A
AlicanAkyol/nativekeel
Health check for React Native and Expo apps: A–E ratings for security, store rules, crashes, upgrades and accessibility. Works with GitHub Actions and SonarQube. npx nativekeel
SECURITY.md ✓
View on GitHub ↗Link checked 2026-11-12 · HTTP 200 · opens the vendor's own site
Install & config
- Copy the command above
- Paste it as one entry under
mcpServersinclaude_desktop_config.json— local servers take command + args (example: clients) - Restart your client
Client config (built from the install command this repo gives)
{
"mcpServers": {
"alicanakyol-nativekeel": {
"command": "npx",
"args": ["nativekeel"]
}
}
}Parsed from the README we fetched on 2026-10-26; we have not executed it.
command/args come from the install command the repository states. When it is ambiguous, the project README wins.
VS Code (.vscode/mcp.json - the key is servers)
{
"servers": {
"alicanakyol-nativekeel": {
"command": "npx",
"args": ["nativekeel"]
}
}
}Same server, but VS Code keeps it under <code>servers</code>.
Claude Code (command line)
claude mcp add --transport stdio alicanakyol-nativekeel -- npx nativekeel
Claude Code does not read a config file; add the server with this command.
Key names differ by client: Clients & CLI
- Star count
- 6 ★ · AlicanAkyol/nativekeel · read from the GitHub search API · (checked 2026-11-13 20:00:50)
- Source
- collected from the punkpeye/awesome-mcp-servers list · type: MCP server
- Harvest history
- first seen 2026-10-23 · last seen 2026-11-14 · seen 26× · listed by 23 sources
- Score
- score 2,300 · 6 ★ · 23 sources · mcp
- Install
npx nativekeel
FAQ (answers come from our records)
How do I install it?
The repository provides this install command:
npx nativekeel. It comes from the repository itself; we cannot guarantee it runs as-is in your client.Who is it for?
We filed it under these tags: MCP 服务. The tags come from the entry itself, not a taxonomy we imposed.
Who maintains it?
repository
AlicanAkyol/nativekeel；first catalogued 2026-10-23；last seen 2026-11-14。There is no official certification or quality rating here — we record sources and dates only.# NativeKeel
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
Health check for React Native and Expo apps. Will your app survive the next upgrade, pass the store and stay safe? One command, no install, no account:
sh
npx nativekeel upgrade # go/no-go for the newest React Native / Expo, with file and line
npx nativekeel # full health check: upgrade, store rules, crashes, security, accessibility
No terminal handy? Paste your package.json at nativekeel.com/check: the same dependency checks and upgrade plan, run in your browser.
Works with GitHub Actions (a quality gate comment on every pull request), SonarQube (findings in your existing projects and quality gate) and AI coding agents (MCP server for Claude Code, Codex and Cursor). Several apps? npx nativekeel fleet puts them on one page.
What's new in 0.1.130: managed Expo apps get the Google Play target SDK check too: a targetSdkVersion pinned in expo-build-properties below 36 is reported, since it keeps the app below the level updates need after 1 November even after an Expo SDK upgrade. Recent releases added a check for UIScene setups that lose the deep link that launches the app, a list of 30 libraries that still call APIs React Native removed, npx nativekeel upgrade (a go/no-go for the newest React Native / Expo), known malware anywhere in the lockfile's dependency tree, and detection of the actively exploited Metro dev-server flaw CVE-2025-11953. Every check is tuned on 1,100+ open-source React Native and Expo projects, with recently updated ones added every week, to keep false alarms out (measured accuracy). All releases →
Summary 4 critical · 4 high · 6 medium · 6 low
Security (OWASP MASVS) crypto 1 · network 1 · code 1 · 7 finding categories; not a compliance verdict
Start here
1. Revoke the AWS access key ID in src/App.js:6 at the provider today.
2. Set targetSdkVersion = 36 and compileSdkVersion = 36 in android/build.gradle.
3. Replace @react-native-community/push-notification-ios: no New Architecture support, unmaintained.
## Could someone steal data or abuse the app?
sh
npx nativekeel security . --html security.html --fail-on high
Review secrets, credential leaks, backend access rules, unsafe code execution, transport and dependency risks in one report. New flow/configuration findings show where the input enters, where it is used, what an attacker would need, and how to verify the fix. --offline keeps the scan offline and skips online advisory checks. No source code is uploaded.
