# Feature catalog — vercel/next.js

> Canonical page: https://codevetter.com/unpack/nextjs/feature-catalog

# Feature catalog — vercel/next.js

Scanned commit 2861a364fcbe75fe96b0b9127f9b335edfcf288c (2026-09-22). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

User-facing surface splits four ways: the `next` CLI subcommands, the runtime request-handling features (App Router, Pages Router, middleware/proxy, server actions, image optimization, RSC prefetching), the sibling npm packages (create-next-app, eslint-plugin-next, codemods, fonts, third-parties, bundle-analyzer UI), and a dev-time developer-experience layer (dev overlay, MCP server, request insights, typegen). Nearly every experimental capability is gated behind a key in `ExperimentalConfig` and mirrored into bundles by `define-env.ts`. Documentation is itself a product: 1153 markdown files including `docs/01-app` + `docs/02-pages` and 258 `errors/*.mdx` pages that the dev overlay deep-links into.
- `next dev` supports self-signed HTTPS (`--experimental-https`, `--experimental-https-key/-cert/-ca` via `createSelfSignedCertificate`), Node inspector passthrough with automatic port+1 remapping for the forked child, and CPU profiling through `--experimental-cpu-prof` writing into a `.next-profiles` directory. — [packages/next/src/cli/next-dev.ts#L45-L63](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/cli/next-dev.ts#L45-L63) [packages/next/src/cli/next-dev.ts#L378-L428](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/cli/next-dev.ts#L378-L428) [packages/next/src/bin/next.ts#L38-L56](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/bin/next.ts#L38-L56)
- A dev-only MCP server is mounted at `/_next/mcp` by both hot reloaders via `getMcpMiddleware`, using `StreamableHTTPServerTransport` with a 1MB body cap, exposing agent tools `compile-route`, `get-compilation-issues`, `get-errors`, `get-logs`, `get-page-metadata`, `get-project-metadata`, `get-request-insights`, `get-routes`, and `get-server-action-by-id`. — [packages/next/src/server/mcp/get-mcp-middleware.ts#L9-L30](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/server/mcp/get-mcp-middleware.ts#L9-L30) [packages/next/src/server/dev/hot-reloader-turbopack.ts#L1271](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/server/dev/hot-reloader-turbopack.ts#L1271) [packages/next/src/server/dev/hot-reloader-webpack.ts#L1721](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/server/dev/hot-reloader-webpack.ts#L1721)
- Request Insights is a dev feature reachable at a dedicated endpoint (`REQUEST_INSIGHTS_DEV_ENDPOINT`) that returns `getRequestInsightsSnapshot()` as JSON, 404s with an explanatory body when `experimental.requestInsights` is off, and is also surfaced as the `next experimental-request-insights` CLI subcommand. — [packages/next/src/server/lib/router-server.ts#L316-L355](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/server/lib/router-server.ts#L316-L355) [packages/next/src/bin/next.ts#L636-L664](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/bin/next.ts#L636-L664) [packages/next/src/cli/next-request-insights.ts](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/cli/next-request-insights.ts)
- Image optimization is a first-class route: `NextNodeServer.handleNextImageRequest` validates params, consults an `ImageOptimizerCache`, and calls `imageOptimizer`/`fetchExternalImage`/`fetchInternalImage`, enforcing `images.localPatterns`, `images.remotePatterns`, http/https-only protocols, and an anti-recursion check on `/_next/image`. — [packages/next/src/server/next-server.ts#L954-L1065](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/server/next-server.ts#L954-L1065) [packages/next/src/server/image-optimizer.ts#L173-L235](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/server/image-optimizer.ts#L173-L235)
- Server Actions ship with built-in CSRF defence: `action-handler.ts` compares the `Origin` header against `x-forwarded-host`/`host`, allows extra hosts via `serverActions.allowedOrigins` through `isCsrfOriginAllowed`, and aborts with `Invalid Server Actions request.` when neither host header is present. — [packages/next/src/server/app-render/action-handler.ts#L506-L545](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/server/app-render/action-handler.ts#L506-L545) [packages/next/src/server/app-render/action-handler.ts#L710-L745](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/server/app-render/action-handler.ts#L710-L745) [packages/next/src/server/app-render/csrf-protection.ts#L69-L90](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/server/app-render/csrf-protection.ts#L69-L90)
- Both routers are live: `server/route-modules/` carries four families — `app-page`, `app-route`, `pages`, `pages-api` — each a `RouteModule` subclass, with `AppPageRouteModule.render()` and `.prerender()` delegating to `renderToHTMLOrFlight` / `prerenderToHTMLOrFlight`. — [packages/next/src/server/route-modules/route-module.ts#L111-L150](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/server/route-modules/route-module.ts#L111-L150) [packages/next/src/server/route-modules/app-page/module.ts#L88-L250](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/server/route-modules/app-page/module.ts#L88-L250)
