Spring Boot Scanner

Spring Boot Scanner

Smart pattern detection and skill routing for Spring Boot projects.

Core Behavior

Trigger Conditions:

• Editing *.java or *.kt files in a project with spring-boot-starter dependencies
• Working with pom.xml or build.gradle* containing Spring Boot
• User mentions "Spring Boot", "Spring Security", "Spring Data", etc.

Action: Scan code → Detect patterns → Route to appropriate skill

Detection Algorithm

Scans in 3 phases: (1) detect Spring Boot project via build files, (2) scan annotations against the map below, (3) route by risk level — LOW auto-invokes, HIGH confirms first. See WORKFLOW.md for the full step-by-step detection flow.

Annotation → Skill Map

Use this script to detect patterns:

# Run from project root
python3 scripts/detect_patterns.py /path/to/file.java

Or use Grep directly:

# Web API detection
grep -l "@RestController\|@GetMapping\|@PostMapping" **/*.java

# Security detection
grep -l "@EnableWebSecurity\|@PreAuthorize\|SecurityFilterChain" **/*.java

# Testing detection
grep -l "@SpringBootTest\|@WebMvcTest\|@MockitoBean\|@MockBean" **/*.java

Escalation Triggers

Always confirm before proceeding when detecting:

Integration with Existing Components

Delegates to Skills:

• spring-boot-web-api → REST patterns
• spring-boot-data-ddd → Repository/Entity patterns
• spring-boot-security → Security configuration
• spring-boot-testing → Test patterns
• spring-boot-modulith → Module structure
• spring-boot-observability → Metrics/Health
• spring-boot-verify → Dependencies/Config
• domain-driven-design → DDD architecture

Delegates to Agents (for comprehensive review):

• spring-boot-reviewer → Full codebase review
• spring-boot-upgrade-verifier → Migration analysis

When to delegate to agents:

• User asks for "review" or "scan" of entire project
• Multiple HIGH RISK patterns across many files
• Explicit /spring-review or /verify-upgrade command

Known Limitations

• Annotation-based only: Detects standard Spring annotations, not custom/meta-annotations or XML configuration
• Java and Kotlin only: Scans *.java and *.kt files; no Groovy/Scala support
• Spring Boot 3.x+ optimized: Escalation patterns focus on Boot 3.x → 4.x migration; older versions may have gaps
• No AST parsing: Uses regex matching, so patterns in comments/strings may cause false positives

Escape Hatch

If scanner guidance isn't helpful for the current context:

The scanner is advisory—it suggests skills but never blocks the workflow.

Related Skills

Detailed References

• Workflow: See WORKFLOW.md for step-by-step detection flow
• Examples: See EXAMPLES.md for trigger scenarios
• Troubleshooting: See TROUBLESHOOTING.md for common issues
• Detection Script: See scripts/detect_patterns.py for programmatic detection

Critical Reminders

1. Always check project type first — Only activate for Spring Boot projects 2. Respect risk levels — Never auto-invoke security/testing/verify without confirmation 3. Batch notifications — Don't spam user with multiple skill suggestions 4. Delegate to agents for scale — Use reviewer agent for multi-file analysis 5. Preserve user flow — Guidance should assist, not interrupt

Spring Boot Scanner Examples

Real-world scenarios showing how the scanner detects and routes.

Example 1: Controller File (Low Risk - Auto-Invoke)

User Action: Editing UserController.java

File Content:

@RestController
@RequestMapping("/api/users")
public class UserController {

    @GetMapping("/{id}")
    public ResponseEntity<UserDto> getUser(@PathVariable Long id) {
        // ...
    }

    @PostMapping
    public ResponseEntity<UserDto> createUser(@Valid @RequestBody CreateUserRequest request) {
        // ...
    }
}

Scanner Detection:

Detected annotations: @RestController, @GetMapping, @PostMapping, @RequestMapping
Skill match: spring-boot-web-api
Risk level: LOW

Scanner Response:

I notice you're working with REST controller patterns. Here's guidance from spring-boot-web-api:

**Request/Response Best Practices:**
- Use DTOs instead of entities in API responses
- Apply `@Valid` for request body validation
- Return `ResponseEntity<T>` for explicit status codes

**Error Handling:**
- Use `ProblemDetail` (RFC 9457) for error responses
- Define `@ExceptionHandler` in `@ControllerAdvice`

See spring-boot-web-api skill for detailed patterns and examples.

