Nativekeel
Provides native Android source security checks and upgrade analysis, including targetSdkVersion, restricted permissions, native code vulnerabilities, and Google Play compliance.
Checks iOS apps for App Store acceptance issues, including review guidelines, file sharing of sensitive data, and other iOS-specific store requirements.
Health checks and upgrade plans for Expo apps, including Expo SDK compatibility, expo-updates configuration, and dependency analysis.
Analyzes Firebase security rules, flagging writes guarded only by sign-in and other insecure configurations.
Integrates with GitHub to post findings as comments on pull requests and track fixed vs new issues.
Provides a GitHub Action to run NativeKeel checks in CI, keeping a pull request comment up to date with findings.
Checks Google Play acceptance criteria, including targetSdk, restricted permissions, and 16 KB memory page compliance.
Provides iOS-specific security and crash checks, including AppDelegate fixes, RCTEventEmitter errors, and file sharing vulnerabilities.
Maps security findings to OWASP MASVS categories for mobile security compliance.
Analyzes Supabase row policies, flagging unconditional or insecure database access rules.
NativeKeel
Health check for React Native and Expo apps. One command, no install, no account:
npx nativekeelNo terminal handy? Paste your package.json at nativekeel.com/check: the same dependency checks and upgrade plan, run in your browser.
Works with GitHub Actions (a quality gate comment on every pull request), SonarQube (findings in your existing projects and quality gate) and AI coding agents (MCP server for Claude Code, Codex and Cursor). Several apps? npx nativekeel fleet puts them on one page.
What's new in 0.1.100: clearer MCP tools: every parameter documented, standard read-only annotations on all eight tools. 0.1.99: backend admin credentials compiled into the app (Supabase service_role, Hasura admin secret, Firebase service accounts, database passwords, Stripe secret key) and server-only SDKs imported by app code. 0.1.98: fewer false alarms: React header imports in an app's own AppDelegate or bridging header are no longer reported on React Native 0.87 (they resolve in the app target; only libraries fail). 0.1.97: render loops ("Too many re-renders", "Maximum update depth exceeded") found with file and line: handlers called instead of passed, effects that set state on every run. 0.1.96: a React Native version that does not match the Expo SDK is reported (a common cause of build failures and launch crashes). 0.1.95: Google Play's API 36 requirement (extension ends 1 November): the edge-to-edge opt-out Android 16 ignores, and orientation locks tablets and foldables ignore. 0.1.94: team panel (closed beta): --upload sends a scan summary (no code) to your team's page with history and trends; GitHub Action input panel-token. Live demo. 0.1.93: --sonar <file> puts NativeKeel findings inside SonarQube (generic issue import, tested on Community Build 26.10), also as the GitHub Action's sonar input (setup). 0.1.92: React Native 0.88 and Expo SDK 58 are stable: the UIScene finding gives 0.88's official SceneDelegate steps, and InputAccessoryView (deprecated in 0.88) is reported with its replacement. 0.1.91: npx nativekeel fleet ~/clients --base last-month.json shows what changed per app since an earlier run (ratings and critical/high counts), plus new and removed apps; compare includes ratings. 0.1.90: pull request comments start with a quality gate and show the A–E ratings with what changed; a committed .nativekeel.json holds the team's gate level and accepted findings (each with a reason). 0.1.89: every report rates Security, Store, Stability, Upgrade, Performance and Accessibility from A to E, and npx nativekeel fleet ~/clients shows all your apps in one table, worst first, with their ratings and store deadlines (--html for a shareable page). 0.1.88: libraries whose iOS code no longer compiles on React Native 0.87 (#import "RCTBridge.h" instead of <React/RCTBridge.h>) are found in your installed packages before the upgrade, and reported as the cause after it (fix and workaround); InteractionManager on 0.87+ is reported as a crash. 0.1.87: when a report has a store or end-of-support deadline (Play target SDK, 16 KB pages, Xcode 27 UIScene, unsupported React Native or Expo, New Architecture off), it ends with one line on where to ask if your team can't fit the upgrade in time. 0.1.86: a page for the React Native 0.77+ error "RCTEventEmitter.receiveEvent() ... has not been registered as callable" with the AppDelegate fix for Objective-C and Swift (nativekeel.com/fix/rcteventemitter-receiveevent-not-registered), linked from the finding that detects it. 0.1.85: the AppDelegate-window crash finding links to a new page listing each affected library and its fix (nativekeel.com/fix/appdelegate-window-unrecognized-selector); reports point to Expert help instead of the old pricing link. 0.1.84: nativekeel.com/check: paste a package.json and get the dependency checks and upgrade plan in your browser, with the same rules as the CLI. 0.1.83: the GitHub Action can keep one comment on each pull request up to date with the findings that pull request adds or fixes (pr-comment: true). verify no longer reports unchanged committed signing keys and passwords as new. 0.1.82: npx nativekeel bundle new.map --base old.map compares two release builds: which packages were added or removed, which grew, and which started being bundled twice (one import _ from "lodash" showed up as +107 KB). Also in the MCP tool measure_bundle. 0.1.81: the bundle measurement reaches the rest of the report and AI agents: lodash and moment findings say how many bytes they really take in your release bundle (or that they are not in it), and the MCP tool measure_bundle returns the per-package breakdown. 