For teams and agencies

Every React Native app you look after, on one page

SonarQube rates code. NativeKeel rates what breaks mobile apps: store deadlines, upgrades that will not build, crashes, leaked keys, screens a screen reader cannot use. The same rules for every app and every pull request, free and on your own machines.

A–E ratings in six areas

Every report rates Security, Store, Stability, Upgrade, Performance and Accessibility, the way SonarQube rates code:

A rating describes what the scan found, not a guarantee. It is in the terminal, HTML, Markdown and JSON reports.

All your apps in one table

npx nativekeel fleet ~/clients --html fleet.html --brand "Your agency"

Point it at a folder of client projects or a monorepo. It scans every React Native and Expo app it finds and puts them in one table, worst first: versions, the six ratings, critical and high findings, and the store and end-of-support deadlines each app faces.

Open the sample page (four fictional apps).

What changed since last month

npx nativekeel fleet ~/clients --json > fleet-2026-10.json   # keep this month's run
npx nativekeel fleet ~/clients --base fleet-2026-10.json     # next month

Each app shows what moved ("Security E→C, critical 4→2"), which apps are new and which are gone. A monthly report for a client is one command. Nothing is stored anywhere except the file you keep.

Every app in your GitHub organization, every month

Copy examples/fleet-workflow.yml to .github/workflows/ in any repository of the organization. On the 1st of each month it clones the repositories on the GitHub runner, scans every React Native and Expo app it finds, compares with last month and writes the table to the run summary. The shareable page and next month's baseline are kept as the run's artifact. Private repositories need a read-only token as a secret; NativeKeel uploads nothing.

A quality gate in every pull request

The GitHub Action keeps one comment up to date on each pull request:

### NativeKeel
Quality gate: ✅ passed, no new critical or high findings.

This pull request: 0 new, 2 fixed compared with 4aef3dc.
Ratings: Security A (was C) · Store B · Stability A · Upgrade D · Performance A · Accessibility C

# .github/workflows/nativekeel.yml
on: pull_request
permissions:
  contents: read
  pull-requests: write
jobs:
  health:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: AlicanAkyol/nativekeel@v0
        with:
          pr-comment: true

Already have findings you cannot fix this sprint? --save-baseline accepts them, and only new ones fail the build.

Team decisions, in the repository

A .nativekeel.json next to package.json sets the gate and lists findings the team has accepted, each with a reason. Ignored findings stay listed in every report, and malware warnings cannot be ignored.

{
  "failOn": "high",
  "ignore": [
    { "id": "flipper", "reason": "Removed in the 0.80 upgrade, sprint 42" }
  ]
}

Why teams can run it on client code

• Your code never leaves the machine. Only package names go to npm and React Native Directory; --offline sends nothing.
• No account, no dependencies, MIT licensed, published with npm provenance.
• Read-only. It never runs project code, and warns before you run a project with planted malware.