# Extension points — strapi/strapi

> Canonical page: https://codevetter.com/unpack/strapi/extension-points

# Extension points — strapi/strapi

Scanned commit 93476f908c08d6d3d5215c06483829e3c6da1b32 (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Extensions are intended to enter through factories, plugin contracts, registries, and lifecycle hooks. Backend and browser plugins have separate registration interfaces. Document middleware, provider capabilities, GraphQL extension configuration, and MCP definitions offer additional integration boundaries. Several APIs enforce registration timing or preserve default behavior through explicit fallback logic.
- createCoreController and createCoreService accept objects or callbacks receiving {strapi}, fill missing methods from defaults, and install base implementations as prototypes. createCoreRouter supports prefix, per-action config, only/except filtering, and route type selection. — [packages/core/core/src/factories.ts#L15-50](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/factories.ts#L15-L50) [packages/core/core/src/factories.ts#L54-114](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/factories.ts#L54-L114)
- Backend plugins can provide register/bootstrap/destroy, configuration defaults/validation, routes, controllers, services, policies, middleware, and content types. Application extensions overlay plugin schemas and may transform the loaded plugin through strapi-server.js. — [packages/core/core/src/loaders/plugins/index.ts#L18-31](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/loaders/plugins/index.ts#L18-L31) [packages/core/core/src/loaders/plugins/index.ts#L34-69](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/loaders/plugins/index.ts#L34-L69) [packages/core/core/src/loaders/plugins/index.ts#L73-94](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/loaders/plugins/index.ts#L73-L94)
- The registries provider installs controllers/services/modules/plugins/custom-fields/APIs and sanitizer/validator registries. It creates beforeSync/afterSync hooks, while Strapi invokes application lifecycle functions with {strapi}. — [packages/core/core/src/providers/registries.ts#L9-35](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/providers/registries.ts#L9-L35) [packages/core/core/src/Strapi.ts#L583-593](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/Strapi.ts#L583-L593) [packages/core/core/src/services/custom-fields.ts#L3-7](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/custom-fields.ts#L3-L7)
- strapi.documents.use registers Document Service middleware around cached per-content-type repositories. The wrapper excludes updateComponents and omitComponentData from normal middleware interception. — [packages/core/core/src/services/document-service/index.ts#L28-60](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/document-service/index.ts#L28-L60)
- Browser plugins register through StrapiApp, adding reducers, menu/settings links, routes, widgets, and hooks. Plugin register runs before custom register; Content Manager demonstrates adding its reducer and lazy route subtree. — [packages/core/admin/admin/src/StrapiApp.tsx#L200-240](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/admin/admin/src/StrapiApp.tsx#L200-L240) [packages/core/admin/admin/src/StrapiApp.tsx#L389-397](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/admin/admin/src/StrapiApp.tsx#L389-L397) [packages/core/admin/admin/src/StrapiApp.tsx#L550-561](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/admin/admin/src/StrapiApp.tsx#L550-L561) [packages/core/content-manager/admin/src/index.ts#L18-46](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/content-manager/admin/src/index.ts#L18-L46)
- Upload providers may implement uploadStream or upload, replaceStream or replace, with delete-then-upload fallback when replacement capabilities are absent. Email providers expose init(options, settings) returning send and optional verification/lifecycle/capability methods. — [packages/core/upload/server/src/services/provider.ts#L13-64](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/upload/server/src/services/provider.ts#L13-L64) [packages/core/email/server/src/bootstrap.ts#L5-17](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/email/server/src/bootstrap.ts#L5-L17) [packages/core/email/server/src/bootstrap.ts#L22-52](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/email/server/src/bootstrap.ts#L22-L52)
- GraphQL extension.use accepts configuration objects or factories receiving strapi, nexus, and typeRegistry. generate combines type definitions, Nexus types/plugins, resolvers, and resolver configuration, alongside a shadowCRUD manager. — [packages/plugins/graphql/server/src/services/extension/extension.ts#L8-20](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/plugins/graphql/server/src/services/extension/extension.ts#L8-L20) [packages/plugins/graphql/server/src/services/extension/extension.ts#L38-93](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/plugins/graphql/server/src/services/extension/extension.ts#L38-L93)
- MCP exposes tool/prompt/resource definition registries but rejects registration once status leaves idle. CLI extensions enter the commands factory array, while authentication strategies register per route type and may provide a verify function. — [packages/core/core/src/services/mcp/index.ts#L66-99](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/mcp/index.ts#L66-L99) [packages/core/strapi/src/cli/commands/index.ts#L37-72](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/strapi/src/cli/commands/index.ts#L37-L72) [packages/core/strapi/src/cli/index.ts#L42-50](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/strapi/src/cli/index.ts#L42-L50) [packages/core/core/src/services/auth/index.ts#L21-24](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/auth/index.ts#L21-L24) [packages/core/core/src/services/auth/index.ts#L49-58](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/auth/index.ts#L49-L58)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)