0.1.80: npx nativekeel bundle: the release JavaScript bundle measured from its source map, per package, including packages bundled twice. Works with Hermes bytecode maps; nothing is built or run. 0.1.79: fewer false alarms: push-notification and invitation tokens are no longer reported as unencrypted auth tokens, even when the storage key is a constant, and large JSON required inside a function is described as bundled but evaluated only when used. 0.1.78: OTA updates: a note when expo-updates relies on a hand-written runtime version or the appVersion policy (59 of 871 apps), and react-native-code-push now says that App Center is gone and Microsoft archived its CodePush server. 0.1.77: iOS file sharing that puts an unencrypted MMKV, expo-sqlite or Realm database in the Files app and Finder. 0.1.76: biometric unlocks that only check a yes/no in JavaScript, with no secret bound to Face ID/Touch ID/fingerprint (41 of 871 apps, wallets among them); apps that bind a key in JS or native code are not flagged. 0.1.75: placeholder text is checked for contrast too (placeholderTextColor against the input or the view behind it): 226 placeholders in 55 of 871 apps. 0.1.74: large JSON imported into the JavaScript bundle (all translations up front, Lottie JSON that could be a .lottie asset) in 19 of 871 apps, and a note on touchables without accessibilityRole. 0.1.73: text contrast: where a Text color and the background behind it are both literal colors in the code, pairs below WCAG 2.2 AA (4.5:1, or 3:1 for large text) are reported. Found in 180 of 871 open-source apps. 0.1.72: buttons whose tappable area is certainly under 44×44 points (explicit size or a bare small icon) and have no hitSlop: 209 of 871 open-source apps. 0.1.71: accessibility checks: icon-only buttons without a label, unlabeled text fields, app-wide text scaling turned off, and Text.defaultProps that React 19 ignores. On 871 open-source apps, 282 have at least one unlabeled icon button. 0.1.70: in nativekeel improve, AI keys shipped in the bundle are contained like other exposed credentials, signing keys get signing-specific steps, and upgrade work has its own group. 0.1.69: a package.json entry that is not a valid package name (a typo or a workspace alias) is skipped with a warning instead of stopping the scan; the improvement plan gives New Architecture steps for apps before 0.76. 0.1.68: nativekeel improve and MCP improve_app turn existing findings into a prioritized app improvement plan. Exposed credentials get containment steps; dependency usage and performance signals require context and verification. Static patterns do not establish measured speed or size savings. 0.1.67: the Codex plugin works again without configuration: Codex cannot pass environment variables to a plugin's server, so its boundary is your home folder (or only NATIVEKEEL_MCP_ROOTS on a server you configure yourself). 0.1.66: six native Android source checks: archive paths reaching file writes, incoming nested Intent launches, caller-selected WebView URLs, Intent text reaching SQL, and caller-selected file reads/writes. Explicit exported entry points are correlated with Java/Kotlin source and literal Gradle namespaces; findings state OS protections, prerequisites and verification steps. 0.1.65: npx nativekeel security and MCP security_audit: a focused review of data exposure, account access and code execution risks. Eight new checks trace credentials into telemetry/URLs, external input into eval/SQL, unsafe OAuth settings and broad private FileProvider paths. Findings show evidence, attacker prerequisites, a fix and a verification step; zero findings never certifies security. 0.1.64: stricter MCP file boundaries, validated dependency names, and malware stop warnings preserved across scan, plan, error and verify tools. New checks flag Firebase writes guarded only by sign-in and unconditional Supabase row policies. These are source findings, not proof of deployed exploitability. Plugin servers now require explicit NATIVEKEEL_MCP_ROOTS. 0.1.63: a Codex plugin (codex plugin marketplace add AlicanAkyol/nativekeel) with the MCP server and the same skill as the Claude Code plugin. 0.1.62: npx nativekeel verify and the verify_upgrade MCP tool: after an upgrade, what got fixed and what is new compared with the last commit; exits 1 on new critical or high findings. 0.1.61: npx nativekeel explain "<error>" and the explain_error MCP tool: what a build, launch, crash or store-review error means, the fix, and where your project is affected. 0.1.59: the upgrade plan lists what changes in the next React Native and Expo versions in your own code. 0.1.57: a Claude Code plugin (claude plugin marketplace add AlicanAkyol/nativekeel) that adds the MCP server and tells Claude when to use it, one-click install for Cursor and VS Code. 0.1.56: warns before you run a project with planted malware (a VS Code task that runs on folder open, code hidden after a long run of spaces in babel.config.js, JavaScript disguised as a font), the trick behind fake job tests sent to developers. Found in 4 open-source repositories during our weekly scan. 0.1.55: listed in the official MCP Registry (io.github.AlicanAkyol/nativekeel). Recent releases added a Start here list in every report, hacking risks mapped to OWASP MASVS, crash and performance checks. Every check is tuned on 850+ open-source React Native and Expo apps, with recently updated ones added every week, to keep false alarms out (what we found in them). All releases →
Summary 4 critical · 4 high · 6 medium · 6 low
Security (OWASP MASVS) crypto 1 · network 1 · code 1 · 7 finding categories; not a compliance verdict
Start here
1. Revoke the AWS access key ID in src/App.js:6 at the provider today.
2. Set targetSdkVersion = 36 and compileSdkVersion = 36 in android/build.gradle.
3. Replace @react-native-community/push-notification-ios: no New Architecture support, unmaintained.Could someone steal data or abuse the app?
npx nativekeel security . --html security.html --fail-on highReview secrets, credential leaks, backend access rules, unsafe code execution, transport and dependency risks in one report. New flow/configuration findings show where the input enters, where it is used, what an attacker would need, and how to verify the fix. --offline keeps the scan offline and skips online advisory checks. No source code is uploaded.