---

Example 2: Security Configuration (High Risk - Confirm)

User Action: Creating SecurityConfig.java

File Content:

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/public/**").permitAll()
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()));
        return http.build();
    }
}

Scanner Detection:

Detected annotations: @EnableWebSecurity, SecurityFilterChain
Skill match: spring-boot-security
Risk level: HIGH

Scanner Response:

I detected security configuration patterns. This involves authentication and authorization setup.

[AskUserQuestion]
Question: "Would you like security guidance for this configuration?"
Options:
1. "Load spring-boot-security skill" - Full Lambda DSL patterns, JWT/OAuth2 setup
2. "Quick validation only" - Check for common security issues
3. "Continue without guidance" - I understand security config

If User Selects Option 1:

Loading spring-boot-security skill...

**Spring Security 7 Requirements:**
- ✅ Using Lambda DSL (correct)
- ✅ Using `requestMatchers()` (correct)
- ✅ Using `authorizeHttpRequests()` (correct)

**Recommendations:**
- Consider adding CSRF protection for state-changing endpoints
- Add method security with `@PreAuthorize` for fine-grained access

See EXAMPLES.md in spring-boot-security for complete patterns.

---

Example 3: Deprecated Pattern (Escalation)

User Action: Opening legacy TestConfig.java

File Content:

@SpringBootTest
public class UserServiceTest {

    @MockBean  // Deprecated in Boot 3.4+
    private UserRepository userRepository;

    @Test
    void shouldCreateUser() {
        // ...
    }
}

Scanner Detection:

Detected annotations: @SpringBootTest, @MockBean
Skill match: spring-boot-testing
Risk level: HIGH
Escalation: @MockBean is deprecated

Scanner Response:

⚠️ **Deprecated Pattern Detected**

Found `@MockBean` which is deprecated since Spring Boot 3.4. Use `@MockitoBean` instead.

**Migration:**

// Before (deprecated) @MockBean private UserRepository userRepository;

// After (Spring Boot 4.x) @MockitoBean private UserRepository userRepository;

**Note:** `@MockitoBean` requires import from `org.springframework.test.context.bean.override.mockito`

Would you like me to help migrate this test file?

[AskUserQuestion]
Options:
1. "Migrate all @MockBean usages" - Find and replace in this file
2. "Scan project for @MockBean" - Check all test files
3. "Load spring-boot-testing skill" - Full testing patterns

---

Example 4: Entity with Repository (Low Risk - Batched)

User Action: Creating Order.java and OrderRepository.java

Order.java:

@Entity
@Table(name = "orders")
public class Order {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @ManyToOne
    @JoinColumn(name = "customer_id")
    private Customer customer;

    @OneToMany(cascade = CascadeType.ALL, orphanRemoval = true)
    private List<OrderItem> items = new ArrayList<>();
}

OrderRepository.java:

@Repository
public interface OrderRepository extends JpaRepository<Order, Long> {
    List<Order> findByCustomerId(Long customerId);

    @Query("SELECT o FROM Order o JOIN FETCH o.items WHERE o.id = :id")
    Optional<Order> findByIdWithItems(@Param("id") Long id);
}

Scanner Detection:

Detected annotations: @Entity, @Repository, @ManyToOne, @OneToMany
Skill matches: spring-boot-data-ddd, domain-driven-design
Risk level: LOW (both)

Scanner Response:

I notice you're working with JPA entities and repositories. Here's combined guidance:

**From spring-boot-data-ddd:**
- Use `JOIN FETCH` to avoid N+1 queries (you're doing this ✓)
- Consider `@EntityGraph` for reusable fetch strategies
- Use `orphanRemoval = true` for owned collections (you're doing this ✓)

**From domain-driven-design:**
- Consider if Order is an Aggregate Root
- OrderItems should be Value Objects if they have no independent identity
- Customer reference suggests a different Aggregate - use ID reference instead

**Potential improvement:**

// Instead of entity reference (crosses aggregate boundary) @ManyToOne private Customer customer;

// Use ID reference (respects aggregate boundaries) @Column(name = "customer_id") private Long customerId;

Would you like more details on DDD aggregate patterns?

