NativeKeel

What it does

NativeKeel is a command-line scanner for React Native and Expo apps that also runs as a local MCP server over stdio (`npx -y nativekeel@latest mcp`). An assistant can point it at a project folder and get back findings with file and line references and a suggested fix: upgrade blockers, settings that Google Play or the App Store would reject, packages off the versions an Expo SDK expects, likely runtime crashes, leaked secrets, insecure network settings, accessibility gaps and performance patterns.

Beyond the scan it builds an ordered upgrade plan and gives a go or no-go verdict on moving to the newest React Native. It also checks whether a given npm library suits a given React Native version, explains a build, launch or store-review error and where the project is affected, and compares the project with an earlier git revision after an upgrade to show what was fixed and what is new. If a release build has already written a source map, it can break the JavaScript bundle down by package and compare it with an older map.

The README lists six MCP tools. The server code (src/mcp.js) registers nine, because `security_audit`, `improve_app` and `upgrade_readiness` are there too but left out of that list. The code caps each findings list it returns at 80 and reports how many were cut. The package has no dependencies beyond Node.js built-ins, and npm releases carry provenance from GitHub Actions. The maker also sells fixed-price upgrade work, while the tool itself is free and MIT-licensed.

What it needs

npx comes with Node.js. The React Native or Expo project must sit inside the folder the client starts the server in, or in a folder named in NATIVEKEEL_MCP_ROOTS. `verify_upgrade` needs the project to be in a git repository. `measure_bundle` needs a source map from a release build you have already made. No account or API key.

Limits

• Not covered Static only: it never runs the app or project code and does not measure frame rate or startup time
• Not covered Its security review is not a penetration test or a compliance verdict
• Size cap Each findings list is cut at 80 entries, with the number dropped reported (src/mcp.js)
• Size cap measure_bundle returns the 30 largest packages, 10 duplicates and 10 largest JSON files
• Limit Only folders under the server's start folder or NATIVEKEEL_MCP_ROOTS can be scanned. A start at the filesystem root counts for nothing
• Limit Started from a plugin folder (Codex), the boundary is the home folder unless NATIVEKEEL_MCP_ROOTS is set
• Not covered Accessibility checks cover React Native's own touchables and inputs, not custom components or focus order
• Limit Unused-package results can miss dynamic imports
• Limit Its filter for instruction-like text in results is, by its own docs, not a full prompt-injection defense

Static only: it never runs the app or project code, does not measure frame rate or startup time, and its security review is not a penetration test or compliance verdict. Each findings list is cut at 80 entries (src/mcp.js). Only folders under the server's start directory or NATIVEKEEL_MCP_ROOTS can be scanned; when started from a plugin folder (Codex) the boundary is the home folder unless NATIVEKEEL_MCP_ROOTS is set. Accessibility checks cover React Native's own touchables and inputs, not custom components or focus order. Unused-package results can miss dynamic imports. Its filter for instruction-like text in results is, by its own docs, not a complete prompt-injection defense.

Who it suits

Suits developers maintaining React Native or Expo apps who want an assistant to check a project before upgrading React Native or Expo, adding a native library or preparing a store release, all locally and without an account. It reads only and changes nothing, so the assistant still makes the fixes. Projects that are not React Native or Expo get nothing from it, and anyone needing runtime profiling, device testing or a formal security assessment needs other tools.