This is source analysis, not a live attack or a security certificate. Security checks and scope · Mobile flow details · Native Android details.
Related MCP server: rn-devtools-mcp
What it checks
Upgrade
Is your React Native / Expo version still supported? React Native supports the latest three minors; in Expo projects React Native moves with the SDK.
Can you upgrade at all? The legacy architecture was removed in 0.82. If the New Architecture is off (it is off by default before 0.76), you are stuck at 0.81.
Which packages block the upgrade? Native modules without New Architecture support (cross-checked with the package's own codegen spec), unmaintained or with no release in years, with verified alternatives and renamed packages. Library versions for each step come from the libraries' own compatibility tables.
Which packages might be unused? Installed packages with no import, native reference, requirement or patch found. Listed for review, not automatic removal: dynamic and generated usage can hide from a static scan.
Store
Will Google Play and the App Store accept your next build?
targetSdk, permissions Google Play restricts (photo/video, all files, background location, app installs, SMS), 16 KB memory pages (it also opens your built APK/AAB and checks every native library), the iOS privacy manifest and SDKs too old to have one, missing Info.plist usage descriptions, sign-up without account deletion, social login without Sign in with Apple, and release builds signed with the debug key.
Crashes
Will it crash at runtime? packages off the versions your Expo SDK expects, release builds that still point at a development server, native libraries that need a newer React Native, Reanimated without its Babel plugin or
react-native-worklets, mixed@react-native-firebase/*or@react-navigation/*majors, a second copy of React or React Native inside a dependency, Kotlin modules that cannot load through the New Architecture interop layer, AppDelegate setups that crash in Release, camera/photos/location access without the Info.plist text iOS requires, imports of APIs removed from React Native core (AsyncStorage,Picker,ViewPropTypes, …) or deprecated for removal (ImageBackground,SafeAreaView), and traps learned from real upgrades.
Security, grouped by OWASP MASVS
Secrets in the app or the repo: AWS, Stripe, OpenAI, Anthropic, GitHub, Slack, SendGrid, Twilio, Shopify, Google OAuth and Supabase
service_rolekeys, private keys,.envvalues compiled into the bundle, Expoextra/EXPO_PUBLIC_/eas.jsonsecrets, signing keys and passwords.Data on the device: iOS file sharing (
UIFileSharingEnabled) that exposes an unencrypted MMKV, expo-sqlite or Realm database (they live in Documents by default on iOS), passwords that flow into crash reports, analytics, databases or plain AsyncStorage (followed through variables), auth tokens in unencrypted storage, Android backups that copy them.Network: TLS certificate checks turned off in native code, cleartext HTTP,
NSAllowsArbitraryLoads, plain-HTTP API calls, user-installed CAs in release.Backend rules: Firebase Realtime Database, Firestore and Storage rules open to anyone or in test mode; Supabase tables created without row level security; sign-in-only Firebase write rules and unconditional Supabase UPDATE/DELETE policies without row ownership checks. Policy findings include file/line evidence and explain deployment/grant assumptions.
Authentication: biometric prompts (Face ID, Touch ID, fingerprint) whose success is only a yes/no in JavaScript, with no secret bound to biometrics in the keychain/keystore, in JS or native code: the prompt guards the screen, not the data.
Cryptography: hardcoded encryption keys, MD5/SHA-1 on passwords, ECB mode,
Math.randomfor nonces and salts.Platform: WebViews that read local files or load HTTP into HTTPS, Android components any app can start, unverified deep links and the template
myapp://URL scheme.Dependencies and reverse engineering: known vulnerabilities in the exact versions you ship (GitHub Advisory Database), source maps in the app, Hermes or R8 off.
These are static checks: they catch the common, detectable mistakes, not everything a penetration test of the running app and backend would.
Performance
What is your release bundle actually made of?
npx nativekeel bundlereads the source map a release build already wrote (Android:android/app/build/generated/sourcemaps/react/release/, Expo:npx expo export --dump-sourcemap) and measures how much of the shipped code is your app and each package, and which packages are bundled twice.--base old.mapcompares two builds: what was added, removed or grew. Nothing is built or run; the normal scan picks the map up too.Where should you investigate performance? Nested list patterns, JavaScript animation settings, source logging calls, root
lodash/momentimports, referenced images over 500 KB, JSON over 300 KB imported into the JavaScript bundle (every language's translations, Lottie animations), and selector allocation patterns. Confirm the actual components, release output and runtime behavior before changing them; these checks do not measure frame rate, startup time or savings. AccessibilityCan everyone use it? Icon-only buttons with no accessibility label (VoiceOver and TalkBack say just "button"), buttons smaller than 44×44 with no
hitSlop, text and placeholders whose color and background (both set in the code) fall below WCAG contrast, text fields with no label or placeholder, and text scaling turned off for the whole app.Text.defaultPropsis flagged too: React 19 (React Native 0.78+) ignores it in JSX, so app-wide fonts and font-scaling limits silently stop applying. Only React Native's own touchables and inputs are checked; custom components, focus order and color contrast still need a test with a screen reader.