---

Example 5: Mixed Patterns (Low + High Risk)

User Action: Creating integration test with security

File Content:

@SpringBootTest
@AutoConfigureMockMvc
public class UserApiIntegrationTest {

    @Autowired
    private MockMvc mockMvc;

    @MockitoBean
    private UserService userService;

    @Test
    @WithMockUser(roles = "ADMIN")
    void adminCanDeleteUser() throws Exception {
        mockMvc.perform(delete("/api/users/1"))
            .andExpect(status().isNoContent());
    }
}

Scanner Detection:

Detected annotations:
  - @SpringBootTest, @MockitoBean → spring-boot-testing (HIGH)
  - @WithMockUser → spring-boot-security (HIGH)
  - MockMvc patterns → spring-boot-web-api (LOW)

Scanner Response:

I detected multiple patterns in your integration test:

**Auto-loaded (web-api):**
- MockMvc patterns detected - use `contentType(APPLICATION_JSON)` for JSON requests

**Confirmation needed:**
This test involves security testing patterns (@WithMockUser) and slice testing (@SpringBootTest).

[AskUserQuestion]
Question: "Which guidance would you like for this test?"
Options:
1. "Both security + testing skills" - Comprehensive test patterns
2. "Security testing only" - Focus on @WithMockUser, JWT mocking
3. "Integration testing only" - @SpringBootTest, MockMvc patterns
4. "Continue without guidance"

---

Example 6: Build File (Verify Trigger)

User Action: Opening pom.xml

File Content:

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>3.2.1</version>
</parent>

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-databind</artifactId>
    </dependency>
</dependencies>

Scanner Detection:

Spring Boot version: 3.2.1 (< 4.0)
Detected: com.fasterxml.jackson (Jackson 2.x)
Skill match: spring-boot-verify
Risk level: HIGH
Escalations:
  - Version < 4.0 (migration opportunity)
  - Jackson 2.x namespace (will change in Boot 4)

Scanner Response:

I analyzed your Spring Boot project configuration:

**Current State:**
- Spring Boot version: 3.2.1
- Jackson: 2.x (com.fasterxml namespace)

⚠️ **Migration Considerations:**

Spring Boot 4.0 introduces breaking changes:

| Current | Spring Boot 4.0 |
|---------|-----------------|
| `spring-boot-starter-web` | `spring-boot-starter-webmvc` |
| `com.fasterxml.jackson` | `tools.jackson` |
| Java 17+ | Java 21+ recommended |

[AskUserQuestion]
Question: "Would you like migration analysis?"
Options:
1. "Run full upgrade verification" - Launch verify-upgrade agent
2. "Load spring-boot-verify skill" - Dependency guidance only
3. "Not planning to upgrade yet" - Continue as-is

---

Example 7: Comprehensive Review Request

User Action: "Can you review my Spring Boot project for best practices?"

Scanner Response:

For a comprehensive review, I'll delegate to the spring-boot-reviewer agent which can:

1. **Discover** - Scan all Java files, detect which skills are relevant
2. **Parallel Review** - Launch specialized reviewers for each detected area
3. **Report** - Consolidate findings with severity levels

[Agent tool invocation]
Launching spring-boot-reviewer agent with scope: "all"

The reviewer will check:
- ✓ Web API patterns (if controllers found)
- ✓ Data/Repository patterns (if entities found)
- ✓ Security configuration (if security files found)
- ✓ Testing patterns (if tests found)
- ✓ Dependency versions (always checked)

Review in progress...

---

Quick Reference: Trigger → Response

Spring Boot Scanner Troubleshooting

Common issues encountered during pattern detection and skill routing.

Table of Contents

• No Patterns Detected
• Project Not Recognized
• Annotation Detection Issues
• Script Execution Issues
• False Positives and Negatives

---

No Patterns Detected

Issue: "No Spring Boot patterns detected" for a Spring Boot project

Symptom: Scanner runs but reports no patterns in files that clearly use Spring annotations.

Causes:

• File extensions not recognized (e.g., .kt Kotlin files)
• Annotations using full package names instead of imports
• Non-standard directory structure
• Files excluded by scanning scope

Solution:

1. Verify file extensions: Scanner looks for *.java and *.kt files:

# Check if your files have correct extensions
ls -la src/**/*.java src/**/*.kt 2>/dev/null

2. Check annotation format: Scanner looks for @AnnotationName, not fully qualified:

// ✅ Detected
@RestController
public class MyController {}

// ❌ NOT Detected (full package name)
@org.springframework.web.bind.annotation.RestController
public class MyController {}

3. Run script directly for debugging:

python3 scripts/detect_patterns.py src/main/java/com/example/MyController.java

---

Issue: Patterns detected in some files but not others

Symptom: Scanner detects patterns in some files but misses others.

