# NativeKeel (npm · nativekeel)

React Native and Expo health check: upgrade blockers, store rules, crash risks, security findings

- Trust score: 89/100 (high trust)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- npm · `nativekeel`: 89/100 (this document), [markdown](https://verifymcp.io/servers/alicanakyol-nativekeel/nativekeel.md), [page](https://verifymcp.io/servers/alicanakyol-nativekeel/nativekeel)

## Channel facts

- Registry: `npm`
- Package: `nativekeel`
- Version: `0.1.132`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to AlicanAkyol/nativekeel).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 3 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 66/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1755 tokens (~195/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 73/100
  - Stability observed for 22 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the NativeKeel MCP server?

NativeKeel runs locally as an npm package, launched with npx -y nativekeel. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add alicanakyol-nativekeel -- npx -y nativekeel
```

### Cursor

```json
{
  "mcpServers": {
    "alicanakyol-nativekeel": {
      "command": "npx",
      "args": [
        "-y",
        "nativekeel"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "alicanakyol-nativekeel": {
      "command": "npx",
      "args": [
        "-y",
        "nativekeel"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add alicanakyol-nativekeel -- npx -y nativekeel
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "alicanakyol-nativekeel": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "nativekeel"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add alicanakyol-nativekeel --command npx --arg -y --arg nativekeel
```

### Hermes

```yaml
mcp_servers:
  alicanakyol-nativekeel:
    command: "npx"
    args: ["-y", "nativekeel"]
```

### Netclaw

```json
{
  "McpServers": {
    "alicanakyol-nativekeel": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "nativekeel"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add alicanakyol-nativekeel -t stdio -c npx -a -y nativekeel
```

### Other

```json
{
  "mcpServers": {
    "alicanakyol-nativekeel": {
      "command": "npx",
      "args": [
        "-y",
        "nativekeel"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 89, +1)

No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-03 (score 88, +1)

No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-01 (score 87, +16)

- [security regression] Tool safety: pass → unverified
- [security regression] Stability: 0.57 → unverified
- [security improvement] Malware scan: unverified → pass
- [functional regression] Capabilities: fail → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] Package version: 0.1.131 → 0.1.132

### 2026-10-31 (score 71, −15)

- [security regression] Malware scan: pass → unverified
- [functional] Package version: 0.1.130 → 0.1.131

### 2026-10-30 (score 86, +1)

No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-28 (score 85, +1)

No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-26 (score 84, +1)

No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-25 (score 83, +26)

- [security improvement] Malware scan: unverified → pass
- [security improvement] Known CVEs: unverified → pass
- [functional improvement] Dependency health: unverified → pass

## MCP tools (9)

### `scan_project` (~289 tokens)

Health check for a React Native or Expo project: upgrade blockers, New Architecture, Google Play and App Store rules (target SDK, 16 KB pages, Xcode 27 UIScene, privacy manifests), crash risks, accessibility (unlabeled icon buttons and text fields, small touch targets, low text contrast, text scaling), OWASP MASVS security findings, leaked secrets, and signs of malware planted in the project or known malware anywhere in its lockfile dependency tree (run it before installing or starting a project you did not write). Use this for a general "how healthy is this app" or "what is wrong with it" question; it covers every area at a glance. For a deeper security review with attacker prerequisites use security_audit; for "should we upgrade" use upgrade_readiness. Read-only, never runs project code; returns findings with file:line references and fixes, never source code.

Input parameters:

- `min_severity` (string): Lowest severity to return: critical, high, medium, low or info. Default low.
- `offline` (boolean): true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false.
- `path` (string, required): Folder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read.

### `security_audit` (~219 tokens)

Review mobile app data exposure, account access, unsafe code execution, backend rules and dependency risks. Returns source evidence, attacker prerequisites, fixes, validation steps and explicit coverage limits. Use this when the question is specifically about security ("can this app be hacked", "is user data safe", before a security review or release); it goes deeper than the security part of scan_project and explains what an attacker would need for each finding. For an overall health check use scan_project. Static and read-only; does not claim a live penetration test or a clean bill of health.

Input parameters:

- `min_severity` (string): Lowest severity to return: critical, high, medium, low or info. Default low.
- `offline` (boolean): true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false.
- `path` (string, required): Folder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read.

### `improve_app` (~174 tokens)

Prioritize existing security, crash, accessibility, performance, store and dependency findings into a review plan with prerequisites, expected effects and validation. Use this when someone asks what to fix first or how to make the app better overall, across all areas. Do not use it for upgrade questions: use upgrade_readiness for whether to upgrade and upgrade_plan for the upgrade steps. No project code runs, no automatic changes or unmeasured performance claims. Reports unassessed areas explicitly.

Input parameters:

- `offline` (boolean): true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false.
- `path` (string, required): Folder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read.

### `measure_bundle` (~226 tokens)

What the release JavaScript bundle of a React Native or Expo app is made of, measured from the source map a release build already wrote (Hermes bytecode maps included): bytes and share for the app code and each package, packages bundled more than once, and the largest JSON. With base (an older map), what was added, removed or changed size since that build. Nothing is built or run; returns found:false with how to produce a map if there is none.

