Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

NativeKeel

NPM · NATIVEKEEL

React Native and Expo health check: upgrade blockers, store rules, crash risks, security findings

Available components

+4 this week 89 Trust /100

Last scanned (4 hours ago)

Scores higher than 93% of npm servers

Category Testing and QA

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to AlicanAkyol/nativekeel). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 3 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability66
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 1755 tokens (~195/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management73
  • Stability observed for 22 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
  • Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.

  • 3 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.

  • 1 Nov 26 +16
    • Tool safety: pass → unverified ▼ security
    • Stability: 0.57 → unverified ▼ security
    • Malware scan: unverified → pass ▲ security
    • Capabilities: fail → unverified ▼ functional
    • Tool coverage: 100 → unverified ▼ functional
    • Package version: 0.1.131 → 0.1.132 functional
  • 31 Oct 26 −15
    • Malware scan: pass → unverified ▼ security
    • Package version: 0.1.130 → 0.1.131 functional
  • 30 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

  • 28 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

  • 26 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

  • 25 Oct 26 +26
    • Malware scan: unverified → pass ▲ security
    • Known CVEs: unverified → pass ▲ security
    • Dependency health: unverified → pass ▲ functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/nativekeel@0.1.132

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo AlicanAkyol/nativekeel
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/AlicanAkyol/nativekeel/.github/workflows/publish.yml@refs/tags/v0.1.132
Rekor log index 3634205125
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:a830acbfae5116b59a774a91883031e9e53e3fcb7c0e428f53047f96602150538dc108529beab68b50f489210bd537c079f301dc52b91cda9d40f4670

Background: How many MCP packages publish verified provenance →

Dependencies 0 packages
Packages resolved 0
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 9 exposed · ~1,711 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
check_library ~131

What to know about one React Native library before adding or upgrading it: latest version, New Architecture support and maintenance status (React Native Directory), the version range that works with a given React Native version where NativeKeel has a compatibility table, replacements, and known traps.

NameTypeReqDescription
namestringyesnpm package name of the library, for example react-native-reanimated or @react-native-async-storage/async-storage.
react_nativestring–React Native version to check against, for example 0.88 or 0.88.0. Optional: without it only the general facts are returned.

No output schema declared.

No examples provided.

explain_error ~154

Explain a React Native or Expo build, launch, crash or store-review error: what it means and the fix, from errors NativeKeel has reproduced or verified against Apple, Google, Expo and React Native documentation. Pass the error message (or the failing part of the log) and, optionally, the project path to see where this project is affected. Call it before searching the web or changing versions.

NameTypeReqDescription
errorstringyesThe error message or the relevant part of the build log.
offlineboolean–Default true: the project check runs without network requests.
pathstring–Folder of the React Native or Expo app, to point at the place in this project the error comes from. Optional.

No output schema declared.

No examples provided.

improve_app ~174

Prioritize existing security, crash, accessibility, performance, store and dependency findings into a review plan with prerequisites, expected effects and validation. Use this when someone asks what to fix first or how to make the app better overall, across all areas. Do not use it for upgrade questions: use upgrade_readiness for whether to upgrade and upgrade_plan for the upgrade steps. No project code runs, no automatic changes or unmeasured performance claims. Reports unassessed areas explicitly.

NameTypeReqDescription
offlineboolean–true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false.
pathstringyesFolder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read.

No output schema declared.

No examples provided.

measure_bundle ~226

What the release JavaScript bundle of a React Native or Expo app is made of, measured from the source map a release build already wrote (Hermes bytecode maps included): bytes and share for the app code and each package, packages bundled more than once, and the largest JSON. With base (an older map), what was added, removed or changed size since that build. Nothing is built or run; returns found:false with how to produce a map if there is none.

NameTypeReqDescription
basestring–An older release source map, relative to path, to compare against: the result then lists packages added, removed or changed in size. Optional.
mapstring–Source map of the release bundle, relative to path (for example android/app/build/generated/sourcemaps/react/release/index.android.bundle.map). Optional: without it the usual React Native and Expo ou…
pathstringyesFolder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read.

No output schema declared.

