Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/lsampaioweb/ai-instructions/spring-boot-configgit clone --depth 1 https://github.com/lsampaioweb/ai-instructionsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/lsampaioweb/ai-instructions/spring-boot-config)<a href="https://agentmods.dev/rules/lsampaioweb/ai-instructions/spring-boot-config"><img src="https://agentmods.dev/badge/rules/lsampaioweb/ai-instructions/spring-boot-config.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00753 |
| Opus 5 | $0.00000 | $0.00377 |
| Sonnet 5 | $0.00000 | $0.00151 |
| Haiku 4.5 | $0.00000 | $0.00075 |
Grade A, and why
spring-boot-config scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 46 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Spring Boot Config Engine
Naming Conventions
- Use dot-separated lowercase property keys with a consistent root namespace prefix (e.g.,
app.pagination.default-size,app.security.jwt.expiry).
Rules
- Set
spring.application.namefor service identity used by logging and tracing context. - Keep
application.ymlas the base configuration file for each runnable module. - Keep values shared by all environments in
application.ymlonly. - Add
application-development.ymlandapplication-production.ymlfor distinct runtime environments. - Keep profile files limited to keys whose effective values differ from
application.yml. - Use
productionas the default active profile inapplication.yml, unless the user explicitly requests another default. - Set
spring.threads.virtual.enabled: trueinapplication.ymlfor Java 25 modules. - Set
logging.config: "classpath:log/logback-spring.xml"inapplication.yml. - Set
spring.devtools.restart.enabled: trueinapplication.ymlwhenspring-boot-devtoolsis declared. - Configure
spring.datasource.hikari.*with explicit pool sizing inapplication.ymlfor JDBC modules. - Set
server.port: 8080inapplication-development.yml. - Set
server.port: 9443inapplication-production.yml. - Set
server.error.include-stacktrace: "always"inapplication-development.yml. - Set
server.error.include-stacktrace: "never"as the safe base default inapplication.yml. - Do not repeat
server.error.include-stacktraceinapplication-production.yml. - Set
springdoc.swagger-ui.enabled: trueinapplication-development.yml. - Set
springdoc.swagger-ui.enabled: falseas the safe base default inapplication.yml. - Do not repeat
springdoc.swagger-ui.enabledinapplication-production.yml. - Keep one configuration-properties registration strategy per runnable module: either component-scanned properties classes or explicit
@EnableConfigurationProperties, but not both. - When using
@EnableConfigurationProperties, register each@ConfigurationPropertiesclass in the owning@Configurationclass, not the main class. - Prefer class-level configuration properties over scattered value injection.
- Annotate
@ConfigurationPropertiesclasses with@Validatedand use Bean Validation constraints (e.g.,@NotNull,@NotBlank,@Min) on required fields. - Use environment variable placeholders without defaults for sensitive attributes (for example, credentials, usernames, passwords, tokens, private keys, and connection secrets).
- Use environment variable placeholders without defaults in
application.ymlfor runtime infrastructure selectors such as datasource URLs, broker URLs, and telemetry exporter endpoints. - Use fail-fast configuration behavior for sensitive attributes so application startup fails when required sensitive environment values are missing.
- Allow default values only for non-sensitive attributes.
- Keep local-development-only fallback values in
application-development.yml, not inapplication.yml. - Use clear, stable property keys with domain prefixes for custom application properties.
- Keep each custom property namespace owned by a specific feature, integration, or infrastructure component.
- Keep shared configuration in the module-root
config/package only for cross-feature infrastructure properties; keep feature-specific configuration properties in feature-packageconfig/subdirectories. - Require explicit documentation for new public configuration keys.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 46 lines · 0 tokens per session scan A 403fc9c0a997
spring-boot-config is a cursor rule published in the GitHub repository lsampaioweb/ai-instructions (1 stars, last pushed 11d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 753 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
cli-error-handling
CLI command error handling patterns.
prefer-direct-imports-over-module-mocks
Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.
control-plane-descriptors
Control plane descriptor and instance implementation patterns.
family-instance-domain-actions
Family instance domain action implementation patterns.