Causes:

• Non-recursive scan mode
• Files in unexpected locations
• Character encoding issues

Solution:

1. Use recursive scanning:

python3 scripts/detect_patterns.py . --recursive

2. Check file encoding (should be UTF-8):

file -i src/main/java/com/example/MyController.java

3. Verify file permissions:

ls -la src/main/java/com/example/MyController.java

---

Project Not Recognized

Issue: "Not a Spring Boot project" for valid project

Symptom: Scanner exits early claiming project isn't Spring Boot.

Causes:

• pom.xml or build.gradle not in expected location
• Non-standard dependency declaration
• Multi-module project structure

Solution:

1. Check build file location:

# Find all Maven projects
find . -name "pom.xml" -type f

# Find all Gradle projects
find . -name "build.gradle*" -type f

2. Verify Spring Boot dependency exists:

# Maven
grep -l "spring-boot-starter" **/pom.xml

# Gradle
grep -l "spring-boot\|org.springframework.boot" **/build.gradle*

3. For multi-module projects, run from the correct module:

python3 scripts/detect_patterns.py ./backend --recursive

---

Issue: Build file detected but version not parsed

Symptom: Project recognized but version shows as null.

Causes:

• Version defined in parent POM
• Version in Gradle version catalog
• Version in gradle.properties

Solution:

Check alternative version locations:

Maven - parent or properties:

<parent>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>4.0.1</version>
</parent>

Gradle - version catalog (gradle/libs.versions.toml):

[versions]
spring-boot = "4.0.1"

---

Annotation Detection Issues

Issue: Custom/meta-annotations not detected

Symptom: Files with custom annotations (like @ApiController) not detected.

Cause: Scanner only detects standard Spring annotations.

Solution:

This is a known limitation. For custom annotations:

1. Search for the custom annotation definition to understand what it composes:

grep -r "@interface ApiController" src/

2. Use grep directly for custom patterns:

grep -l "@ApiController" **/*.java **/*.kt

3. Add patterns to detect_patterns.py if needed for your project.

---

Issue: Annotations in comments detected as false positives

Symptom: Scanner reports patterns from commented-out code.

Cause: Simple regex matching includes comments.

Solution:

Review flagged files manually:

# Check context of detected pattern
grep -n "@RestController" src/main/java/com/example/MyController.java

The scanner intentionally errs on the side of detection—better to suggest a skill that may not be needed than miss one that is.

---

Script Execution Issues

Issue: "Permission denied" when running script

Symptom: bash: permission denied error.

Solution:

chmod +x scripts/detect_patterns.py

---

Issue: "python3: command not found"

Symptom: Python not available in path.

Solution:

1. Check Python installation:

which python3
python3 --version  # Requires 3.8+

2. Try alternative Python commands:

python scripts/detect_patterns.py .
# or
/usr/bin/python3 scripts/detect_patterns.py .

---

Issue: UnicodeDecodeError when scanning files

Symptom: Script crashes with encoding error.

Cause: File contains non-UTF-8 characters.

Solution:

1. Identify problematic file:

find . -name "*.java" -exec file {} \; | grep -v UTF-8

2. Convert to UTF-8 if needed:

iconv -f ISO-8859-1 -t UTF-8 file.java > file_utf8.java

---

False Positives and Negatives

Issue: Too many skills suggested

Symptom: Scanner suggests 5+ skills for a simple file.

Cause: File contains patterns from multiple domains.

Solution:

This is expected behavior. The scanner detects all applicable patterns. Focus on:

• HIGH RISK skills (security, testing, verify) that require confirmation
• LOW RISK skills are informational only

---

Issue: Wrong skill suggested

Symptom: Scanner suggests spring-boot-data-ddd for a service class.

Cause: Pattern overlap (e.g., @Repository can appear in different contexts).

Solution:

Consider the file's directory location:

• **/domain/** → domain-driven-design skill
• **/repository/** → spring-boot-data-ddd skill
• **/controller/** → spring-boot-web-api skill

The scanner provides suggestions; use judgment based on context.

---

Issue: Missing escalation warnings

Symptom: Deprecated patterns not flagged.

Cause: Pattern not in escalation list or using different format.