No examples provided.

scan_project ~289

Health check for a React Native or Expo project: upgrade blockers, New Architecture, Google Play and App Store rules (target SDK, 16 KB pages, Xcode 27 UIScene, privacy manifests), crash risks, accessibility (unlabeled icon buttons and text fields, small touch targets, low text contrast, text scaling), OWASP MASVS security findings, leaked secrets, and signs of malware planted in the project or known malware anywhere in its lockfile dependency tree (run it before installing or starting a project you did not write). Use this for a general "how healthy is this app" or "what is wrong with it" question; it covers every area at a glance. For a deeper security review with attacker prerequisites use security_audit; for "should we upgrade" use upgrade_readiness. Read-only, never runs project code; returns findings with file:line references and fixes, never source code.

NameTypeReqDescription
min_severitystring–Lowest severity to return: critical, high, medium, low or info. Default low.
offlineboolean–true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false.
pathstringyesFolder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read.

No output schema declared.

No examples provided.

security_audit ~219

Review mobile app data exposure, account access, unsafe code execution, backend rules and dependency risks. Returns source evidence, attacker prerequisites, fixes, validation steps and explicit coverage limits. Use this when the question is specifically about security ("can this app be hacked", "is user data safe", before a security review or release); it goes deeper than the security part of scan_project and explains what an attacker would need for each finding. For an overall health check use scan_project. Static and read-only; does not claim a live penetration test or a clean bill of health.

NameTypeReqDescription
min_severitystring–Lowest severity to return: critical, high, medium, low or info. Default low.
offlineboolean–true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false.
pathstringyesFolder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read.

No output schema declared.

No examples provided.

upgrade_plan ~193

Ordered, step-by-step upgrade plan for a React Native or Expo project: phases in the order to do them (security fixes, crash risks, store deadlines, React Native and Expo upgrades, library replacements), the reason for each phase and concrete steps with file names. Use this once the decision to upgrade is made and the user wants the work in order; call upgrade_readiness first for the go/no-go. For non-upgrade priorities use improve_app. Built from the same scan as scan_project; stops with a warning if the project contains planted malware. Read-only.

NameTypeReqDescription
offlineboolean–true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false.
pathstringyesFolder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read.

No output schema declared.

No examples provided.

upgrade_readiness ~180

Go/no-go for upgrading a React Native or Expo project to the newest version: a verdict (ready, blocked, a multi-version jump, or already current), the exact breaking changes in the project's own code and dependencies with file and line, behavior and tooling changes to review, and an honest list of what a static scan cannot confirm. Use this first when someone asks whether or how to upgrade; use upgrade_plan for the full ordered steps. Built from the same scan as scan_project. Read-only.

NameTypeReqDescription
offlineboolean–true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false.
pathstringyesFolder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read.

No output schema declared.

No examples provided.

verify_upgrade ~145

Check a change before committing it: compares the React Native or Expo project as committed at a git revision (default HEAD) with the working tree, and lists what got fixed, what is new and how versions moved. Call it after an upgrade or a dependency change. Read-only: the committed version is unpacked into a temporary folder outside the project and deleted.

NameTypeReqDescription
basestring–Git revision to compare with: HEAD (default), HEAD~1, a branch, tag or commit SHA.
offlineboolean–Default true: both sides are scanned without network requests.
pathstringyesFolder of the React Native or Expo app, inside a git repository.

No output schema declared.

No examples provided.

Install

How do I install the NativeKeel MCP server?

NativeKeel runs locally as an npm package, launched with npx -y nativekeel. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · nativekeel

# add to Claude Code
claude mcp add alicanakyol-nativekeel -- npx -y nativekeel
Common questions

What is the NativeKeel MCP server?

NativeKeel is an MCP server listed in the public MCP registry as io.github.AlicanAkyol/nativekeel. React Native and Expo health check: upgrade blockers, store rules, crash risks, security findings. This page covers its npm package (nativekeel).

Is the NativeKeel MCP server safe to use?

NativeKeel scores 89 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the NativeKeel MCP server expose?

NativeKeel exposes 9 tools: scan_project, security_audit, improve_app, measure_bundle, upgrade_plan, and 4 more. Their descriptions and schemas cost roughly 1,711 tokens of context every time the server is loaded.

Is the NativeKeel MCP server still maintained?

NativeKeel is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the NativeKeel MCP server under?

NativeKeel declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.