NativeKeel
NPM · NATIVEKEEL
React Native and Expo health check: upgrade blockers, store rules, crash risks, security findings
Available components
Last scanned (4 hours ago)
Scores higher than 93% of npm servers
Category Testing and QA
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to AlicanAkyol/nativekeel). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 3 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability66
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1755 tokens (~195/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management73
- Stability observed for 22 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Nov 26 +16
- Tool safety: pass → unverified ▼ security
- Stability: 0.57 → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- Capabilities: fail → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Package version: 0.1.131 → 0.1.132 functional
- 31 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 0.1.130 → 0.1.131 functional
- 30 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 26 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 25 Oct 26 +26
- Malware scan: unverified → pass ▲ security
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → pass ▲ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/nativekeel@0.1.132
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | AlicanAkyol/nativekeel |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/AlicanAkyol/nativekeel/.github/workflows/publish.yml@refs/tags/v0.1.132 |
| Rekor log index | 3634205125 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:a830acbfae5116b59a774a91883031e9e53e3fcb7c0e428f53047f96602150538dc108529beab68b50f489210bd537c079f301dc52b91cda9d40f4670 |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_library ~131
What to know about one React Native library before adding or upgrading it: latest version, New Architecture support and maintenance status (React Native Directory), the version range that works with a given React Native version where NativeKeel has a compatibility table, replacements, and known traps.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | npm package name of the library, for example react-native-reanimated or @react-native-async-storage/async-storage. |
| react_native | string | – | React Native version to check against, for example 0.88 or 0.88.0. Optional: without it only the general facts are returned. |
No output schema declared.
No examples provided.
explain_error ~154
Explain a React Native or Expo build, launch, crash or store-review error: what it means and the fix, from errors NativeKeel has reproduced or verified against Apple, Google, Expo and React Native documentation. Pass the error message (or the failing part of the log) and, optionally, the project path to see where this project is affected. Call it before searching the web or changing versions.
| Name | Type | Req | Description |
|---|---|---|---|
| error | string | yes | The error message or the relevant part of the build log. |
| offline | boolean | – | Default true: the project check runs without network requests. |
| path | string | – | Folder of the React Native or Expo app, to point at the place in this project the error comes from. Optional. |
No output schema declared.
No examples provided.
improve_app ~174
Prioritize existing security, crash, accessibility, performance, store and dependency findings into a review plan with prerequisites, expected effects and validation. Use this when someone asks what to fix first or how to make the app better overall, across all areas. Do not use it for upgrade questions: use upgrade_readiness for whether to upgrade and upgrade_plan for the upgrade steps. No project code runs, no automatic changes or unmeasured performance claims. Reports unassessed areas explicitly.
| Name | Type | Req | Description |
|---|---|---|---|
| offline | boolean | – | true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false. |
| path | string | yes | Folder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read. |
No output schema declared.
No examples provided.
measure_bundle ~226
What the release JavaScript bundle of a React Native or Expo app is made of, measured from the source map a release build already wrote (Hermes bytecode maps included): bytes and share for the app code and each package, packages bundled more than once, and the largest JSON. With base (an older map), what was added, removed or changed size since that build. Nothing is built or run; returns found:false with how to produce a map if there is none.
| Name | Type | Req | Description |
|---|---|---|---|
| base | string | – | An older release source map, relative to path, to compare against: the result then lists packages added, removed or changed in size. Optional. |
| map | string | – | Source map of the release bundle, relative to path (for example android/app/build/generated/sourcemaps/react/release/index.android.bundle.map). Optional: without it the usual React Native and Expo ou… |
| path | string | yes | Folder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read. |
No output schema declared.
