03-swagger-documentation

A rule requiring Chinese OpenAPI 3 documentation annotations on backend controllers and data-transfer objects. OpenAPI is a standard way to describe web APIs so their endpoints, parameters, and responses can be read by people and tools.

In plain words
What is it for?
Use it when generating backend features to add descriptions for controllers, endpoints, parameters, and response codes in Chinese.
Why use it?
It prevents new or changed backend endpoints from being left undocumented. Consistent annotations make the API's purpose, authentication needs, parameters, and responses clearer.

Cursor rule

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/movebrickschi/harness-engineering-mcp/03-swagger-documentation
Clone the repo
git clone --depth 1 https://github.com/movebrickschi/harness-engineering-mcp
Per session 798 This file is loaded in full into every session.
When invoked 798 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00798 $0.00798
Opus 5 $0.00399 $0.00399
Sonnet 5 $0.00160 $0.00160
Haiku 4.5 $0.00080 $0.00080

Measured 3d ago against content hash 12e53d326630, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

03-swagger-documentation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

assets/rules/03-swagger-documentation.mdc · 91 lines

How it starts

The opening of the file, as written. The whole thing — 91 lines — stays where its author put it; the contents beside it link to each section on GitHub.

springdoc-openapi 文档注解规范

生成后端功能时,必须为 Controller 和 DTO 添加完整的 OpenAPI 3 文档注解(io.swagger.v3.oas.annotations),所有描述使用中文

Controller 注解

类级别

  • @Tag(name = "模块名", description = "模块说明") 标记模块分组
  • @SecurityRequirement(name = "Bearer") 标记需要认证的接口

方法级别

  • @Operation(summary = "中文摘要", description = "中文详细说明") 描述接口用途
  • @ApiResponse(responseCode = "200", description = "成功描述") 标记响应
  • @Parameter(description = "参数说明") 标记路径参数或查询参数
// ✅ 正确
@Tag(name = "用户管理", description = "用户注册、登录、信息查询等接口")
@SecurityRequirement(name = "Bearer")
@RestController
@RequestMapping("/api/admin/user")
@RequiredArgsConstructor
public class UserController {

    @Operation(summary = "获取用户设置", description = "返回当前登录用户的个性化配置")
    @ApiResponse(responseCode = "200", description = "成功获取用户设置")
    @GetMapping("/settings")
    public R<UserSettingsVO> getSettings(@AuthenticationPrincipal LoginUser loginUser) { }

    @Operation(summary = "查询用户详情")
    @GetMapping("/{userId}")
    public R<UserVO> getUser(@Parameter(description = "用户ID") @PathVariable Long userId) { }
}

// ❌ 缺少 OpenAPI 注解
@RestController
@RequestMapping("/api/admin/user")
public class UserController {
    @GetMapping("/settings")
    public R<UserSettingsVO> getSettings(@AuthenticationPrincipal LoginUser loginUser) { }
}

DTO / VO 注解

  • 类级别使用 @Schema(description = "中文描述") 说明用途
  • 必填字段使用 @Schema(description = "中文描述", example = "示例值", requiredMode = Schema.RequiredMode.REQUIRED)
  • 可选字段使用 @Schema(description = "中文描述", nullable = true)
  • 枚举类型补充 allowableValues
// ✅ 正确
@Data
@Schema(description = "创建项目请求")
public class CreateProjectRequest {

    @Schema(description = "项目名称", example = "我的项目", requiredMode = Schema.RequiredMode.REQUIRED)
    @NotBlank(message = "项目名称不能为空")
    private String name;

    @Schema(description = "项目描述", nullable = true)
    private String description;

    @Schema(description = "项目状态:0=草稿 1=已发布", example = "0", allowableValues = {"0", "1"})
    private Integer status;
}

// ❌ 缺少 Schema 注解
@Data
public class CreateProjectRequest {
    private String name;
    private String description;
}

Read the full file on GitHub · 91 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 91 lines · 798 tokens per session scan A 12e53d326630

Subscribe to this mod's changes

03-swagger-documentation is a cursor rule published in the GitHub repository movebrickschi/harness-engineering-mcp (2 stars, last pushed 3mo ago), licensed MIT. It adds 798 tokens to every session, about $0.0040 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.