Exhibit

Reads Next.js Server Actions, RSC, and Flight payloads in DevTools, and redacts credentials before anything is shown.

In the Network panel, a Next.js Server Action is an opaque POST and an RSC navigation is a byte stream. Exhibit reads them. It classifies Server Actions, RSC navigations, SSR documents, and Next.js API routes, and partially decodes React Flight payloads with an explicit decode reason and a raw protocol fallback. It never guesses a server function name from an opaque action identifier — if the browser cannot prove it, Exhibit says so. Screenshots of this panel are safe to paste into a ticket. Authorization and cookie headers, credential-shaped fields, and token-like values are redacted before anything is stored, shown, copied, or exported. There is no setting that turns that off. It works on any site, not only Next.js. Start recording, use your page, and Exhibit explains each REST, GraphQL, form, or fetch request in one sentence: which recent interaction it followed, what kind of request it was, what came back, how long it took, and how confident that reading is. Every claim links back to the protocol facts behind it. Inspect gives you the developer view — headers, bodies, timing phases, initiator, and an evidence ledger — with Structured, Text, and Raw protocol body modes. Built for privacy: • No server, no account, no analytics, no outbound requests. • Authorization and cookie headers, credential-shaped fields, and token-like values are redacted before anything is stored, shown, or exported. • No required host permissions. Interaction access is optional and requested for the inspected page's origin only when you start recording. Chrome keeps the origin grant until you revoke it or uninstall. • Captured evidence is held in browser-session memory and is never written to disk. It clears when your browser session ends, or sooner if you press Clear. Export before closing the browser if you need to keep it. Also included: API-first filtering, method/domain/protocol/outcome/cache facets, failure/slow/cache quick filters, full-text search, custom additive redaction names, repeated-call comparison, safe cURL copy, sanitized HAR 1.2 export, and a Markdown QA report. Exhibit reports only what the browser can prove. It cannot see server-to-server traffic, and it never guesses a server function name.