NativeKeel runs on your own machine — the client starts it, so there is no endpoint to ping. 3 175 installs a week from npm. Last commit 31 Oct 2026.
React Native and Expo health check: upgrade blockers, store rules, crash risks, security findings
We read the source, 11 h ago · rules 995398eba69f
A value the model can set ends up inside a file or shell call. That is not a flaw by itself — for a terminal server it is the job — but it is where things go wrong when it is not.
const r = analyzeSourceMap(bounded.readFileSync(path.join(root, file), 'utf8'));
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
const candidate = path.join(dir, 'node_modules', name);
…are not in the app; they only weigh down the repository. Check for a use outside the app (store listing, website), then delete them.`,fix:{kind:"cleanup",step:`Delete images nothing references (${u.slice(0,3).join(", ")}${u.length>3?", \u2026":""}).`},evidence:u.slice(0,20).map(m…
…c:(e,t)=>{let n=rt.default.resolve(e);if(!Xe.has(n))throw pn(e);let s=Xe.get(n);return t?s:new TextEncoder().encode(s)},readdirSync:(e,t)=>{let n=rt.default.resolve(e);if(!Mi(n))throw pn(e);let s=n.endsWith("/")?n:`${n}/`,i=new Map;for(let a of Xe.keys())if(a.startsWith(s)){let c…
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
That is not a flaw by itself — but it is where things go wrong when it is not the job. We re-read this code on every release. Watch it and you hear from us the day another one appears.
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add nativekeel -- npx -y nativekeel
{
"mcpServers": {
"nativekeel": {
"command": "npx",
"args": [
"-y",
"nativekeel"
]
}
}
}
[mcp_servers.nativekeel]
command = "npx"
args = ["-y", "nativekeel"]
{
"mcpServers": {
"nativekeel": {
"command": "npx",
"args": [
"-y",
"nativekeel"
]
}
}
}
{
"servers": {
"nativekeel": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"nativekeel"
]
}
}
}
Optional settings from the registry entry, left out of the block above:
NATIVEKEEL_MCP_ROOTS (Extra folders the server may scan (path-delimited). By default only the folder the client starts it in).
Check a URL live: status, timing, redirect chains and security headers; private hosts blocked
AI-native GRC: compliance scores, security findings, tickets and agent trust tiers.
Live DNS, email-auth and redirect checks, HTTP security headers, uptime history, PC hardware prices.
Free passive security scanning - check any domain's DMARC, TLS, headers, and exposures.
Scan an MCP server or agent configuration for security posture — evidence-bound findings
Grade a site's security headers with fixes and a badge; read logs or code for the defender.
Domain checks: SPF, DKIM, DMARC, BIMI, MTA-STS, SSL/TLS and HTTP security headers.
Scan a public GitHub repo, explain risks, get fix prompts and rescan to confirm fixes.
Answers built from our own checks of this server.