server-action

A generator for Next.js Server Actions, which are server-side functions used to handle changes such as form submissions. It creates the action according to rules for placement, inputs, errors, caching, and redirects.

In plain words
What is it for?
Use it to create actions for form submissions or typed calls from client components, including cache updates and navigation after a change.
Why use it?
It helps avoid mixing server-side mutations with route handlers or data-reading code. It also provides a consistent structure for handling successful and expected-error cases.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/pruthvinathjv/nextjs-claude-code-kit/server-action
Clone the repo
git clone --depth 1 https://github.com/pruthvinathJV/nextjs-claude-code-kit
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 674 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.00674
Opus 5 $0.00000 $0.00337
Sonnet 5 $0.00000 $0.00135
Haiku 4.5 $0.00000 $0.00067

Measured 2d ago against content hash 431a86bd5a2b, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

server-action scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/server-action.md · 76 lines

What it actually says

Generate a Server Action for the following mutation: $ARGUMENTS

Rules for generation:

File placement:

  • If this action is used by a single route, co-locate it in that route's directory as actions.ts
  • If this action is shared across routes, place it in app/actions/ or lib/actions/
  • Always add 'use server' at the top of the file (not inside the function)

Function signature:

  • For form submissions: accept FormData as the parameter
  • For programmatic calls from Client Components: accept a typed object parameter
  • Never accept Request objects — that's a Route Handler pattern, not Server Actions

Return values:

  • Return data directly on success — not { status: 200, data: ... }
  • On expected errors (validation, not found), return { error: string } or throw
  • Use revalidatePath() or revalidateTag() after mutations that should invalidate cached data
  • Use redirect() from next/navigation if the action should navigate after completion

What NOT to generate:

  • No try/catch that swallows errors silently
  • No HTTP status objects
  • No calling other Server Actions from within this Server Action
  • No data fetching (reads) — Server Actions are for writes/mutations only

Example of what to generate:

'use server'

import { revalidatePath } from 'next/cache'
import { redirect } from 'next/navigation'

export async function createPost(formData: FormData) {
  const title = formData.get('title') as string
  const content = formData.get('content') as string

  if (!title || !content) {
    return { error: 'Title and content are required' }
  }

  await db.post.create({ data: { title, content } })
  revalidatePath('/posts')
  redirect('/posts')
}

After generating the action, also generate:

  1. The form or button component that calls it (as a Client Component if using event handlers, or with action= prop if it's a plain form)
  2. Any TypeScript types needed for the parameters
  3. If the form needs to display errors or pending state, use useActionState from react (NOT the deprecated useFormState from react-dom) and useFormStatus from react-dom:
'use client'
import { useActionState } from 'react'      // React 19 / Next.js 15
import { useFormStatus } from 'react-dom'

function SubmitButton() {
  const { pending } = useFormStatus()
  return <button type="submit" disabled={pending}>{pending ? 'Saving...' : 'Save'}</button>
}

export function PostForm() {
  const [state, action] = useActionState(createPost, null)
  return (
    <form action={action}>
      <input name="title" />
      {state?.error && <p>{state.error}</p>}
      <SubmitButton />
    </form>
  )
}

Ask before generating if unclear: Is this triggered by a form submission or a button click? Does it need optimistic updates?

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 76 lines · 0 tokens per session scan A 431a86bd5a2b

Subscribe to this mod's changes

server-action is a command published in the GitHub repository pruthvinathJV/nextjs-claude-code-kit (2 stars, last pushed 6mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 674 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.