Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/wangtingyeye/llm-agent-study/springbootgit clone --depth 1 https://github.com/WangTingYeYe/llm-agent-studyWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.03209 |
| Opus 5 | $0.00000 | $0.01605 |
| Sonnet 5 | $0.00000 | $0.00642 |
| Haiku 4.5 | $0.00000 | $0.00321 |
Grade A, and why
springboot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 292 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Spring Boot 3 企业级最佳实践规范
1. 配置管理模块
1.1 配置文件组织
- 主配置文件：
application.yml包含通用配置 - 环境配置：
application-{profile}.yml按环境分离 - 配置优先级：命令行参数 > 环境变量 > 配置文件
- 敏感信息：使用环境变量或配置中心，禁止硬编码
1.2 配置属性绑定
- 使用
@ConfigurationProperties进行类型安全的配置绑定 - 配置类使用
@Validated进行参数校验 - 复杂配置使用嵌套类结构
- 提供默认值和配置文档
1.3 多环境管理
- 开发环境：本地数据库，详细日志，热重载
- 测试环境：内存数据库，模拟外部服务
- 生产环境：外部配置，最小日志级别，性能监控
1.4 配置最佳实践
- 配置项命名使用 kebab-case
- 布尔值配置明确语义（enabled/disabled）
- 数值配置包含单位说明
- 定期审查和清理无用配置
2. 依赖注入模块
2.1 Bean 定义策略
- 组件扫描：使用
@Component、@Service、@Repository、@Controller - 配置类：复杂 Bean 使用
@Configuration+@Bean - 条件注册：使用
@ConditionalOn*注解进行条件装配 - 作用域管理：明确 Bean 的生命周期和作用域
2.2 依赖注入方式
- 构造器注入：推荐方式，保证依赖不可变
- 字段注入：仅在测试中使用
@Autowired - Setter注入：可选依赖使用
- 避免循环依赖：重构代码结构，使用事件驱动
2.3 Bean 生命周期管理
- 使用
@PostConstruct和@PreDestroy管理生命周期 - 实现
InitializingBean和DisposableBean接口 - 资源清理在销毁方法中进行
- 异步初始化使用
@Async注解
2.4 依赖注入最佳实践
- 接口编程，面向抽象依赖
- 使用
@Qualifier解决多实现问题 - 避免过度依赖，保持类的单一职责
- 使用
@Primary指定默认实现
3. 安全模块
3.1 认证机制
- JWT 认证：无状态认证，适合分布式应用
- OAuth2 集成：第三方登录和授权
- 多因素认证：提高安全级别
- 会话管理：合理设置超时和并发控制
3.2 授权策略
- 基于角色：RBAC 模型，角色权限分离
- 基于资源：细粒度权限控制
- 方法级安全：使用
@PreAuthorize和@PostAuthorize - URL 级安全：配置路径访问规则
3.3 数据安全
- 输入验证：所有外部输入必须验证
- SQL 注入防护：使用参数化查询
- XSS 防护：输出编码和 CSP 策略
- CSRF 防护：API 使用 Token 验证
3.4 安全配置最佳实践
- 最小权限原则，默认拒绝访问
- 敏感操作记录审计日志
- 定期更新安全依赖
- 使用 HTTPS 和安全头配置
4. 性能优化模块
4.1 应用层优化
- 连接池配置：数据库、Redis、HTTP 客户端
- 线程池调优：异步任务和定时任务
- JVM 参数：堆内存、GC 策略、监控参数
- 启动优化：延迟初始化、条件装配
4.2 缓存策略
- 本地缓存：Caffeine 用于热点数据
- 分布式缓存：Redis 用于共享数据
- 缓存层次：L1（本地）+ L2（分布式）
- 缓存更新：写入时更新、定时刷新、事件驱动
4.3 数据库优化
- 连接池配置：HikariCP 参数调优
- 查询优化：索引使用、分页查询、批量操作
- 事务管理：只读事务、事务传播、超时设置
- 读写分离：主从配置、路由策略
4.4 监控和诊断
- 应用指标：JVM、业务指标、自定义指标
- 性能分析：慢查询、热点方法识别
- 告警机制：阈值监控、异常告警
- 健康检查：Actuator 端点监控应用状态
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 292 lines · 0 tokens per session scan A 4d80ee269fa5
springboot is a cursor rule published in the GitHub repository WangTingYeYe/llm-agent-study (4 stars, last pushed 1y ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,209 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
typescript
Changes to these high-fan-out internals can affect every message, delta, element, or rerun. Keep work in them minimal, and benchmark changes with representative stress-test apps.
coolify-ai-docs
Master reference to all Coolify AI documentation in .ai/ directory.
python_lib
Tips and guidelines specific to the development of the Streamlit Python library, not applicable to scripts and e2e tests.
specs
This directory contains product and tech specs for Streamlit features.