# NativeKeel [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/AlicanAkyol/nativekeel  
**GitHub Stars:** 2  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/nativekeel

## Description
React Native and Expo health check: upgrade blockers, store rules, crash risks, security findings

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "nativekeel": {
    "command": "npx",
    "args": ["-y","nativekeel"],
    "env": {
      "NATIVEKEEL_MCP_ROOTS": ""
    }
  }
}
```

**Requires environment variables:** `NATIVEKEEL_MCP_ROOTS` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What NativeKeel MCP server does

The NativeKeel MCP server gives an MCP-compatible agent access to health checks for React Native and Expo applications. It examines project configuration, JavaScript and TypeScript source, native Android and iOS files, dependency metadata, and—in applicable checks—built APK or AAB contents. The results group issues around upgrades, app-store acceptance, runtime crashes, security, and performance investigation.

Upgrade analysis identifies React Native and Expo compatibility problems, packages that lack New Architecture support, stale or unmaintained dependencies, renamed packages, and installed packages that appear unused. It also reports code and configuration changes associated with upcoming React Native or Expo versions.

Store checks cover items such as Android SDK targets, restricted permissions, 16 KB memory-page support, iOS privacy manifests, required Info.plist usage descriptions, account-deletion flows, Apple sign-in requirements, and release signing. Crash checks include incompatible package versions, development-server references in release builds, common Reanimated configuration errors, duplicate React packages, and several native integration problems.

## How it works

The NativeKeel MCP server performs static analysis rather than running an attack against the app or backend. Security checks look for exposed credentials, unsafe data flows, weak transport settings, backend policy problems, risky platform configuration, cryptographic mistakes, dependency advisories, and reverse-engineering exposure. Findings include evidence and, for newer flow and configuration checks, attacker prerequisites, remediation guidance, and a way to verify the change.

The MCP tools include `security_audit` for a focused security review, `improve_app` for turning existing findings into a prioritized improvement plan, `verify_upgrade` for comparing the current state with the last commit after an upgrade, and `explain_error` for interpreting build, launch, crash, or store-review errors. The command-line interface also provides corresponding workflows, including `npx nativekeel`, `npx nativekeel security`, `npx nativekeel verify`, and `npx nativekeel explain`.

Static findings are signals to investigate. They do not prove that a vulnerability is exploitable, establish measured performance or size savings, or certify security.

## Setup and configuration

Run the CLI with Node's package runner:

```sh
npx nativekeel
```

The project describes the basic health check as requiring no installation and no account. Security scans can use `--offline` to skip online advisory checks, and reports can be written as HTML. The source is not uploaded.

For MCP plugin deployments, `NATIVEKEEL_MCP_ROOTS` defines the permitted file roots. Plugin servers require explicit roots. Codex cannot pass environment variables to a plugin's server, so its default boundary is the user's home folder unless a separately configured server supplies `NATIVEKEEL_MCP_ROOTS`.

NativeKeel provides installation paths for Claude Code and Codex plugins, plus one-click installation for Cursor and VS Code.

## Tools and capabilities

- Review upgrade readiness for React Native and Expo projects.
- Find store submission blockers and release configuration issues.
- Trace selected security risks across source and configuration.
- Produce prioritized improvement steps from existing findings.
- Compare post-upgrade findings with the previous commit.
- Explain build, launch, crash, and store-review errors.
- Flag performance patterns for further investigation, such as nested lists, logging, large referenced images, and broad imports.

## Limitations and notes

The checks cover detectable patterns and do not replace testing, a penetration test, or backend review. A clean report is not a security certification. Some dependency and performance findings require project context and verification. Security advisory checks may need online access unless the scan is run offline. Findings about backend policies include deployment and grant assumptions, so the deployed configuration still needs confirmation.

_Full upstream README: https://allmcps.com/mcp/nativekeel/readme_