Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/WangTingYeYe/llm-agent-studyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/wangtingyeye/llm-agent-study/springboot)<a href="https://agentmods.dev/rules/wangtingyeye/llm-agent-study/springboot"><img src="https://agentmods.dev/badge/rules/wangtingyeye/llm-agent-study/springboot/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/wangtingyeye/llm-agent-study/springboot"><img src="https://agentmods.dev/badge/rules/wangtingyeye/llm-agent-study/springboot.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.03209 |
| Opus 5.5 | $0.00000 | $0.01284 |
| Sonnet 5.5 | $0.00000 | $0.00642 |
| Haiku 4.5 | $0.00000 | $0.00321 |
Grade A, and why
springboot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 292 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Spring Boot 3 企业级最佳实践规范
1. 配置管理模块
1.1 配置文件组织
- 主配置文件：
application.yml包含通用配置 - 环境配置：
application-{profile}.yml按环境分离 - 配置优先级：命令行参数 > 环境变量 > 配置文件
- 敏感信息：使用环境变量或配置中心，禁止硬编码
1.2 配置属性绑定
- 使用
@ConfigurationProperties进行类型安全的配置绑定 - 配置类使用
@Validated进行参数校验 - 复杂配置使用嵌套类结构
- 提供默认值和配置文档
1.3 多环境管理
- 开发环境：本地数据库，详细日志，热重载
- 测试环境：内存数据库，模拟外部服务
- 生产环境：外部配置，最小日志级别，性能监控
1.4 配置最佳实践
- 配置项命名使用 kebab-case
- 布尔值配置明确语义（enabled/disabled）
- 数值配置包含单位说明
- 定期审查和清理无用配置
2. 依赖注入模块
2.1 Bean 定义策略
- 组件扫描：使用
@Component、@Service、@Repository、@Controller - 配置类：复杂 Bean 使用
@Configuration+@Bean - 条件注册：使用
@ConditionalOn*注解进行条件装配 - 作用域管理：明确 Bean 的生命周期和作用域
2.2 依赖注入方式
- 构造器注入：推荐方式，保证依赖不可变
- 字段注入：仅在测试中使用
@Autowired - Setter注入：可选依赖使用
- 避免循环依赖：重构代码结构，使用事件驱动
2.3 Bean 生命周期管理
- 使用
@PostConstruct和@PreDestroy管理生命周期 - 实现
InitializingBean和DisposableBean接口 - 资源清理在销毁方法中进行
- 异步初始化使用
@Async注解
2.4 依赖注入最佳实践
- 接口编程，面向抽象依赖
- 使用
@Qualifier解决多实现问题 - 避免过度依赖，保持类的单一职责
- 使用
@Primary指定默认实现
3. 安全模块
3.1 认证机制
- JWT 认证：无状态认证，适合分布式应用
- OAuth2 集成：第三方登录和授权
- 多因素认证：提高安全级别
- 会话管理：合理设置超时和并发控制
3.2 授权策略
- 基于角色：RBAC 模型，角色权限分离
- 基于资源：细粒度权限控制
- 方法级安全：使用
@PreAuthorize和@PostAuthorize - URL 级安全：配置路径访问规则
3.3 数据安全
- 输入验证：所有外部输入必须验证
- SQL 注入防护：使用参数化查询
- XSS 防护：输出编码和 CSP 策略
- CSRF 防护：API 使用 Token 验证
3.4 安全配置最佳实践
- 最小权限原则，默认拒绝访问
- 敏感操作记录审计日志
- 定期更新安全依赖
- 使用 HTTPS 和安全头配置
4. 性能优化模块
4.1 应用层优化
- 连接池配置：数据库、Redis、HTTP 客户端
- 线程池调优：异步任务和定时任务
- JVM 参数：堆内存、GC 策略、监控参数
- 启动优化：延迟初始化、条件装配
4.2 缓存策略
- 本地缓存：Caffeine 用于热点数据
- 分布式缓存：Redis 用于共享数据
- 缓存层次：L1（本地）+ L2（分布式）
- 缓存更新：写入时更新、定时刷新、事件驱动
4.3 数据库优化
- 连接池配置：HikariCP 参数调优
- 查询优化：索引使用、分页查询、批量操作
- 事务管理：只读事务、事务传播、超时设置
- 读写分离：主从配置、路由策略
4.4 监控和诊断
- 应用指标：JVM、业务指标、自定义指标
- 性能分析：慢查询、热点方法识别
- 告警机制：阈值监控、异常告警
- 健康检查：Actuator 端点监控应用状态
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 292 lines · 0 tokens per session scan A 4d80ee269fa5
springboot is a cursor rule published in the GitHub repository WangTingYeYe/llm-agent-study (4 stars, last pushed 1y ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,209 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
springboot-jpa-best-practices
A set of Chinese-language rules for structuring Java Spring Boot applications that use JPA, a library for database access.
graftcode-java
Mandatory Graftcode architecture rules for building Java backend services (plain Maven/Gradle modules exposed via Graftcode Gateway, not REST).
spring-boot-architecture
Spring Boot Java architecture contract for feature packaging, service boundaries, repositories, DTOs, mappers, and controller dependencies.
spring-boot-http-client
Spring Boot outbound HTTP contract for RestClient beans, timeouts, and repository-side remote calls.
spring-retry-conventions
Spring Boot database retry conventions using AbstractDatabaseService and RetryTemplate.
java-springboot-standards
Java Spring Boot coding standards and patterns for your monorepo services.