App improvement review
npx nativekeel improve /path/to/app --offline
npx nativekeel improve /path/to/app --offline --out IMPROVE.mdExisting security, stability, performance, store and dependency findings become an ordered plan with reasons, applicability conditions, actions, verification and recovery. Exposed credentials get containment instructions. Apparently unused dependencies are review candidates: direct, transitive, dynamic, native and generated consumers must be considered before removal. Performance signals are not measurements.
Use --json for structured output or MCP improve_app. Malware findings block execution-dependent actions. Unknown runtime, backend, accessibility and reliability coverage stays explicit. This adds a decision layer over existing checks, not new vulnerability detectors. See scope and next modules.
Usage
npx nativekeel [path] # report
npx nativekeel plan --out UPGRADE.md # step-by-step upgrade plan
npx nativekeel --html report.html # shareable HTML report
npx nativekeel --markdown pr.md # summary for a pull request comment
npx nativekeel --sarif nk.sarif # GitHub code scanning
npx nativekeel --sonar nk-sonar.json # SonarQube external issues
npx nativekeel --json # machine-readable output
npx nativekeel --fail-on high # exit 1 on high or critical (default: critical)
npx nativekeel --offline # no network at all, local checks only
npx nativekeel --verbose # list every outdated package
npx nativekeel fleet ~/clients # every app in a folder side by sideEverything is free. The scan exits with code 1 when it finds a critical issue, so it can gate CI.
Upgrade plan
nativekeel plan turns the report into ordered work: stop leaks, set up a safety net of UI flows, fix crash risks, meet store deadlines, close security gaps, replace blocking packages, switch on the New Architecture at the right point, then upgrade React Native (or the Expo SDK) in small, reviewable hops with links to the Upgrade Helper diffs and the library versions each hop needs. Performance fixes and routine updates come last.
GitHub Action
# .github/workflows/nativekeel.yml
name: NativeKeel
on: [pull_request]
permissions:
contents: read
security-events: write # only needed with sarif: true
jobs:
health:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with: { node-version: 20 }
- run: npm ci
- uses: AlicanAkyol/nativekeel@v0
with:
fail-on: critical
baseline: .nativekeel-baseline.json # optional
sarif: true # findings inline in the PRThe report is added to the job summary. To also keep one comment on each pull request up to date with what that pull request adds or fixes, give the job pull-requests: write and set pr-comment: true:
permissions:
contents: read
pull-requests: write
# …
- uses: AlicanAkyol/nativekeel@v0
with:
pr-comment: trueThe comment compares the pull request with its base commit (no code runs) and is edited in place on every push, not repeated. Pull requests from forks get a read-only token, so they get the job summary only.
With a baseline, only findings that are new since the baseline fail the build:
npx nativekeel --save-baseline .nativekeel-baseline.json # commit this fileUse with AI coding agents (MCP)
Let Claude Code, Codex, Cursor, VS Code or any MCP client ask NativeKeel what is wrong with a project, how to upgrade it, and which version of a library works with your React Native version, instead of guessing. With it installed, the agent checks the project before it upgrades React Native or Expo, adds a native library, prepares a store release, or runs a project you did not write.
Claude Code (plugin: the MCP server plus a skill that tells Claude when to use it):
claude plugin marketplace add AlicanAkyol/nativekeel
claude plugin install nativekeel@nativekeelOr the MCP server alone: claude mcp add nativekeel -- npx -y nativekeel@latest mcp
Codex (plugin: the MCP server plus the same skill):
codex plugin marketplace add AlicanAkyol/nativekeel
codex plugin add nativekeel@nativekeelOr only the MCP server, in ~/.codex/config.toml:
[mcp_servers.nativekeel]
command = "npx"
args = ["-y", "nativekeel@latest", "mcp"]Any other agent, no MCP needed: add this line to your project's AGENTS.md or CLAUDE.md:
Before upgrading React Native or Expo, adding a native library, or preparing a store release, run `npx -y nativekeel@latest --json` and fix the critical and high findings first.Also listed in the official MCP Registry as io.github.AlicanAkyol/nativekeel.
Tools: scan_project (findings with file:line and fixes), measure_bundle (what the release bundle is made of, from its source map), upgrade_plan (ordered steps), check_library (latest version, New Architecture support, maintenance, the range that works with a given React Native version, known traps) explain_error (what a build, launch, crash or store-review error means, the fix, and where this project is affected) and verify_upgrade (after an upgrade: what got fixed and what is new compared with the last commit). Without MCP: npx nativekeel explain "<error>" --path . and npx nativekeel verify. The server is read-only and only scans folders under the directory it was started in, plus NATIVEKEEL_MCP_ROOTS (set it when your client starts servers from another folder). Results omit source files and non-package project names. Common instruction-like patterns are filtered, but this is not a complete prompt-injection defense. Malware findings stop upgrade plans; verify_upgrade.ok means no new serious findings, while safety.blocked separately reports current malware. Servers started inside a plugin folder (Codex) use your home folder as the boundary, or only NATIVEKEEL_MCP_ROOTS when it is set. See SECURITY.md.