Solution:

Escalation patterns are specific. Common variants that may not trigger:

---

Using Exa MCP for Edge Cases

When encountering issues not covered here, use Exa MCP for latest information:

Use Exa MCP to search for: "Spring Boot [specific issue]"

Examples:

• "Spring Boot 4 annotation detection patterns"
• "Spring Kotlin annotation processing"
• "Spring Boot custom annotation scanning"

Spring Boot Scanner Workflow

Detailed step-by-step detection and routing workflow.

Complete Detection Flow

┌─────────────────────────────────────────────────────────────────┐
│                    TRIGGER: User Activity                        │
│  - Editing Java or Kotlin file                                   │
│  - Discussing Spring Boot                                        │
│  - Working with build files                                      │
└───────────────────────────────┬─────────────────────────────────┘
                                │
                                ▼
┌─────────────────────────────────────────────────────────────────┐
│              PHASE 1: Spring Boot Project Detection              │
│                                                                  │
│  1. Glob for build files:                                        │
│     - **/pom.xml                                                │
│     - **/build.gradle*                                          │
│                                                                  │
│  2. Grep for Spring Boot indicators:                             │
│     - spring-boot-starter                                       │
│     - org.springframework.boot                                  │
│                                                                  │
│  Result: IS_SPRING_BOOT = true/false                            │
└───────────────────────────────┬─────────────────────────────────┘
                                │
              ┌─────────────────┴─────────────────┐
              │                                   │
         IS_SPRING_BOOT                     NOT SPRING_BOOT
              │                                   │
              ▼                                   ▼
    Continue to Phase 2                    EXIT (no action)
              │
              ▼
┌─────────────────────────────────────────────────────────────────┐
│              PHASE 2: Annotation Pattern Scanning                │
│                                                                  │
│  Target: Current file being edited OR recently changed files    │
│                                                                  │
│  Scan for annotation categories:                                │
│                                                                  │
│  ┌──────────────────┐  ┌──────────────────┐                     │
│  │ WEB PATTERNS     │  │ DATA PATTERNS    │                     │
│  │ @RestController  │  │ @Entity          │                     │
│  │ @GetMapping      │  │ @Repository      │                     │
│  │ @PostMapping     │  │ @Aggregate       │                     │
│  │ @RequestMapping  │  │ @MappedSuperclass│                     │
│  │ @ResponseBody    │  │ @EmbeddedId      │                     │
│  └──────────────────┘  └──────────────────┘                     │
│                                                                  │
│  ┌──────────────────┐  ┌──────────────────┐                     │
│  │ SECURITY         │  │ TESTING          │                     │
│  │ @EnableWebSec    │  │ @SpringBootTest  │                     │
│  │ @PreAuthorize    │  │ @WebMvcTest      │                     │
│  │ @Secured         │  │ @DataJpaTest     │                     │
│  │ SecurityFilter   │  │ @MockitoBean     │                     │
│  │ Chain            │  │ @MockBean (dep)  │                     │
│  └──────────────────┘  └──────────────────┘                     │
│                                                                  │
│  ┌──────────────────┐  ┌──────────────────┐                     │
│  │ MODULITH         │  │ OBSERVABILITY    │                     │
│  │ @ApplicationMod  │  │ @Timed           │                     │
│  │ @ApplicationMod  │  │ @Counted         │                     │
│  │   uleListener    │  │ HealthIndicator  │                     │
│  │ @NamedInterface  │  │ MeterRegistry    │                     │
│  └──────────────────┘  └──────────────────┘                     │
│                                                                  │
│  ┌──────────────────┐                                           │
│  │ DDD PATTERNS     │                                           │
│  │ @Service in      │                                           │
│  │   domain/**      │                                           │
│  │ @DomainService   │                                           │
│  │ @ValueObject     │                                           │
│  │ @AggregateRoot   │                                           │
│  └──────────────────┘                                           │
│                                                                  │
│  Result: detected_patterns = [{skill, risk_level, patterns[]}]  │
└───────────────────────────────┬─────────────────────────────────┘
                                │
                                ▼
┌─────────────────────────────────────────────────────────────────┐
│              PHASE 3: Risk Classification                        │
│                                                                  │
│  Categorize detected skills by risk:                            │
│                                                                  │
│  LOW_RISK = [                                                   │
│    spring-boot-web-api,                                         │
│    spring-boot-data-ddd,                                        │
│    domain-driven-design,                                        │
│    spring-boot-modulith,                                        │
│    spring-boot-observability                                    │
│  ]                                                               │
│                                                                  │
│  HIGH_RISK = [                                                  │
│    spring-boot-security,                                        │
│    spring-boot-testing,                                         │
│    spring-boot-verify                                           │
│  ]                                                               │
│                                                                  │
│  ESCALATION_TRIGGERS = [                                        │
│    @MockBean → deprecated warning                               │
│    @EnableGlobalMethodSecurity → deprecated warning             │
│    .and() in security → removed warning                         │
│    com.fasterxml.jackson → migration warning                    │
│    version < 3.0 → major migration warning                      │
│  ]                                                               │
│                                                                  │
│  Separate patterns into:                                        │
│    - low_risk_patterns[]                                        │
│    - high_risk_patterns[]                                       │
│    - escalation_patterns[]                                      │
└───────────────────────────────┬─────────────────────────────────┘
                                │
                                ▼
┌─────────────────────────────────────────────────────────────────┐
│              PHASE 4: Routing & Response                         │
│                                                                  │
│  CASE 1: Only LOW_RISK patterns                                 │
│  ────────────────────────────                                   │
│  → Auto-invoke relevant skill guidance                          │
│  → Format: "Working with [pattern]. Here's guidance:"           │
│  → Load skill Quick Reference inline                            │
│                                                                  │
│  CASE 2: Only HIGH_RISK patterns                                │
│  ────────────────────────────                                   │
│  → Use AskUserQuestion to confirm                               │
│  → Options:                                                     │
│    - "Load [skill] for detailed guidance"                       │
│    - "Run verification scan"                                    │
│    - "Continue without guidance"                                │
│  → Wait for user selection                                      │
│  → Route based on choice                                        │
│                                                                  │
│  CASE 3: Mixed LOW + HIGH risk                                  │
│  ────────────────────────────                                   │
│  → Auto-invoke LOW_RISK guidance                                │
│  → Separately ask about HIGH_RISK                               │
│  → Format: "Loaded [low] guidance. For [high], would you like?" │
│                                                                  │
│  CASE 4: ESCALATION triggers present                            │
│  ────────────────────────────                                   │
│  → Always show warning first                                    │
│  → Format: "⚠️ Detected deprecated pattern: [pattern]"          │
│  → Recommend specific action                                    │
│  → Then proceed with normal routing                             │
│                                                                  │
│  CASE 5: Many files / comprehensive request                     │
│  ────────────────────────────                                   │
│  → Delegate to spring-boot-reviewer agent                       │
│  → Format: "This requires comprehensive review. Launching..."   │
│  → Use Agent tool to invoke agent                               │
└─────────────────────────────────────────────────────────────────┘

