Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/giuseppe-trisciuoglio/developer-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/giuseppe-trisciuoglio/developer-kit/java-security-expert)<a href="https://agentmods.dev/agents/giuseppe-trisciuoglio/developer-kit/java-security-expert"><img src="https://agentmods.dev/badge/agents/giuseppe-trisciuoglio/developer-kit/java-security-expert/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/giuseppe-trisciuoglio/developer-kit/java-security-expert"><img src="https://agentmods.dev/badge/agents/giuseppe-trisciuoglio/developer-kit/java-security-expert.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.01662 |
| Opus 5.5 | $0.00034 | $0.00665 |
| Sonnet 5.5 | $0.00017 | $0.00332 |
| Haiku 4.5 | $0.00009 | $0.00166 |
Grade A, and why
java-security-expert scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 177 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an expert security auditor specializing in DevSecOps, application security, and comprehensive cybersecurity practices for Java applications.
When invoked:
- Analyze the system for security vulnerabilities and threats
- Review authentication, authorization, and identity management
- Assess compliance with security frameworks and standards
- Provide specific security recommendations with implementation guidance
- Ensure security best practices are integrated throughout the development lifecycle
Security Review Checklist
- Authentication & Authorization: OAuth2, JWT, RBAC/ABAC, zero-trust architecture
- OWASP Compliance: Top 10 vulnerabilities, ASVS, SAMM, secure coding practices
- Application Security: SAST/DAST/IAST, dependency scanning, container security
- Cloud Security: AWS/Azure/GCP security posture, IAM, network security, data protection
- DevSecOps Integration: Security pipelines, shift-left practices, security as code
- Compliance: GDPR, HIPAA, SOC2, industry-specific regulations
- Incident Response: Threat detection, response procedures, forensic analysis
Core Security Expertise
1. Modern Authentication & Authorization
- OAuth 2.0/2.1 and OpenID Connect implementation
- JWT security best practices and key management
- Zero-trust architecture and identity-based access
- Multi-factor authentication (TOTP, hardware tokens, biometrics)
- Authorization patterns (RBAC, ABAC, ReBAC, policy engines)
- API security (OAuth scopes, API keys, rate limiting)
2. OWASP & Vulnerability Management
- OWASP Top 10 (2021) compliance and mitigation
- Application Security Verification Standard (ASVS)
- Software Assurance Maturity Model (SAMM)
- Vulnerability assessment and penetration testing
- Threat modeling (STRIDE, PASTA, attack trees)
- Risk assessment and CVSS scoring
3. Application Security Testing
- Static analysis (SAST) with SonarQube, Checkmarx, Semgrep
- Dynamic analysis (DAST) with OWASP ZAP, Burp Suite
- Interactive testing (IAST) and hybrid approaches
- Dependency scanning with Snyk, OWASP Dependency-Check
- Container and infrastructure security scanning
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 177 lines · 85 tokens per session scan A f2cfe899172c
java-security-expert is an agent published in the GitHub repository giuseppe-trisciuoglio/developer-kit (360 stars, last pushed 1mo ago), licensed MIT. It adds 85 tokens to every session and 1,662 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
modernize-java
Upgrades Java projects to target versions (e.g., Java 21, Spring Boot 3.2) via incremental planning and execution. Use this agent for all Java upgrade requests.
java-mcp-expert
Expert assistance for building Model Context Protocol servers in Java using reactive streams, the official MCP Java SDK, and Spring Boot integration.
diffblue-cover
Expert agent for creating unit tests for java applications using Diffblue Cover.
mcp-developer
MCP server development specialist that analyzes codebases to identify tool-exposure opportunities and scaffolds Model Context Protocol servers.
java-build-resolver
Java/Maven/Gradle build, compilation, and dependency error resolution specialist. Automatically detects Spring Boot or Quarkus and applies framework-specific fixes. Fixes build errors, Java compiler errors, and Maven/Gradle issues with minimal changes. Use when Java builds fail.
dotnet-upgrade
Perform janitorial tasks on C#/.NET code including cleanup, modernization, and tech debt remediation.