambda or Vercel is billed by those providers.

Can AI make videos with Remotion?

Yes. Because a Remotion video is React code, a coding agent can write and edit it from a prompt. Installing the official skills gives agents Remotion's conventions for timing, transitions, captions and assets, and the result is a real project you can keep editing by hand.

Do I need to know React to use Remotion?

To edit the output yourself, some React and TypeScript knowledge helps a lot. With an agent writing the code, you can get started from prompts and templates, but complex edits and debugging go faster if you can read the components.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.