Ratings and several apps at once
Every report rates six areas from A to E, the way SonarQube rates code: Security, Store, Stability, Upgrade, Performance, Accessibility. A means the scan found nothing in that area, B only low findings, C medium, D high, E at least one critical. A rating describes what the scan found, not a guarantee.
npx nativekeel fleet [folder ...] scans every React Native and Expo app under the folders you give it (client projects side by side, or all apps in a monorepo) and shows them in one table, worst first: versions, the six ratings, critical and high counts, and the store and end-of-support deadlines each app faces. --html fleet.html saves it as a page you can share, --markdown and --json work too, and --fail-on applies across all apps.
npx nativekeel fleet ~/clients --html fleet.html --brand "Acme Mobile"
npx nativekeel fleet ~/clients --json > fleet-2026-10.json # keep this month's run
npx nativekeel fleet ~/clients --base fleet-2026-10.json # next month: what changed per appWith --base, every app shows what changed since that run ("Security D→B, critical 2→0"), and new or removed apps are listed. npx nativekeel compare before.json after.json does the same for one app, ratings included.
Every app in a GitHub organization, monthly: copy examples/fleet-workflow.yml to .github/workflows/ in any repository of the organization. On the 1st of each month it clones the repositories on the runner, scans them, compares with last month and writes the table to the run summary, with fleet.html and fleet.json kept as the run's artifact. Private repositories need a read-only FLEET_TOKEN secret; NativeKeel uploads nothing.
Already on SonarQube? npx nativekeel --sonar nativekeel-sonar.json writes the findings in SonarQube's generic issue format; pass it to the scanner with -Dsonar.externalIssuesReportPaths=nativekeel-sonar.json (or set sonar: nativekeel-sonar.json on the GitHub Action). Security findings arrive as vulnerabilities, store rules and crash risks as bugs, upgrade and other findings as code smells, each on its file and line. Tested on SonarQube Community Build 26.10. Details: nativekeel.com/sonarqube.
In a pull request, the GitHub Action's comment (pr-comment: true) starts with a quality gate (passed when the change adds no critical or high finding) and the ratings, with what changed.
A .nativekeel.json next to package.json keeps the team's decisions in the repository: the gate level, and findings the team has accepted, each with a reason. --fail-on still wins. Ignored findings stay listed in the report, and malware warnings cannot be ignored.
{
"failOn": "high",
"ignore": [
{ "id": "flipper", "reason": "Removed in the 0.80 upgrade, sprint 42" },
{ "id": "a11y-small-touch-target*", "reason": "Design review in November" }
]
}Team panel (closed beta). With --upload (or the Action's panel-token input) and your team's token in NATIVEKEEL_TOKEN, each scan sends a summary to your team's page on nativekeel.com: app name, versions, ratings, finding titles. No source code and no finding details; never with --offline. Live demo · join the beta: hello@nativekeel.com.
Looking after many apps? Tell us what your team needs: hello@nativekeel.com
Reports for clients
Agencies can put their own name on the HTML report: npx nativekeel plan --html plan.html --brand "Acme Mobile".
Why you can run this on private code
Your code never leaves your machine. The only requests are package-name lookups on npm and React Native Directory, and one request to npm's advisory endpoint with the names and exact versions of your runtime dependencies (what
npm auditsends). In Expo projects withoutnode_modules, one request to unpkg for the versions your Expo SDK expects (only theexpoversion is sent).--offlinemakes none; a test trapsfetchto prove it.Zero dependencies, no install scripts. Only Node.js built-ins.
Read-only. It never changes your project.
Safe on untrusted projects. It never runs project code, and a repository's own git config cannot make the scan run a command.
Secrets are always masked in every output.
Verifiable releases. Published with npm provenance from GitHub Actions:
npm audit signatures.
Details and vulnerability reporting: SECURITY.md. Wrong or missed finding? Tell us, no code needed.
Expert help
The tool is free and stays free. If your team would rather hand an upgrade over, the maintainer takes on a few projects at a time: send your report to hello@nativekeel.com. How it works.
