# Feature catalog — pallets/flask

> Canonical page: https://codevetter.com/unpack/flask/feature-catalog

# Feature catalog — pallets/flask

Scanned commit d73fa1cdcbd8b1465c151db8924ba58b1dd14e35 (2026-09-08). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

As a framework, Flask's user-facing features are its decorator registries, its CLI subcommands, and its request/response conveniences. Route registration spans `@route` plus seven method shortcuts including the newly added `@app.query` for HTTP QUERY; class-based views come via `View`/`MethodView`. The `flask` CLI ships `run`, `shell` and `routes` built in, discovers app-provided commands through `app.cli`/`blueprint.cli`, and loads third-party commands from the `flask.commands` entry point group. Response handling covers strings, bytes, dicts, lists, generators, tuples, WSGI callables and Response objects; JSON is routed through a swappable `JSONProvider`. Sessions, flashing, file sending, streaming, signals and blueprint nesting round out the surface.
- Seven HTTP-method route shortcuts are generated through `Scaffold._method_route`: `get`, `query`, `post`, `put`, `delete`, `patch` (plus `route`); `query` is new in 3.2 for the HTTP QUERY method and is also listed in `views.http_method_funcs`. — [src/flask/sansio/scaffold.py#L284-L342](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/sansio/scaffold.py#L284-L342) [src/flask/views.py#L11-L13](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/views.py#L11-L13) [CHANGES.rst#L32](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/CHANGES.rst#L32)
- `flask run` exposes `--host/-h` (default 127.0.0.1), `--port/-p` (5000), `--cert`/`--key`, `--reload/--no-reload`, `--debugger/--no-debugger`, `--with-threads/--without-threads`, `--extra-files` and `--exclude-patterns`, and inserts `--debug` as its first parameter after definition. — [src/flask/cli.py#L882-L935](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/cli.py#L882-L935) [src/flask/cli.py#L996](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/cli.py#L996)
- `flask shell` builds an interactive REPL banner from `current_app.import_name` and `instance_path`, honours `PYTHONSTARTUP`, wires `rlcompleter.Completer` against the shell context rather than `__main__`, then calls `code.interact`. — [src/flask/cli.py#L999-L1046](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/cli.py#L999-L1046)
- `flask routes` supports `--sort` over `endpoint|methods|domain|rule|match` and `--all-methods`, hides HEAD/OPTIONS by default, and renders a padded ASCII table computed from per-column max widths. — [src/flask/cli.py#L1048-L1107](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/cli.py#L1048-L1107)
- The root CLI group is `FlaskGroup`, which registers three eager options in order (`--env-file`, `--app`, `--debug`) so dotenv loading happens before app import, and sets `auto_envvar_prefix="FLASK"` so every option is also settable via `FLASK_*` env vars. — [src/flask/cli.py#L563-L599](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/cli.py#L563-L599)
- App discovery supports four forms: explicit `module:name`, `module:factory(args)` with `ast.literal_eval`-parsed arguments, auto-detection of `app`/`application`/`create_app`/`make_app`, and implicit `wsgi.py` then `app.py` in the CWD. — [src/flask/cli.py#L41-L89](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/cli.py#L41-L89) [src/flask/cli.py#L120-L196](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/cli.py#L120-L196) [src/flask/cli.py#L333-L370](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/cli.py#L333-L370)
- `Flask.make_response` accepts str/bytes/bytearray, any iterator (streaming), dict and list (auto-JSON via `self.json.response`), `BaseResponse` subclasses, arbitrary WSGI callables, and 2- or 3-tuples of `(body, status)`, `(body, headers)` or `(body, status, headers)`. — [src/flask/app.py#L1284-L1360](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/app.py#L1284-L1360)
- Class-based views: `View.as_view` supports `init_every_request=False` for a shared instance, applies `cls.decorators` in order, and copies `methods`/`provide_automatic_options` onto the generated function; `MethodView.__init_subclass__` auto-derives `methods` from defined handler names and falls back from HEAD to GET. — [src/flask/views.py#L85-L135](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/views.py#L85-L135) [src/flask/views.py#L163-L191](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/views.py#L163-L191)
- Message flashing writes `session["_flashes"]` via a read-append-reassign pattern (deliberately not `setdefault`, so external session backends stay in sync) and emits the `message_flashed` signal; `get_flashed_messages` caches into `app_ctx._flashes` so repeat calls in one request are stable. — [src/flask/helpers.py#L326-L400](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/helpers.py#L326-L400) [src/flask/ctx.py#L322](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/ctx.py#L322)
- Ten Blinker signals are defined in one namespace: template-rendered, before-render-template, request-started, request-finished, request-tearing-down, got-request-exception, appcontext-tearing-down, appcontext-pushed, appcontext-popped and message-flashed. — [src/flask/signals.py#L1-L17](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/signals.py#L1-L17)
- Async views are opt-in: `ensure_sync` returns plain functions unchanged and wraps coroutine functions via `async_to_sync`, which imports `asgiref.sync.async_to_sync` and raises "Install Flask with the 'async' extra" if asgiref is missing. — [src/flask/app.py#L1068-L1103](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/app.py#L1068-L1103)
- Config can be populated six ways: `from_envvar`, `from_prefixed_env` (JSON-decoded `FLASK_*` vars with `__` nesting), `from_pyfile` (exec'd as a module), `from_object` (uppercase attrs only), `from_file` (pluggable loader, text or binary) and `from_mapping`; `get_namespace` extracts prefixed subsets. — [src/flask/config.py#L102-L365](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/config.py#L102-L365)
- Three runnable example apps ship in-repo: `examples/tutorial` (flaskr — sqlite blog with auth blueprint, `init-db` CLI command, 4 test modules), `examples/javascript` (fetch/jQuery/XHR templates) and `examples/celery` (`celery_init_app` subclasses `Task` to push an app context around every job). — [examples/tutorial/flaskr/__init__.py#L1-L47](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/examples/tutorial/flaskr/__init__.py#L1-L47) [examples/tutorial/flaskr/db.py#L1-L55](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/examples/tutorial/flaskr/db.py#L1-L55) [examples/celery/src/task_app/__init__.py#L28-L38](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/examples/celery/src/task_app/__init__.py#L28-L38) [examples/celery/src/task_app/views.py#L1-L38](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/examples/celery/src/task_app/views.py#L1-L38)
- `jsonify` and the module-level `flask.json.dumps/dump/loads/load` all delegate to `current_app.json` when an app context is active, falling back to stdlib `json` otherwise, so provider swaps apply globally. — [src/flask/json/__init__.py#L13-L170](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/json/__init__.py#L13-L170) [src/flask/json/provider.py#L128-L215](https://github.com/pallets/flask/blob/d73fa1cdcbd8b1465c151db8924ba58b1dd14e35/src/flask/json/provider.py#L128-L215)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)