A
AlicanAkyol/nativekeel
Health check for React Native and Expo apps: A–E ratings for security, store rules, crashes, upgrades and accessibility. Works with GitHub Actions and SonarQube. npx nativekeel
SECURITY.md ✓
在 GitHub 查看 ↗链接已于 2026-11-12 核查 · HTTP 200 · 打开的是厂商自己的官网
安装与配置
- 复制上面的命令
- 粘成
claude_desktop_config.json里mcpServers的一项（本地服务器用 command + args，示例见 客户端接法） - 重启客户端
客户端配置（取自该仓库的安装命令）
{
"mcpServers": {
"alicanakyol-nativekeel": {
"command": "npx",
"args": ["nativekeel"]
}
}
}解析自我们于 2026-10-26 抓取的该仓库 README；我们未执行过。
command/args 来自仓库写明的安装命令；不确定时请以该项目 README 为准。
VS Code（.vscode/mcp.json —— 键名是 servers）
{
"servers": {
"alicanakyol-nativekeel": {
"command": "npx",
"args": ["nativekeel"]
}
}
}VS Code 顶层键是 <code>servers</code>，其余与上面那份相同。
Claude Code（命令行）
claude mcp add --transport stdio alicanakyol-nativekeel -- npx nativekeel
Claude Code 不收 JSON 文件，用这条命令直接加。
配置项的键名以你的客户端为准：客户端与 CLI
- ★ 数取值
- 6 ★ · AlicanAkyol/nativekeel · 取自 GitHub 搜索 API · （2026-11-13 20:00:50 核对）
- 来源明细
- 收录自 punkpeye/awesome-mcp-servers 榜单（我们从中收集的条目之一） · 条目类型：MCP 服务
- 收录与活跃
- 收录于 2026-10-23 · 最近见到 2026-11-14 · 共见到 26 次 · 被 23 个来源列出
- 评分构成
- 综合分 2,300 · 6 ★ · 23 个来源 · mcp
- 安装
npx nativekeel
常见问题（答案都来自我们的记录）
怎么安装？
该仓库给出的安装命令是
npx nativekeel。我们的记录里它是仓库自己提供的；不保证在你的客户端上直接可用。它适合谁 / 用来做什么？
我们把它归在这些标签下: MCP 服务。标签来自条目自身，不是我们强加的分类。
谁维护它、还在更新吗？
仓库
AlicanAkyol/nativekeel；我们收录于 2026-10-23；最近见到 2026-11-14。这里没有"官方认证"或"质量评级"——我们只记录来源与时间。# NativeKeel
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
Health check for React Native and Expo apps. Will your app survive the next upgrade, pass the store and stay safe? One command, no install, no account:
sh
npx nativekeel upgrade # go/no-go for the newest React Native / Expo, with file and line
npx nativekeel # full health check: upgrade, store rules, crashes, security, accessibility
No terminal handy? Paste your package.json at nativekeel.com/check: the same dependency checks and upgrade plan, run in your browser.
Works with GitHub Actions (a quality gate comment on every pull request), SonarQube (findings in your existing projects and quality gate) and AI coding agents (MCP server for Claude Code, Codex and Cursor). Several apps? npx nativekeel fleet puts them on one page.
What's new in 0.1.130: managed Expo apps get the Google Play target SDK check too: a targetSdkVersion pinned in expo-build-properties below 36 is reported, since it keeps the app below the level updates need after 1 November even after an Expo SDK upgrade. Recent releases added a check for UIScene setups that lose the deep link that launches the app, a list of 30 libraries that still call APIs React Native removed, npx nativekeel upgrade (a go/no-go for the newest React Native / Expo), known malware anywhere in the lockfile's dependency tree, and detection of the actively exploited Metro dev-server flaw CVE-2025-11953. Every check is tuned on 1,100+ open-source React Native and Expo projects, with recently updated ones added every week, to keep false alarms out (measured accuracy). All releases →
Summary 4 critical · 4 high · 6 medium · 6 low
Security (OWASP MASVS) crypto 1 · network 1 · code 1 · 7 finding categories; not a compliance verdict
Start here
1. Revoke the AWS access key ID in src/App.js:6 at the provider today.
2. Set targetSdkVersion = 36 and compileSdkVersion = 36 in android/build.gradle.
3. Replace @react-native-community/push-notification-ios: no New Architecture support, unmaintained.
## Could someone steal data or abuse the app?
sh
npx nativekeel security . --html security.html --fail-on high
Review secrets, credential leaks, backend access rules, unsafe code execution, transport and dependency risks in one report. New flow/configuration findings show where the input enters, where it is used, what an attacker would need, and how to verify the fix. --offline keeps the scan offline and skips online advisory checks. No source code is uploaded.
