Production-grade AI agent skills, playbooks, and standards for modern Spring Boot platforms.
SaferSkills independently audited spring-boot-platform-agents (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Vendor-neutral AI engineering platform for building production-grade Spring Boot services. Works with OpenCode, Claude Code, Codex, Cursor, Gemini CLI, Cline, Roo Code, and Continue.
Java 25 · Spring Boot 4 · PostgreSQL 17 · OpenAPI 3.1 · Testcontainers · Docker · OpenTelemetry · Micrometer / Prometheus / Grafana
# Clone alongside your service repo
git clone https://github.com/aleem-raja/spring-boot-platform-agents.git .agents# OpenCode (any directory)
opencode .
# Claude Code (any directory)
claude .
# Other agents read AGENTS.md for routingAsk your agent (in natural language):
"Use the create-service playbook. Build a Customer Management Service."
The agent loads the playbook, assigns agents (architect → implementation-engineer → test-engineer → security-engineer), loads required skills on demand, and follows the phase-by-phase workflow.
# Plan mode — architecture design
opencode . --mode plan "Design order service"
# Build mode — generate implementation
opencode . --mode build "Generate the order service code"
# Review mode — check pull request
opencode . --mode review
# Security review
opencode . --mode security
# Test generation
opencode . --mode test
# Performance analysis
opencode . --mode perfYou (natural language) → Agent Router → Playbook → Agents → Skills → Output| Layer | What | Example |
|---|---|---|
| Playbooks | Multi-step workflows | create-service, add-feature, review-pr |
| Agents | Expert roles | architect, implementation-engineer, test-engineer |
| Skills | Domain knowledge loaded on demand | jpa-hibernate, kafka, spring-security |
| Standards | Cross-cutting rules | architecture-standard, coding-standard |
| Templates | Code scaffolds | pom.xml, Dockerfile, application.yml |
The platform ships as an npm package with a CLI for managing skills.
# No install needed — use via npx
npx spring-boot-platform-agents help
# Or install globally
npm install -g spring-boot-platform-agents# List all skill categories
npx spring-boot-platform-agents list-categories
# List skills in a category
npx spring-boot-platform-agents list-skills persistence
# List all skills across all categories
npx spring-boot-platform-agents list-skills
# Add a new skill (creates a template file)
npx spring-boot-platform-agents add-skill messaging rabbitmq \
--purpose "RabbitMQ integration patterns for Spring Boot"The add-skill command scaffolds a new skill file with the standard template (Purpose, When to Use, Best Practices, Anti-Patterns, Examples, Checklist). Edit the generated file and register it in AGENTS.md if a new category is needed.
# Create a websocket skill
npx sbp-agents add-skill spring websocket --purpose "WebSocket and STOMP messaging"
# Create a contract testing skill
npx sbp-agents add-skill testing contract-testing --purpose "Spring Cloud Contract and Pact"
# List all available skills
npx sbp-agents list-skills| Playbook | Purpose | Agents Used |
|---|---|---|
create-service | Scaffold new Spring Boot service | architect → impl → test → security |
add-feature | Add feature to existing service | architect → impl → test |
review-pr | Review pull request changes | code-reviewer → security |
fix-cve | Remediate security vulnerabilities | security → release |
upgrade-java | Upgrade Java version | impl → test |
upgrade-spring | Upgrade Spring Boot version | impl → test |
deploy-service | Deploy service to environment | sre → release |
generate-docs | Generate service documentation | impl → test |
| Agent | File | Role | Escalates To |
|---|---|---|---|
| architect | agents/architect.md | Design service architecture | — |
| implementation-engineer | agents/implementation-engineer.md | Write production code | architect |
| test-engineer | agents/test-engineer.md | Write and run tests | implementation-engineer |
| security-engineer | agents/security-engineer.md | Review security posture | architect, platform, compliance |
| performance-engineer | agents/performance-engineer.md | Optimize performance | architect, SRE |
| sre-engineer | agents/sre-engineer.md | Define operations contracts | platform, security, performance |
| release-engineer | agents/release-engineer.md | Manage release pipeline | architect, security, SRE |
| code-reviewer | agents/code-reviewer.md | Review code quality | architect, security |
| Category | Skills |
|---|---|
| api | api-versioning |
| architecture | microservice-patterns |
| caching | spring-cache |
| cicd | github-actions, gitlab-ci, jenkins |
| deployment | docker-compose, helm, kubernetes |
| documentation | architecture-decision-records, docs-pages, openapi, spring-restdocs |
| git | conventional-commits, trunk-based-development |
| java | java25-modern |
| messaging | kafka |
| modernization | openrewrite, upgrade-java, upgrade-spring |
| observability | micrometer-prometheus, opentelemetry |
| persistence | flyway, jpa-hibernate, liquibase, postgresql |
| resilience | resilience4j |
| security | oauth2-jwt |
| spring | spring-boot4, spring-security |
| testing | integration-testing, testcontainers, unit-testing |
| validation | bean-validation |
| Standard | Scope |
|---|---|
architecture-standard.md | Service structure, hexagonal architecture, API design, persistence rules, tech decisions |
coding-standard.md | Java 25 conventions, null safety, exception handling, logging, naming |
engineering-standard.md | Branch strategy (trunk-based), PR standards, definition of done, docs as code |
| Template | Purpose |
|---|---|
pom.xml | Production Maven build with modular starters, OAuth2, Kafka, Resilience4j, Testcontainers, ArchUnit |
Dockerfile | Multi-stage Docker build with JVM tuning |
docker-compose.yml | Full dev environment (PostgreSQL, Kafka, OTel Collector, Prometheus, Grafana) |
application.yml | Production config with 3 profiles (local, test, default) |
logback-spring.xml | Structured JSON logging (Logstash) with dev plain-text profile |
otel-collector-config.yml | OpenTelemetry collector with OTLP, Prometheus, batch processing |
| ADR | Decision |
|---|---|
| ADR-001 | Vendor-neutral agent platform with 4-layer architecture |
| ADR-002 | Trunk-based development (no GitFlow) |
| ADR-003 | Test pyramid with ArchUnit, Testcontainers, contract testing |
| ADR-004 | API design: URL prefix versioning, RFC 9457 errors, pagination |
.
├── AGENTS.md # Orchestration rules (entry point for AI agents)
├── opencode.json # Agent routing for OpenCode (plan/build/review/security/test/perf/sre)
├── package.json # npm package with npx CLI for skill management
├── bin/cli.mjs # CLI: add-skill, list-skills, list-categories
├── agents/ # Expert role definitions (8 agents)
├── skills/ # Domain knowledge loaded on demand (34 skills)
├── playbooks/ # Multi-step workflows (8 playbooks)
├── standards/ # Cross-cutting rules (3 standards)
├── templates/ # Code scaffolds (pom.xml, Dockerfile, k8s, otel, etc.)
├── docs/adr/ # Architecture Decision Records (4 ADRs)
└── examples/ # Reference implementations (GitLab CI pipeline, K8s manifests)See CONTRIBUTING.md.
Apache 2.0
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.