Spring Boot Scanner
Smart pattern detection and skill routing for Spring Boot projects.
Core Behavior
Trigger Conditions:
- Editing
*.java or *.kt files in a project with spring-boot-starter dependencies
- Working with
pom.xml or build.gradle* containing Spring Boot
- User mentions "Spring Boot", "Spring Security", "Spring Data", etc.
Action: Scan code → Detect patterns → Route to appropriate skill
Detection Algorithm
Scans in 3 phases: (1) detect Spring Boot project via build files, (2) scan annotations against the map below, (3) route by risk level — LOW auto-invokes, HIGH confirms first. See WORKFLOW.md for the full step-by-step detection flow.
Annotation → Skill Map
| Annotation Pattern |
Detected Skill |
Risk Level |
@RestController, @GetMapping, @PostMapping, @RequestMapping |
spring-boot-web-api |
LOW |
@Entity, @Repository, @Aggregate, @MappedSuperclass |
spring-boot-data-ddd |
LOW |
@Service in **/domain/** or **/service/** |
domain-driven-design |
LOW |
@ApplicationModule, @ApplicationModuleListener |
spring-boot-modulith |
LOW |
@Timed, @Counted, HealthIndicator, MeterRegistry |
spring-boot-observability |
LOW |
@EnableWebSecurity, @PreAuthorize, @Secured, SecurityFilterChain |
spring-boot-security |
HIGH |
@SpringBootTest, @WebMvcTest, @DataJpaTest, @MockitoBean |
spring-boot-testing |
HIGH |
@MockBean (deprecated) |
spring-boot-testing |
HIGH + WARNING |
| Build file with version < 4.0 |
spring-boot-verify |
HIGH |
Use this script to detect patterns:
# Run from project root
python3 scripts/detect_patterns.py /path/to/file.java
Or use Grep directly:
# Web API detection
grep -l "@RestController\|@GetMapping\|@PostMapping" **/*.java
# Security detection
grep -l "@EnableWebSecurity\|@PreAuthorize\|SecurityFilterChain" **/*.java
# Testing detection
grep -l "@SpringBootTest\|@WebMvcTest\|@MockitoBean\|@MockBean" **/*.java
Escalation Triggers
Always confirm before proceeding when detecting:
| Pattern |
Reason |
Action |
@EnableGlobalMethodSecurity |
Deprecated in Security 6+ |
Confirm + Migration guidance |
@MockBean |
Deprecated in Boot 3.4+ |
Confirm + Show @MockitoBean |
spring-boot-starter-parent < 3.0 |
Major migration needed |
Confirm + Suggest verify-upgrade |
.and() in security config |
Removed in Security 7 |
Confirm + Lambda DSL guidance |
com.fasterxml.jackson |
Jackson 3 migration |
Confirm + Namespace change |
Integration with Existing Components
Delegates to Skills:
spring-boot-web-api → REST patternsspring-boot-data-ddd → Repository/Entity patternsspring-boot-security → Security configurationspring-boot-testing → Test patternsspring-boot-modulith → Module structurespring-boot-observability → Metrics/Healthspring-boot-verify → Dependencies/Configdomain-driven-design → DDD architecture
Delegates to Agents (for comprehensive review):
spring-boot-reviewer → Full codebase reviewspring-boot-upgrade-verifier → Migration analysis
When to delegate to agents:
- User asks for "review" or "scan" of entire project
- Multiple HIGH RISK patterns across many files
- Explicit
/spring-review or /verify-upgrade command
Known Limitations
- Annotation-based only: Detects standard Spring annotations, not custom/meta-annotations or XML configuration
- Java and Kotlin only: Scans
*.java and *.kt files; no Groovy/Scala support
- Spring Boot 3.x+ optimized: Escalation patterns focus on Boot 3.x → 4.x migration; older versions may have gaps
- No AST parsing: Uses regex matching, so patterns in comments/strings may cause false positives
Escape Hatch
If scanner guidance isn't helpful for the current context:
| Scenario |
Action |
| Skip LOW RISK guidance |
Ignore suggestions and continue working |
| Skip HIGH RISK confirmation |
Select "Continue without guidance" option |
| Need comprehensive review |
Use /spring-review command instead |
| Disable temporarily |
Remove spring-boot-scanner from active skills |
The scanner is advisory—it suggests skills but never blocks the workflow.