License
MIT
Available Tools
8 toolscheck_libraryARead-onlyIdempotent
What to know about one React Native library before adding or upgrading it: latest version, New Architecture support and maintenance status (React Native Directory), the version range that works with a given React Native version where NativeKeel has a compatibility table, replacements, and known traps.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | npm package name of the library, for example react-native-reanimated or @react-native-async-storage/async-storage. | |
| react_native | No | React Native version to check against, for example 0.88 or 0.88.0. Optional: without it only the general facts are returned. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and openWorldHint, so safety is covered. The description adds genuinely useful context beyond that: the data sources (React Native Directory, NativeKeel's compatibility table) and the coverage caveat 'where NativeKeel has a compatibility table', which warns results may be partial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One front-loaded sentence with a colon introducing a scannable list of returned facts; no filler or repetition. It is dense and long-ish for a single sentence, but every clause carries content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description must carry the return-value burden, and it does so by enumerating the fields returned plus the caveat about compatibility-table coverage and the no-version case. It stops short of stating result format or how missing data is surfaced, but an agent has enough to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and both parameter descriptions already explain the npm package name format and that react_native is optional with only general facts returned otherwise. The description restates the react_native purpose ('the version range that works with a given React Native version') but adds no syntax or format detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('check_library' → what to know about one React Native library) and enumerates the exact facts returned: latest version, New Architecture support, maintenance status, compatibility range, replacements, known traps. This is clearly distinguishable from siblings like upgrade_plan or verify_upgrade without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'before adding or upgrading it' gives a concrete decision point for invoking the tool, which is more than implied usage. It does not name an alternative (e.g., upgrade_plan) or state when not to use it, so it falls short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
explain_errorARead-onlyIdempotent
Explain a React Native or Expo build, launch, crash or store-review error: what it means and the fix, from errors NativeKeel has reproduced or verified against Apple, Google, Expo and React Native documentation. Pass the error message (or the failing part of the log) and, optionally, the project path to see where this project is affected. Call it before searching the web or changing versions.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Folder of the React Native or Expo app, to point at the place in this project the error comes from. Optional. | |
| error | Yes | The error message or the relevant part of the build log. | |
| offline | No | Default true: the project check runs without network requests. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish the safety profile (readOnly, idempotent, non-destructive, closed-world), so the bar is lower; the description adds the provenance of answers (errors NativeKeel reproduced or verified against Apple, Google, Expo and React Native docs) and the offline default for the local check. What it does not disclose is the failure mode when no verified match exists, or the response shape. Good added context, but not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, zero padding: capability first, then how to supply input, then the ordering directive. Each sentence earns its place and the most decision-relevant content is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does carry the burden of describing results and it does so at a high level ('what it means and the fix'). Combined with 100% schema coverage and full annotations, an agent has what it needs to invoke it correctly; only the shape of the returned explanation/absence of a match is left unspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters, including that 'path' points at where in the project the error originates and that 'offline' defaults to true. The description restates the error/path usage ('the failing part of the log', 'see where this project is affected') with only marginal added meaning, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('explain') and a precisely scoped resource (React Native or Expo build, launch, crash or store-review errors), plus what the answer contains ('what it means and the fix'). This clearly differentiates it from the scan/audit/upgrade siblings, which all operate on the project rather than on an error text.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a concrete triggering condition (you have an error message or failing log) and an ordering directive: 'Call it before searching the web or changing versions.' That is real when-to-use guidance. It does not, however, name or exclude any sibling tool, nor state what to do if this tool returns no verified match, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
improve_appBRead-onlyIdempotent
Prioritize existing security, crash, accessibility, performance, store and dependency findings into a review plan with prerequisites, expected effects and validation. No project code runs, no automatic changes or unmeasured performance claims. Reports unassessed areas explicitly.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Folder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read. | |
| offline | No | true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only, idempotent, non-destructive and open-world behavior. The description adds real context beyond them: no project code is executed, no automatic changes are made, no unmeasured performance claims are produced, and unassessed areas are reported explicitly. Only the source and freshness of the 'existing findings' remains undisclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences with the core action front-loaded, followed by scope exclusions and a disclosure guarantee. Every sentence carries information; there is no filler, though the negation clauses are slightly dense.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description explains the output artifact well and covers behavioral scope, which is important given there is no output schema. However, for an aggregator tool it never states where the 'existing findings' come from or whether prior sibling runs are a prerequisite, leaving a meaningful workflow gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and both parameters (path, offline) are documented in the schema, including the network lookups the offline flag suppresses. The description adds no parameter-level meaning of its own, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (prioritize) and a concrete resource (existing security, crash, accessibility, performance, store and dependency findings) and specifies the artifact produced (a review plan with prerequisites, expected effects and validation). It does not, however, distinguish itself from siblings like security_audit, scan_project or upgrade_plan, so the agent must infer the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'existing ... findings' hints that this tool consumes results produced elsewhere, but no alternative is named and no condition for choosing this tool over security_audit, upgrade_plan or scan_project is given. The agent is left to infer when this step belongs in the workflow.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
measure_bundleARead-onlyIdempotent
What the release JavaScript bundle of a React Native or Expo app is made of, measured from the source map a release build already wrote (Hermes bytecode maps included): bytes and share for the app code and each package, packages bundled more than once, and the largest JSON. With base (an older map), what was added, removed or changed size since that build. Nothing is built or run; returns found:false with how to produce a map if there is none.