Keys added at build time. An EXPOPUBLIC value set in EAS or a CI secret never appears in the repository, so no source scan can see it, yet it ships in the app. NativeKeel also opens the built app and scans the JavaScript bundle inside it, plain JavaScript or Hermes bytecode: APKs and AABs under android/app/build/outputs, eas build --local results, committed bundles, and any APK, AAB or IPA you pass with --artifact app.apk (the GitHub Action's artifact input, after your build step).
This is source analysis, not a live attack or a security certificate. Security checks and scope · Mobile flow details · Native Android details.
## What it checks
Upgrade
Is your React Native / Expo version still supported? React Native supports the latest three minors; in Expo projects React Native moves with the SDK.
sh
npx nativekeel upgrade # go/no-go for the newest React Native / Expo, with file and line
npx nativekeel # full health check: upgrade, store rules, crashes, security, accessibility
No terminal handy? Paste your package.json at nativekeel.com/check: the same dependency checks and upgrade plan, run in your browser.
Works with GitHub Actions (a quality gate comment on every pull request), SonarQube (findings in your existing projects and quality gate) and AI coding agents (MCP server for Claude Code, Codex and Cursor). Several apps? npx nativekeel fleet puts them on one page.
What's new in 0.1.130: managed Expo apps get the Google Play target SDK check too: a targetSdkVersion pinned in expo-build-properties below 36 is reported, since it keeps the app below the level updates need after 1 November even after an Expo SDK upgrade. Recent releases added a check for UIScene setups that lose the deep link that launches the app, a list of 30 libraries that still call APIs React Native removed, npx nativekeel upgrade (a go/no-go for the newest React Native / Expo), known malware anywhere in the lockfile's dependency tree, and detection of the actively exploited Metro dev-server flaw CVE-2025-11953. Every check is tuned on 1,100+ open-source React Native and Expo projects, with recently updated ones added every week, to keep false alarms out (measured accuracy). All releases →
Summary 4 critical · 4 high · 6 medium · 6 low
Security (OWASP MASVS) crypto 1 · network 1 · code 1 · 7 finding categories; not a compliance verdict
Start here
1. Revoke the AWS access key ID in src/App.js:6 at the provider today.
2. Set targetSdkVersion = 36 and compileSdkVersion = 36 in android/build.gradle.
3. Replace @react-native-community/push-notification-ios: no New Architecture support, unmaintained.
## Could someone steal data or abuse the app?
sh
npx nativekeel security . --html security.html --fail-on high
Review secrets, credential leaks, backend access rules, unsafe code execution, transport and dependency risks in one report. New flow/configuration findings show where the input enters, where it is used, what an attacker would need, and how to verify the fix. --offline keeps the scan offline and skips online advisory checks. No source code is uploaded.
Keys added at build time. An EXPOPUBLIC value set in EAS or a CI secret never appears in the repository, so no source scan can see it, yet it ships in the app. NativeKeel also opens the built app and scans the JavaScript bundle inside it, plain JavaScript or Hermes bytecode: APKs and AABs under android/app/build/outputs, eas build --local results, committed bundles, and any APK, AAB or IPA you pass with --artifact app.apk (the GitHub Action's artifact input, after your build step).
This is source analysis, not a live attack or a security certificate. Security checks and scope · Mobile flow details · Native Android details.
## What it checks
Upgrade
Is your React Native / Expo version still supported? React Native supports the latest three minors; in Expo projects React Native moves with the SDK.
Listed badge (optional)
Copy this line into the README if you want the listing mark. Optional, and it does not affect being listed.
[](https://anclum.com/en/s/alicanakyol-nativekeel/)
- Source
- awesome · https://github.com/AlicanAkyol/nativekeel
- Browse by field
- MCP servers
- Traction
- 6 ★
- Listed by
- 23 independent sources
- added
- today
- Security policy
- the repository has
SECURITY.mdat its root (we checked that the file exists, not what it says)
More like this
Filed under
Every tag opens the full list for that filter. Counts are the live catalogue figures.