Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/xc404/kiwiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/xc404/kiwi/java-openapi-annotations)<a href="https://agentmods.dev/rules/xc404/kiwi/java-openapi-annotations"><img src="https://agentmods.dev/badge/rules/xc404/kiwi/java-openapi-annotations/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/xc404/kiwi/java-openapi-annotations"><img src="https://agentmods.dev/badge/rules/xc404/kiwi/java-openapi-annotations.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00818 |
| Opus 5.5 | $0.00000 | $0.00327 |
| Sonnet 5.5 | $0.00000 | $0.00164 |
| Haiku 4.5 | $0.00000 | $0.00082 |
Grade A, and why
java-openapi-annotations scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
REST 接口 OpenAPI 注解(kiwi-admin)
在 新增或修改 kiwi-admin/backend 的 REST 接口时,必须同步补充 OpenAPI 3 注解(io.swagger.v3.oas.annotations.*),与现有 Controller 风格一致。未标注的接口不会进入 Swagger UI,且 @Operation 缺失时无法被 MCP OpenAPI 工具同步(见 KiwiOpenApiSyncMcpToolsConfiguration)。
Controller 类
- 在
@RestController上添加@Tag(name = "…", description = "…")(description可选)。 name用中文业务名,与模块一致(如「系统菜单」「BPM 组件」)。
每个公开端点方法
- 添加
@Operation,且 必须 包含:operationId:全局唯一、稳定,供 MCP / 前端 codegen 引用;格式{前缀}_{动作},前缀为控制器简称(camelCase),例如menu_get、bpmComp_page、dict_addDict、codeEnt_create、auth_userInfo。summary:一句中文,说明接口做什么。
- 分页、查询条件、请求体字段等非显而易见时,补充
description(中文,写清默认值与约束,如「page 从 0 开始,size 默认 20、最大 100」)。 @Operation放在映射注解(@GetMapping等)上方,与现有代码一致。
路径 / 查询 / 请求体参数
@PathVariable/@RequestParam:语义不清时加@Parameter(description = "…")。@RequestBody:需要说明字段时,使用io.swagger.v3.oas.annotations.parameters.RequestBody(勿与 Spring 的@RequestBody混淆);Spring 绑定仍用org.springframework.web.bind.annotation.RequestBody。
请求 / 响应 DTO(dto 包或 Controller 内嵌类)
- 类上:
@Schema(description = "…")。 - 对外暴露、含义不直观的字段:
@Schema(description = "…")(必要时example、requiredMode)。
示例(与 SysMenuCtl 一致)
@Tag(name = "系统菜单", description = "菜单 CRUD 与树")
public class SysMenuCtl {
@Operation(operationId = "menu_get", summary = "按 id 获取菜单详情")
@GetMapping("{id}")
public SysMenu menu(@PathVariable("id") String id) { ... }
}
禁止 / 注意
- 不要 只写 Spring MVC 映射而不写
@Operation(除非明确为内部、非文档化端点,且团队确认不需要 Swagger/MCP)。 - 不要 省略
operationId或随意改名(会破坏 MCP 工具与已有集成)。 - 使用 OpenAPI 3 注解包名
io.swagger.v3.oas.annotations,不要 使用已废弃的 Swagger 2io.swagger.annotations。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 51 lines · 0 tokens per session scan A 36a62a1f8df5
java-openapi-annotations is a cursor rule published in the GitHub repository xc404/kiwi (7 stars, last pushed 1mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 818 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
springboot-jpa-best-practices
A set of Chinese-language rules for structuring Java Spring Boot applications that use JPA, a library for database access.
graftcode-java
Mandatory Graftcode architecture rules for building Java backend services (plain Maven/Gradle modules exposed via Graftcode Gateway, not REST).
spring-boot-architecture
Spring Boot Java architecture contract for feature packaging, service boundaries, repositories, DTOs, mappers, and controller dependencies.
spring-boot-http-client
Spring Boot outbound HTTP contract for RestClient beans, timeouts, and repository-side remote calls.
spring-retry-conventions
Spring Boot database retry conventions using AbstractDatabaseService and RetryTemplate.
java-springboot-standards
Java Spring Boot coding standards and patterns for your monorepo services.