- Cache Components / PPR is the headline experimental feature: `cacheComponents` is now a top-level config key (the old `experimental.cacheComponents` and `experimental.ppr` are marked `@deprecated`), and enabling it implicitly turns on `experimental.ppr` and `experimental.cachedNavigations`. — [packages/next/src/server/config-shared.ts#L1231-L1234](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/server/config-shared.ts#L1231-L1234) [packages/next/src/server/config-shared.ts#L2126-L2135](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/server/config-shared.ts#L2126-L2135) [test/lib/gate/conditions.ts#L23-L28](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/test/lib/gate/conditions.ts#L23-L28)
- `"use cache"` is backed by a swappable handler registry keyed on `Symbol.for('@next/cache-handlers')` / `-map` / `-set`, with dev-only extras (`-dev-fronts`, `-dev-tiered`, `-private`) and a `DEV_MEMORY_CACHE_SIZE` of 50MB so `cacheMaxMemorySize: 0` does not make dev reloads uncached. — [packages/next/src/server/use-cache/handlers.ts#L14-L95](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/server/use-cache/handlers.ts#L14-L95) [packages/next/src/server/lib/cache-handlers/types.ts#L1-L60](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/server/lib/cache-handlers/types.ts#L1-L60)
- i18n domain routing and locale redirects are handled before render, directly in the router-server request handler, using `detectDomainLocale` + `getLocaleRedirect` and short-circuiting with a `307 TemporaryRedirect`. — [packages/next/src/server/lib/router-server.ts#L358-L405](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/server/lib/router-server.ts#L358-L405)
- `packages/next-codemod` ships 21 named transforms for migrations, including `next-async-request-api`, `middleware-to-proxy`, `metadata-to-viewport-export`, `cra-to-next`, `remove-experimental-ppr`, and `next-lint-to-eslint-cli`, driven by the `next upgrade` subcommand. — [packages/next-codemod/transforms/](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next-codemod/transforms/) [packages/next/src/bin/next.ts#L564-L600](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/bin/next.ts#L564-L600) [packages/next/src/cli/next-upgrade.ts](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/cli/next-upgrade.ts)
- `@next/eslint-plugin-next` exposes 23 rules through a single `plugin.rules` map with two presets — `recommendedRules` (16 warn + 6 error) and `coreWebVitalsRules` which escalates `no-html-link-for-pages` and `no-sync-scripts` to error. — [packages/eslint-plugin-next/src/index.ts#L1-L80](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/eslint-plugin-next/src/index.ts#L1-L80) [packages/eslint-plugin-next/src/rules/](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/eslint-plugin-next/src/rules/)
- Telemetry is opt-out: `Telemetry` stores an `anonymousId` and `telemetry.enabled` in a conf file, disables itself on `NEXT_TELEMETRY_DISABLED`, prints the `https://nextjs.org/telemetry` notice, and is toggled by the `next telemetry` subcommand. — [packages/next/src/telemetry/storage.ts#L16-L155](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/telemetry/storage.ts#L16-L155) [packages/next/src/bin/next.ts#L508-L527](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/bin/next.ts#L508-L527)
- `next typegen` generates route types independently of a full build, backed by `server/lib/router-utils/typegen.ts` and `route-types-utils.ts` / `root-params-type-utils.ts`. — [packages/next/src/bin/next.ts#L529-L545](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/bin/next.ts#L529-L545) [packages/next/src/server/lib/router-utils/typegen.ts](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/server/lib/router-utils/typegen.ts) [packages/next/src/server/lib/router-utils/route-types-utils.ts](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/server/lib/router-utils/route-types-utils.ts)
- The dev overlay is a separate sub-application under `packages/next/src/next-devtools/` with `dev-overlay/`, `userspace/`, `server/`, and `shared/` layers plus a browser entry (`dev-overlay.browser.tsx`) and a shim, and its UX can be killed at build time via `process.env.__NEXT_DISABLE_DEV_OVERLAY_UX`. — [packages/next/src/next-devtools/](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/next-devtools/) [packages/next/src/build/define-env.ts#L161](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/packages/next/src/build/define-env.ts#L161)
- An `evals/` workspace exists for agent evaluation (`evals/next-upgrade`, `eval.config.json`, run via `pnpm eval` / `pnpm eval:upgrade` using `@vercel/agent-eval`), making automated upgrade quality a tracked product surface. — [package.json#L14-L16](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/package.json#L14-L16) [evals/README.md](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/evals/README.md) [evals/eval.config.json](https://github.com/vercel/next.js/blob/2861a364fcbe75fe96b0b9127f9b335edfcf288c/evals/eval.config.json)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)