Keys added at build time. An EXPOPUBLIC value set in EAS or a CI secret never appears in the repository, so no source scan can see it, yet it ships in the app. NativeKeel also opens the built app and scans the JavaScript bundle inside it, plain JavaScript or Hermes bytecode: APKs and AABs under android/app/build/outputs, eas build --local results, committed bundles, and any APK, AAB or IPA you pass with --artifact app.apk (the GitHub Action's artifact input, after your build step).
This is source analysis, not a live attack or a security certificate. Security checks and scope · Mobile flow details · Native Android details.
## What it checks
Upgrade
Is your React Native / Expo version still supported? React Native supports the latest three minors; in Expo projects React Native moves with the SDK.
sh
npx nativekeel upgrade # go/no-go for the newest React Native / Expo, with file and line
npx nativekeel # full health check: upgrade, store rules, crashes, security, accessibility
No terminal handy? Paste your package.json at nativekeel.com/check: the same dependency checks and upgrade plan, run in your browser.
Works with GitHub Actions (a quality gate comment on every pull request), SonarQube (findings in your existing projects and quality gate) and AI coding agents (MCP server for Claude Code, Codex and Cursor). Several apps? npx nativekeel fleet puts them on one page.
What's new in 0.1.130: managed Expo apps get the Google Play target SDK check too: a targetSdkVersion pinned in expo-build-properties below 36 is reported, since it keeps the app below the level updates need after 1 November even after an Expo SDK upgrade. Recent releases added a check for UIScene setups that lose the deep link that launches the app, a list of 30 libraries that still call APIs React Native removed, npx nativekeel upgrade (a go/no-go for the newest React Native / Expo), known malware anywhere in the lockfile's dependency tree, and detection of the actively exploited Metro dev-server flaw CVE-2025-11953. Every check is tuned on 1,100+ open-source React Native and Expo projects, with recently updated ones added every week, to keep false alarms out (measured accuracy). All releases →
Summary 4 critical · 4 high · 6 medium · 6 low
Security (OWASP MASVS) crypto 1 · network 1 · code 1 · 7 finding categories; not a compliance verdict
Start here
1. Revoke the AWS access key ID in src/App.js:6 at the provider today.
2. Set targetSdkVersion = 36 and compileSdkVersion = 36 in android/build.gradle.
3. Replace @react-native-community/push-notification-ios: no New Architecture support, unmaintained.
## Could someone steal data or abuse the app?
sh
npx nativekeel security . --html security.html --fail-on high
Review secrets, credential leaks, backend access rules, unsafe code execution, transport and dependency risks in one report. New flow/configuration findings show where the input enters, where it is used, what an attacker would need, and how to verify the fix. --offline keeps the scan offline and skips online advisory checks. No source code is uploaded.
Keys added at build time. An EXPOPUBLIC value set in EAS or a CI secret never appears in the repository, so no source scan can see it, yet it ships in the app. NativeKeel also opens the built app and scans the JavaScript bundle inside it, plain JavaScript or Hermes bytecode: APKs and AABs under android/app/build/outputs, eas build --local results, committed bundles, and any APK, AAB or IPA you pass with --artifact app.apk (the GitHub Action's artifact input, after your build step).
This is source analysis, not a live attack or a security certificate. Security checks and scope · Mobile flow details · Native Android details.
## What it checks
Upgrade
Is your React Native / Expo version still supported? React Native supports the latest three minors; in Expo projects React Native moves with the SDK.
收录徽章（可选）
想把收录标记放进 README 就复制这行，可选，不影响收录。
[](https://anclum.com/zh/s/alicanakyol-nativekeel/)
- 来源
- awesome · https://github.com/AlicanAkyol/nativekeel
- 按领域浏览
- MCP 服务
- Traction
- 6 ★
- 收录来源
- 23 个独立来源
- 收录于
- 今天
- 安全策略
- 该仓库根目录有
SECURITY.md（我们只核文件存在，未核内容）
同类推荐
所属领域与标签
每个标签都能点进去看同类的全部条目。数字是当前库里的真实条数。