NativeKeel is a comprehensive, open-source command-line tool designed to keep React Native and Expo applications shippable by identifying upgrade blockers, security vulnerabilities, store rejection risks, and stability issues. Developed by a veteran software engineer with over 14 years of production experience in mobile and backend development, NativeKeel serves as a health-check engine that runs entirely on the user's local machine, ensuring that code and secrets remain private. It bridges the gap between development environments and production requirements by flagging problems that typically only surface during build time or store review.

The tool functions as an automated analysis engine that inspects your application's source code, native project files, configuration, and dependencies. It performs over 100 checks, ranging from identifying leaked API keys and unsafe database rules to detecting deprecated native API calls and screen reader accessibility shortcomings. By analyzing the dependency tree and lockfiles, NativeKeel catches vulnerabilities and architecture blockers, such as missing New Architecture support in native modules, which are common hurdles for developers upgrading their projects.

Some of the key features are:

• Upgrade Readiness: Automatically generates a step-by-step migration blueprint to guide developers through major React Native or Expo version upgrades.
• Security Audits: Scans for OWASP MASVS security findings, including exposed credentials, insecure network configurations, and database policy vulnerabilities.
• Store Compliance: Validates projects against Apple and Google Play store requirements, such as Xcode 27 UIScene adoption, privacy manifests, and target SDK levels.
• Stability Checks: Detects crash-prone native code patterns and dependency mismatches that lead to runtime failures in release builds.
• CI/CD Integration: Supports GitHub Actions, SonarQube, and quality gates to prevent new regressions from being merged into production branches.
• AI Agent Support: Operates as an MCP server for AI coding agents like Claude Code, Cursor, and Codex, providing them with ground truth about the project's health.
• Performance Review: Analyzes release bundle composition from source maps to identify unnecessary bloat and inefficient import patterns.
• Local Execution: Prioritizes privacy and security by ensuring all scans occur locally without sending source code or telemetry data to external servers.

Operationally, NativeKeel is invoked via the command line using npx nativekeel. Users can run a full health check, generate structured reports (HTML, Markdown, JSON, SARIF), or use specialized sub-commands like upgrade to see breaking changes or fleet to monitor multiple projects across a team or agency. The tool is highly configurable, allowing teams to set quality gates and define ignored findings using a .nativekeel.json file in their repository root.

Some common use cases include:

• Pre-Upgrade Analysis: Identifying breaking changes and native code modifications required before beginning a major React Native version update.
• Store Submission Verification: Ensuring an app meets all technical criteria for the App Store and Google Play before submission to avoid costly rejections.
• Team Quality Management: Maintaining consistent code quality across multiple client projects or monorepos by enforcing a unified gate for security and performance.
• AI-Assisted Development: Providing AI agents with deep insights into project structure and library compatibility to generate more accurate code changes.
• Security Hardening: Performing regular scans to detect accidental exposure of API keys, backend admin credentials, or unsafe WebView configurations.