Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/thesethrose/devrules/nextjs15git clone --depth 1 https://github.com/TheSethRose/DevRulesWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01428 |
| Opus 5 | $0.00000 | $0.00714 |
| Sonnet 5 | $0.00000 | $0.00286 |
| Haiku 4.5 | $0.00000 | $0.00143 |
Grade A, and why
NextJS15 scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 95 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Next.js Best Practices
Project Structure
- Use the App Router directory structure (
app/,components/,lib/are common top-level folders). - Place route-specific components, layouts, pages, loading/error UIs within the
appdirectory following App Router conventions. - Place shared, reusable components outside the
appdirectory (e.g., incomponents/). - Place utilities, helpers, constants, and types in
lib/orutils/. - Use lowercase kebab-case for directory and file names (e.g.,
components/auth-wizard,app/user-profile/page.tsx).
Components & Rendering
- Use Server Components by default for better performance and data fetching.
- Mark components requiring interactivity, browser APIs, or state/lifecycle hooks explicitly with
'use client'at the top. - Prefer passing Server Components as props (children) to Client Components where possible to minimize Client bundle size.
- Wrap Client Components that suspend (e.g., data fetching with hooks) in
<Suspense>with an appropriate fallback UI. - Use
next/dynamicfor dynamic loading of components that are not critical for the initial page load. - Implement proper error boundaries (
error.tsxfiles in the App Router) to handle runtime errors gracefully. - Place static content, constants, and type/interface definitions towards the end of the file for readability.
Performance
- Optimize images using
next/image: Ensure properwidth,height,priorityprops, considerfillprop, and use modern formats like WebP if applicable. - Minimize unnecessary use of
useEffectand client-side state (useState) in Client Components. Fetch data on the server where possible. - Favor Server Components (RSC) for data fetching and rendering static content.
- Implement caching strategies effectively: Utilize Next.js fetch caching, Route Segment caching, and consider
revalidateoptions. Understand the difference between static and dynamic rendering.
Data Fetching
- Primarily use Server Components for data fetching (async/await directly in components).
- Use Route Handlers (
route.ts) for API endpoints. - Implement proper error handling (e.g., try/catch) for data fetching operations.
- Utilize Next.js extended
fetchAPI options for caching and revalidation (cache,next.revalidate). - Handle loading states using
loading.tsxfiles or<Suspense>boundaries. - Handle error states using
error.tsxfiles.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 95 lines · 1,428 tokens per session scan A 16c8b4df6ae5
NextJS15 is a cursor rule published in the GitHub repository TheSethRose/DevRules (25 stars, last pushed 1y ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,428 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
creating-cursor-rules
Meta-rule for creating effective Cursor IDE rules with best practices, patterns, and examples.
prpm-json-best-practices
Best practices for structuring prpm.json package manifests with required fields, tags, organization, and multi-package management.
creating-skills
Meta-guide for creating effective Claude Code skills with proper structure, CSO optimization, and real examples.
beanstalk-deploy
Robust deployment patterns for Elastic Beanstalk with GitHub Actions, Pulumi, and edge case handling.
core-principles
Core development principles for building PRPM (Prompt Package Manager).
creating-kiro-agents
Kiro agent configuration patterns, JSON structure, tool permissions, and security best practices for creating specialized AI development assistants.