| Name | Required | Description | Default |
|---|---|---|---|
| map | No | Source map of the release bundle, relative to path (for example android/app/build/generated/sourcemaps/react/release/index.android.bundle.map). Optional: without it the usual React Native and Expo output folders are searched. | |
| base | No | An older release source map, relative to path, to compare against: the result then lists packages added, removed or changed in size. Optional. | |
| path | Yes | Folder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent, non-destructive, closed-world). The description adds genuinely new behavioral context: nothing is built or run, and a missing map yields found:false with remediation guidance. It stops short of permission or performance details, so not a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads what is measured, then the diff behavior, then the no-build/error fallback — a logical order with no filler. It is dense and long, but each clause carries information an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does the work of describing returns: bytes and share per package, duplicate packages, largest JSON, diff results, and the found:false shape. Complete enough to call correctly, though it could be more explicit about the failure payload structure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so all three parameters are already documented in the schema (including the map default-search behavior and the base diff semantics). The description restates the base-comparison outcome without adding syntax or format detail beyond it, matching the baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (measure) and resource (release JavaScript bundle composition) plus the exact data source (the source map a release build already wrote). Clearly separable from siblings like scan_project or check_library, which inspect different artifacts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear conditional context: pass base to get a diff against an older build, and the map param is optional because standard RN/Expo output folders are searched. No explicit when-not or named alternative tool, but siblings do not overlap enough to require it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_projectARead-onlyIdempotent
Health check for a React Native or Expo project: upgrade blockers, New Architecture, Google Play and App Store rules (target SDK, 16 KB pages, Xcode 27 UIScene, privacy manifests), crash risks, accessibility (unlabeled icon buttons and text fields, small touch targets, low text contrast, text scaling), OWASP MASVS security findings, leaked secrets, and signs of malware planted in the project (run it before installing or starting a project you did not write). Read-only, never runs project code; returns findings with file:line references and fixes, never source code.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Folder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read. | |
| offline | No | true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false. | |
| min_severity | No | Lowest severity to return: critical, high, medium, low or info. Default low. | low |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnly/idempotent/non-destructive, and the description adds genuinely new behavioral facts beyond them: it never executes project code, and results are findings with file:line plus fixes rather than source code. It does not mention runtime cost or result volume for what is a potentially slow, network-touching scan, so it just misses a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded in the opening clause, and both the safety disclaimer and the return-format note come after. The long parenthetical check inventory is dense but each item helps an agent judge coverage, though it flattens into a single run-on sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description correctly steps in to state what is returned (findings with file:line and fixes, never source code) and what is not done (no code execution). It leaves open how results are paginated or how long a scan takes, which matters for a tool that may make network calls.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents path, offline, and min_severity. The description adds only an indirect hint about severities via the check list and does not clarify the offline/network interaction or severity filtering beyond what the schema states, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names the specific resource (React Native / Expo project) and verb (health check) and then enumerates the exact check categories, so an agent can distinguish it from focused siblings like security_audit, check_library, or measure_bundle without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly gives a triggering condition: 'run it before installing or starting a project you did not write.' That is real when-to-use guidance, but it names no alternative tool and offers no when-not-to-use rule, so sibling routing (e.g. full scan vs. security_audit) is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
security_auditARead-onlyIdempotent
Review mobile app data exposure, account access, unsafe code execution, backend rules and dependency risks. Returns source evidence, attacker prerequisites, fixes, validation steps and explicit coverage limits. Static and read-only; does not claim a live penetration test or a clean bill of health.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Folder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read. | |
| offline | No | true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false. | |
| min_severity | No | Lowest severity to return: critical, high, medium, low or info. Default low. | low |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false and openWorldHint=true, so the safety profile is covered. The description adds real context beyond that: it discloses the output shape (source evidence, attacker prerequisites, fixes, validation steps), states it is static, and explicitly bounds its claims with 'explicit coverage limits'. It stops short of describing pagination or runtime behavior, so a 4 rather than 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences with no filler; the purpose is front-loaded and the caveats follow. Slightly compressed, but every sentence carries distinct information (scope, returns, limitations).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description correctly steps in to describe what comes back (evidence, prerequisites, fixes, validation steps, coverage limits). Combined with the scope disclaimer, an agent has enough to call it correctly, though the relationship to sibling tools remains unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so path, offline and min_severity are already fully documented, establishing the baseline of 3. The description adds only indirect signal (dependency risks hinting at the offline lookups), which does not meaningfully extend the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Review') and enumerates concrete resource domains (data exposure, account access, unsafe code execution, backend rules, dependency risks) for a mobile app. The scope is clear enough to distinguish it from generic siblings like measure_bundle or upgrade_plan, but it never explicitly contrasts itself with the closest sibling, scan_project.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The closing sentence sets a boundary ('does not claim a live penetration test or a clean bill of health'), which implicitly tells the agent when this tool is appropriate versus a real pentest. However, it gives no positive when-to-use cue and never names an alternative sibling (e.g. scan_project or check_library) for overlapping checks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
upgrade_planARead-onlyIdempotent
Ordered, step-by-step upgrade plan for a React Native or Expo project: phases in the order to do them (security fixes, crash risks, store deadlines, React Native and Expo upgrades, library replacements), the reason for each phase and concrete steps with file names. Built from the same scan as scan_project; stops with a warning if the project contains planted malware. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Folder of the React Native or Expo app (the one with package.json), absolute or relative to the workspace. Must be inside the folders this server may read. | |
| offline | No | true: make no network requests (skip the npm and React Native Directory lookups behind version, maintenance and vulnerability checks). Default false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description's trailing 'Read-only' adds nothing. What does add value is the disclosure that the tool stops with a warning if planted malware is found, and that it reuses the scan_project computation — real behavioral context beyond the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the deliverable, then the phase contents, then the provenance and malware caveat. The long parenthetical phase list is dense but informative, and the closing 'Read-only' is a small piece of redundancy against the annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the return-value burden well: it explains that the plan is phased, ordered, reason-annotated, and includes concrete steps with file names. Combined with the malware-warning behavior and the scan provenance, an agent has everything needed to call and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both `path` and `offline` are already fully documented in the schema, including the network-skip semantics of offline. The description adds no additional parameter meaning, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a concrete deliverable — an ordered upgrade plan for React Native/Expo projects — and enumerates the phases it contains (security fixes, crash risks, store deadlines, RN/Expo upgrades, library replacements). It also distinguishes itself from its closest sibling by noting it is 'built from the same scan as scan_project,' so an agent can tell the two apart without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear contextual framing (derived from the scan_project scan, with a malware short-circuit) that implies when the tool is appropriate. However, it never explicitly states when to prefer it over siblings like verify_upgrade or improve_app, nor does it name any exclusion conditions, so it falls short of full alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_upgradeARead-onlyIdempotent
Check a change before committing it: compares the React Native or Expo project as committed at a git revision (default HEAD) with the working tree, and lists what got fixed, what is new and how versions moved. Call it after an upgrade or a dependency change. Read-only: the committed version is unpacked into a temporary folder outside the project and deleted.