No examples provided.
scan_project ~289
Health check for a React Native or Expo project: upgrade blockers, New Architecture, Google Play and App Store rules (target SDK, 16 KB pages, Xcode 27 UIScene, privacy manifests), crash risks, accessibility (unlabeled icon buttons and text fields, small touch targets, low text contrast, text scaling), OWASP MASVS security findings, leaked secrets, and signs of malware planted in the project or known malware anywhere in its lockfile dependency tree (run it before installing or starting a project you did not write). Use this for a general "how healthy is this app" or "what is wrong with it" question; it covers every area at a glance. For a deeper security review with attacker prerequisites use security_audit; for "should we upgrade" use upgrade_readiness. Read-only, never runs project code; returns findings with file:line references and fixes, never source code.
| Name | Type | Req | Description |
|---|---|---|---|
| min_severity | string | – | Lowest severity to return: critical, high, medium, low or info. Default low. |
| offline | boolean | – | true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false. |
| path | string | yes | Folder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read. |
No output schema declared.
No examples provided.
security_audit ~219
Review mobile app data exposure, account access, unsafe code execution, backend rules and dependency risks. Returns source evidence, attacker prerequisites, fixes, validation steps and explicit coverage limits. Use this when the question is specifically about security ("can this app be hacked", "is user data safe", before a security review or release); it goes deeper than the security part of scan_project and explains what an attacker would need for each finding. For an overall health check use scan_project. Static and read-only; does not claim a live penetration test or a clean bill of health.
| Name | Type | Req | Description |
|---|---|---|---|
| min_severity | string | – | Lowest severity to return: critical, high, medium, low or info. Default low. |
| offline | boolean | – | true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false. |
| path | string | yes | Folder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read. |
No output schema declared.
No examples provided.
upgrade_plan ~193
Ordered, step-by-step upgrade plan for a React Native or Expo project: phases in the order to do them (security fixes, crash risks, store deadlines, React Native and Expo upgrades, library replacements), the reason for each phase and concrete steps with file names. Use this once the decision to upgrade is made and the user wants the work in order; call upgrade_readiness first for the go/no-go. For non-upgrade priorities use improve_app. Built from the same scan as scan_project; stops with a warning if the project contains planted malware. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| offline | boolean | – | true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false. |
| path | string | yes | Folder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read. |
No output schema declared.
No examples provided.
upgrade_readiness ~180
Go/no-go for upgrading a React Native or Expo project to the newest version: a verdict (ready, blocked, a multi-version jump, or already current), the exact breaking changes in the project's own code and dependencies with file and line, behavior and tooling changes to review, and an honest list of what a static scan cannot confirm. Use this first when someone asks whether or how to upgrade; use upgrade_plan for the full ordered steps. Built from the same scan as scan_project. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| offline | boolean | – | true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false. |
| path | string | yes | Folder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read. |
No output schema declared.
No examples provided.
verify_upgrade ~145
Check a change before committing it: compares the React Native or Expo project as committed at a git revision (default HEAD) with the working tree, and lists what got fixed, what is new and how versions moved. Call it after an upgrade or a dependency change. Read-only: the committed version is unpacked into a temporary folder outside the project and deleted.
| Name | Type | Req | Description |
|---|---|---|---|
| base | string | – | Git revision to compare with: HEAD (default), HEAD~1, a branch, tag or commit SHA. |
| offline | boolean | – | Default true: both sides are scanned without network requests. |
| path | string | yes | Folder of the React Native or Expo app, inside a git repository. |
No output schema declared.
No examples provided.
How do I install the NativeKeel MCP server?
NativeKeel runs locally as an npm package, launched with npx -y nativekeel. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · nativekeel
claude mcp add alicanakyol-nativekeel -- npx -y nativekeel
What is the NativeKeel MCP server?
NativeKeel is an MCP server listed in the public MCP registry as io.github.AlicanAkyol/nativekeel. React Native and Expo health check: upgrade blockers, store rules, crash risks, security findings. This page covers its npm package (nativekeel).
Is the NativeKeel MCP server safe to use?
NativeKeel scores 89 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the NativeKeel MCP server expose?
NativeKeel exposes 9 tools: scan_project, security_audit, improve_app, measure_bundle, upgrade_plan, and 4 more. Their descriptions and schemas cost roughly 1,711 tokens of context every time the server is loaded.
Is the NativeKeel MCP server still maintained?
NativeKeel is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the NativeKeel MCP server under?
NativeKeel declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.