Input parameters:

- `base` (string): An older release source map, relative to path, to compare against: the result then lists packages added, removed or changed in size. Optional.
- `map` (string): Source map of the release bundle, relative to path (for example android/app/build/generated/sourcemaps/react/release/index.android.bundle.map). Optional: without it the usual React Native and Expo ou…
- `path` (string, required): Folder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read.

### `upgrade_plan` (~193 tokens)

Ordered, step-by-step upgrade plan for a React Native or Expo project: phases in the order to do them (security fixes, crash risks, store deadlines, React Native and Expo upgrades, library replacements), the reason for each phase and concrete steps with file names. Use this once the decision to upgrade is made and the user wants the work in order; call upgrade_readiness first for the go/no-go. For non-upgrade priorities use improve_app. Built from the same scan as scan_project; stops with a warning if the project contains planted malware. Read-only.

Input parameters:

- `offline` (boolean): true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false.
- `path` (string, required): Folder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read.

### `upgrade_readiness` (~180 tokens)

Go/no-go for upgrading a React Native or Expo project to the newest version: a verdict (ready, blocked, a multi-version jump, or already current), the exact breaking changes in the project's own code and dependencies with file and line, behavior and tooling changes to review, and an honest list of what a static scan cannot confirm. Use this first when someone asks whether or how to upgrade; use upgrade_plan for the full ordered steps. Built from the same scan as scan_project. Read-only.

Input parameters:

- `offline` (boolean): true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false.
- `path` (string, required): Folder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read.

### `check_library` (~131 tokens)

What to know about one React Native library before adding or upgrading it: latest version, New Architecture support and maintenance status (React Native Directory), the version range that works with a given React Native version where NativeKeel has a compatibility table, replacements, and known traps.

Input parameters:

- `name` (string, required): npm package name of the library, for example react-native-reanimated or @react-native-async-storage/async-storage.
- `react_native` (string): React Native version to check against, for example 0.88 or 0.88.0. Optional: without it only the general facts are returned.

### `explain_error` (~154 tokens)

Explain a React Native or Expo build, launch, crash or store-review error: what it means and the fix, from errors NativeKeel has reproduced or verified against Apple, Google, Expo and React Native documentation. Pass the error message (or the failing part of the log) and, optionally, the project path to see where this project is affected. Call it before searching the web or changing versions.

Input parameters:

- `error` (string, required): The error message or the relevant part of the build log.
- `offline` (boolean): Default true: the project check runs without network requests.
- `path` (string): Folder of the React Native or Expo app, to point at the place in this project the error comes from. Optional.

### `verify_upgrade` (~145 tokens)

Check a change before committing it: compares the React Native or Expo project as committed at a git revision (default HEAD) with the working tree, and lists what got fixed, what is new and how versions moved. Call it after an upgrade or a dependency change. Read-only: the committed version is unpacked into a temporary folder outside the project and deleted.

Input parameters:

- `base` (string): Git revision to compare with: HEAD (default), HEAD~1, a branch, tag or commit SHA.
- `offline` (boolean): Default true: both sides are scanned without network requests.
- `path` (string, required): Folder of the React Native or Expo app, inside a git repository.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/alicanakyol-nativekeel/nativekeel#diagnostics

## Score history

- 2026-11-05: 89
- 2026-11-04: 88
- 2026-11-03: 88
- 2026-11-02: 87
- 2026-11-01: 87
- 2026-10-31: 71
- 2026-10-30: 86
- 2026-10-29: 85
- 2026-10-28: 85
- 2026-10-27: 84
- 2026-10-26: 84
- 2026-10-25: 83
- 2026-10-24: 57
- 2026-10-23: 56
- 2026-10-22: 71
- 2026-10-21: 71
- 2026-10-20: 66
- 2026-10-19: 66
- 2026-10-18: 69
- 2026-10-17: 52
- 2026-10-16: 67
- 2026-10-15: 51
- 2026-10-14: 39
- 2026-10-13: 50
- 2026-10-12: 50

## Common questions

### What is the NativeKeel MCP server?

NativeKeel is an MCP server listed in the public MCP registry as io.github.AlicanAkyol/nativekeel. React Native and Expo health check: upgrade blockers, store rules, crash risks, security findings. This page covers its npm package (nativekeel).

### Is the NativeKeel MCP server safe to use?

NativeKeel scores 89 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the NativeKeel MCP server expose?

NativeKeel exposes 9 tools: scan_project, security_audit, improve_app, measure_bundle, upgrade_plan, and 4 more. Their descriptions and schemas cost roughly 1,711 tokens of context every time the server is loaded.

### Is the NativeKeel MCP server still maintained?

NativeKeel is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the NativeKeel MCP server under?

NativeKeel declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/nativekeel
- Socket report: https://socket.dev/npm/package/nativekeel
- Repository: https://github.com/AlicanAkyol/nativekeel
- Website: https://nativekeel.com/ai-agents
- Changelog RSS feed: https://verifymcp.io/servers/alicanakyol-nativekeel/nativekeel.xml
- Changelog JSON feed: https://verifymcp.io/servers/alicanakyol-nativekeel/nativekeel.json
- HTML version of this page: https://verifymcp.io/servers/alicanakyol-nativekeel/nativekeel