| Name | Required | Description | Default |
|---|---|---|---|
| base | No | Git revision to compare with: HEAD (default), HEAD~1, a branch, tag or commit SHA. | HEAD |
| path | Yes | Folder of the React Native or Expo app, inside a git repository. | |
| offline | No | Default true: both sides are scanned without network requests. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true and destructiveHint=false, so the safety profile is largely covered. The description adds genuinely new behavior: the committed revision is unpacked into a temporary folder outside the project and deleted, telling the agent about filesystem side effects and cleanup. It stops short of describing the result format in detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, front-loaded with the core comparison action, followed by the invocation trigger and the read-only side-effect note. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description compensates by naming the three categories of result (fixed, new, version movement). Combined with the read-only guarantee and the usage trigger, an agent has everything needed to call this correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, but the description adds real meaning: it explains that the comparison is revision-vs-working-tree and that the revision defaults to HEAD, clarifying what 'base' and 'path' actually do together. It adds context beyond the field descriptions without introducing syntax detail the schema lacks.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a precise action ('compares the React Native or Expo project as committed at a git revision with the working tree') plus the concrete outputs ('what got fixed, what is new and how versions moved'). This clearly separates it from siblings like upgrade_plan (planning) and scan_project (static analysis).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the trigger condition: 'Call it after an upgrade or a dependency change.' That gives a clear usage context, but it never names an alternative or an exclusion (e.g. when to prefer upgrade_plan), so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
8 tool updates
v0.1.0- First observed
check_library - First observed
explain_error - First observed
improve_app - First observed
measure_bundle - First observed
scan_project - First observed
security_audit - First observed
upgrade_plan - First observed
verify_upgrade
TDQS
Scored across 8 tools
Most tools target distinct activities (library lookup, error explanation, bundle measurement, change verification), and the descriptions are unusually detailed. However, scan_project and security_audit both surface security findings, and improve_app and upgrade_plan both transform scan findings into a prioritized plan, so the boundaries between those pairs are somewhat blurry.
All eight tools use consistent snake_case with a verb_noun pattern (check_library, explain_error, measure_bundle, scan_project, upgrade_plan, verify_upgrade). Only security_audit is a noun phrase rather than verb_noun, a trivial deviation that remains perfectly readable.
Eight tools is well within the ideal 3-15 range and each maps to a recognizable part of the React Native/Expo project-health workflow. No tool feels redundant filler or conspicuously absent.
The surface covers the main lifecycle: library compatibility, error diagnosis, project scanning, security review, bundle analysis, upgrade planning, and change verification. The intentionally read-only design means no apply/fix tool exists, which is a minor gap agents can work around by following the returned plans.
Maintenance
Related MCP Connectors
Drive and test your React Native and Expo apps end-to-end on iOS and Android. Supports real devices, simulators, and emulators. Snapshots, taps, typing, swipes, screenshots, deep links, reloads, builds and runtime errors.
Free, read-only ship-readiness check for Replit, Lovable and Bolt apps.
21Your Expo and EAS project in natural language: up to date SDK docs, cloud builds (status, logs, trig
Compliance & security scan for your app: secrets, exposed files, headers, privacy, AI-disclosure.
Related MCP Servers
- AlicenseAqualityCmaintenanceProvides comprehensive tools for React Native development, automating project initialization, version management, upgrades, Expo integration, and development workflows through AI assistance.223 npm21MIT
- AlicenseNot gradedqualityBmaintenanceEnables AI assistants to inspect React Native app performance including memory, rendering, frames, and network requests, providing plain-language summaries and shareable reports.3 npmMIT
- FlicenseNot gradedqualityBmaintenanceBridges your IDE to a running React Native/Expo mobile app over local Wi-Fi, providing live device status, app logs, and a combined standup snapshot.-
- FlicenseNot gradedqualityCmaintenanceA secure local MCP server that allows AI assistants to inspect and diagnose Expo-based React Native projects, offering read-only tools for project summary, doctor checks, dependency validation, and public config retrieval.2-