Related Skills
| Need |
Skill |
| DDD concepts |
domain-driven-design |
| Data layer |
spring-boot-data-ddd |
| REST APIs |
spring-boot-web-api |
| Security config |
spring-boot-security |
| Full codebase review |
Use /spring-review command |
Detailed References
- Workflow: See WORKFLOW.md for step-by-step detection flow
- Examples: See EXAMPLES.md for trigger scenarios
- Troubleshooting: See TROUBLESHOOTING.md for common issues
- Detection Script: See scripts/detect_patterns.py for programmatic detection
Critical Reminders
- Always check project type first — Only activate for Spring Boot projects
- Respect risk levels — Never auto-invoke security/testing/verify without confirmation
- Batch notifications — Don't spam user with multiple skill suggestions
- Delegate to agents for scale — Use reviewer agent for multi-file analysis
- Preserve user flow — Guidance should assist, not interrupt
Converted and distributed by TomeVault — claim your Tome and manage your conversions.
1---2name: spring-boot-scanner3description: Smart code scanner that detects Spring Boot patterns and routes to appropriate skills. Use when editing Java or Kotlin files in Spring Boot projects, working with pom.xml/build.gradle containing spring-boot-starter, or when context suggests Spring Boot development. Detects annotations (@RestController, @Entity, @EnableWebSecurity, @SpringBootTest) to determine relevant skills and provides contextual guidance. Uses progressive automation - auto-invokes for low-risk patterns (web-api, data, DDD), confirms before loading high-risk skills (security, testing, verify). Use when this capability is needed.4---56# Spring Boot Scanner78Smart pattern detection and skill routing for Spring Boot projects.910## Core Behavior1112**Trigger Conditions**:13- Editing `*.java` or `*.kt` files in a project with `spring-boot-starter` dependencies14- Working with `pom.xml` or `build.gradle*` containing Spring Boot15- User mentions "Spring Boot", "Spring Security", "Spring Data", etc.1617**Action**: Scan code → Detect patterns → Route to appropriate skill1819## Detection Algorithm2021Scans in 3 phases: (1) detect Spring Boot project via build files, (2) scan annotations against the map below, (3) route by risk level — LOW auto-invokes, HIGH confirms first. See [WORKFLOW.md](WORKFLOW.md) for the full step-by-step detection flow.2223## Annotation → Skill Map2425| Annotation Pattern | Detected Skill | Risk Level |26|-------------------|----------------|------------|27| `@RestController`, `@GetMapping`, `@PostMapping`, `@RequestMapping` | spring-boot-web-api | LOW |28| `@Entity`, `@Repository`, `@Aggregate`, `@MappedSuperclass` | spring-boot-data-ddd | LOW |29| `@Service` in `**/domain/**` or `**/service/**` | domain-driven-design | LOW |30| `@ApplicationModule`, `@ApplicationModuleListener` | spring-boot-modulith | LOW |31| `@Timed`, `@Counted`, `HealthIndicator`, `MeterRegistry` | spring-boot-observability | LOW |32| `@EnableWebSecurity`, `@PreAuthorize`, `@Secured`, `SecurityFilterChain` | spring-boot-security | HIGH |33| `@SpringBootTest`, `@WebMvcTest`, `@DataJpaTest`, `@MockitoBean` | spring-boot-testing | HIGH |34| `@MockBean` (deprecated) | spring-boot-testing | HIGH + WARNING |35| Build file with version < 4.0 | spring-boot-verify | HIGH |3637Use this script to detect patterns:3839```bash40# Run from project root41python3 scripts/detect_patterns.py /path/to/file.java42```4344Or use Grep directly:4546```bash47# Web API detection48grep -l "@RestController\|@GetMapping\|@PostMapping" **/*.java4950# Security detection51grep -l "@EnableWebSecurity\|@PreAuthorize\|SecurityFilterChain" **/*.java5253# Testing detection54grep -l "@SpringBootTest\|@WebMvcTest\|@MockitoBean\|@MockBean" **/*.java55```5657## Escalation Triggers5859Always confirm before proceeding when detecting:6061| Pattern | Reason | Action |62|---------|--------|--------|63| `@EnableGlobalMethodSecurity` | Deprecated in Security 6+ | Confirm + Migration guidance |64| `@MockBean` | Deprecated in Boot 3.4+ | Confirm + Show @MockitoBean |65| `spring-boot-starter-parent` < 3.0 | Major migration needed | Confirm + Suggest verify-upgrade |66| `.and()` in security config | Removed in Security 7 | Confirm + Lambda DSL guidance |67| `com.fasterxml.jackson` | Jackson 3 migration | Confirm + Namespace change |6869## Integration with Existing Components7071**Delegates to Skills**:72- `spring-boot-web-api` → REST patterns73- `spring-boot-data-ddd` → Repository/Entity patterns74- `spring-boot-security` → Security configuration75- `spring-boot-testing` → Test patterns76- `spring-boot-modulith` → Module structure77- `spring-boot-observability` → Metrics/Health78- `spring-boot-verify` → Dependencies/Config79- `domain-driven-design` → DDD architecture8081**Delegates to Agents** (for comprehensive review):82- `spring-boot-reviewer` → Full codebase review83- `spring-boot-upgrade-verifier` → Migration analysis8485**When to delegate to agents**:86- User asks for "review" or "scan" of entire project87- Multiple HIGH RISK patterns across many files88- Explicit `/spring-review` or `/verify-upgrade` command8990## Known Limitations9192- **Annotation-based only**: Detects standard Spring annotations, not custom/meta-annotations or XML configuration93- **Java and Kotlin only**: Scans `*.java` and `*.kt` files; no Groovy/Scala support94- **Spring Boot 3.x+ optimized**: Escalation patterns focus on Boot 3.x → 4.x migration; older versions may have gaps95- **No AST parsing**: Uses regex matching, so patterns in comments/strings may cause false positives9697## Escape Hatch9899If scanner guidance isn't helpful for the current context:100101| Scenario | Action |102|----------|--------|103| Skip LOW RISK guidance | Ignore suggestions and continue working |104| Skip HIGH RISK confirmation | Select "Continue without guidance" option |105| Need comprehensive review | Use `/spring-review` command instead |106| Disable temporarily | Remove `spring-boot-scanner` from active skills |107108The scanner is advisory—it suggests skills but never blocks the workflow.109110## Related Skills111112| Need | Skill |113|------|-------|114| DDD concepts | `domain-driven-design` |115| Data layer | `spring-boot-data-ddd` |116| REST APIs | `spring-boot-web-api` |117| Security config | `spring-boot-security` |118| Full codebase review | Use `/spring-review` command |119120## Detailed References121122- **Workflow**: See [WORKFLOW.md](WORKFLOW.md) for step-by-step detection flow123- **Examples**: See [EXAMPLES.md](EXAMPLES.md) for trigger scenarios124- **Troubleshooting**: See [TROUBLESHOOTING.md](TROUBLESHOOTING.md) for common issues125- **Detection Script**: See [scripts/detect_patterns.py](scripts/detect_patterns.py) for programmatic detection126127## Critical Reminders1281291. **Always check project type first** — Only activate for Spring Boot projects1302. **Respect risk levels** — Never auto-invoke security/testing/verify without confirmation1313. **Batch notifications** — Don't spam user with multiple skill suggestions1324. **Delegate to agents for scale** — Use reviewer agent for multi-file analysis1335. **Preserve user flow** — Guidance should assist, not interrupt134135---136> Converted and distributed by [TomeVault](https://tomevault.io/claim/joaquimscosta) — claim your Tome and manage your conversions.137<!-- tomevault:4.0:skill_md:2026-04-12 -->
tomevault-io