# NativeKeel

NativeKeel audits React Native and Expo projects for upgrade blockers, store issues, crash risks, and security findings through an MCP connection.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 6
- Author: AlicanAkyol
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/AlicanAkyol/nativekeel
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/nativekeel

## What it does

NativeKeel gives an AI coding agent a health check for React Native and Expo apps. It looks for packages that can stop a framework upgrade, stale or incompatible native modules, unused dependencies, and configuration problems. The checks also cover Google Play and App Store rules, iOS privacy settings, signing, and common Release-build crash causes.

Its security scan reviews source files, the lockfile, and built APK, AAB, or IPA artifacts. It can report exposed credentials, unsafe code paths, transport issues, and dependency risks; a supplied artifact is selected with `--artifact app.apk`. The `--offline` option keeps the scan local and skips online advisory checks.

The MCP server runs through `npx`, with `NATIVEKEEL_MCP_ROOTS` available for project-root configuration. This is source and artifact analysis, not a live attack or a security certificate, so the report does not replace testing the running app.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `NATIVEKEEL_MCP_ROOTS` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env NATIVEKEEL_MCP_ROOTS=<NATIVEKEEL_MCP_ROOTS> --transport stdio nativekeel -- npx -y nativekeel
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add nativekeel --env NATIVEKEEL_MCP_ROOTS=<NATIVEKEEL_MCP_ROOTS> -- npx -y nativekeel
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "nativekeel": {
            "command": "npx",
            "args": [
                "-y",
                "nativekeel"
            ],
            "env": {
                "NATIVEKEEL_MCP_ROOTS": "<NATIVEKEEL_MCP_ROOTS>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "nativekeel": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "nativekeel"
            ],
            "env": {
                "NATIVEKEEL_MCP_ROOTS": "<NATIVEKEEL_MCP_ROOTS>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e NATIVEKEEL_MCP_ROOTS=<NATIVEKEEL_MCP_ROOTS> nativekeel npx -y nativekeel
```
Replace <…> with your own values

## When to use it
- spot packages that block a React Native or Expo upgrade
- check a build against Google Play and App Store rules
- trace likely causes of Release-build crashes
- scan source and build artifacts for exposed secrets
- find risky dependencies and unsafe app settings

## Example prompts
- Check this React Native project for upgrade blockers and make a step-by-step upgrade plan.
- Review the project for Release-build crash risks and point to the affected files.
- Scan `app-release.apk` for exposed secrets and security findings.

## Similar
- [mobile-mcp](https://affpapa.org/en/nevibecode/mcp/mobile-mcp.md) — MCP server · ★ 10025
- [mobilerun](https://affpapa.org/en/nevibecode/mcp/mobilerun.md) — MCP server · ★ 9833
- [e2e](https://affpapa.org/en/nevibecode/mcp/e2e.md) — MCP server · ★ 11962
- [XcodeBuildMCP](https://affpapa.org/en/nevibecode/mcp/xcodebuildmcp.md) — MCP server · ★ 6511
- [ShipSwift](https://affpapa.org/en/nevibecode/mcp/shipswift.md) — MCP server · ★ 3244
- [agent-device](https://affpapa.org/en/nevibecode/mcp/agent-device.md) — MCP server · ★ 5158

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md