Implementation Steps

Step 1: Detect Spring Boot Project

# Using Glob + Grep
1. files = Glob("**/pom.xml") + Glob("**/build.gradle*")
2. for file in files:
     content = Read(file)
     if "spring-boot-starter" in content or "org.springframework.boot" in content:
       return IS_SPRING_BOOT = True
3. return IS_SPRING_BOOT = False

Step 2: Scan for Annotations

# Using Grep with patterns
PATTERNS = {
    "web-api": r"@RestController|@GetMapping|@PostMapping|@RequestMapping",
    "data-ddd": r"@Entity|@Repository|@Aggregate|@MappedSuperclass",
    "security": r"@EnableWebSecurity|@PreAuthorize|@Secured|SecurityFilterChain",
    "testing": r"@SpringBootTest|@WebMvcTest|@DataJpaTest|@MockitoBean|@MockBean",
    "modulith": r"@ApplicationModule|@ApplicationModuleListener|@NamedInterface",
    "observability": r"@Timed|@Counted|HealthIndicator|MeterRegistry",
    "ddd": r"@DomainService|@ValueObject|@AggregateRoot"
}

detected = []
for skill, pattern in PATTERNS.items():
    matches = Grep(pattern, target_file)
    if matches:
        detected.append({"skill": skill, "matches": matches})

Step 3: Classify and Route

LOW_RISK = ["web-api", "data-ddd", "ddd", "modulith", "observability"]
HIGH_RISK = ["security", "testing", "verify"]

low_risk_detected = [d for d in detected if d["skill"] in LOW_RISK]
high_risk_detected = [d for d in detected if d["skill"] in HIGH_RISK]

# Check for escalation triggers
escalations = check_escalation_triggers(target_file)

# Route based on classification
if escalations:
    show_warnings(escalations)

if low_risk_detected:
    auto_invoke_guidance(low_risk_detected)

if high_risk_detected:
    ask_user_confirmation(high_risk_detected)

Grep Patterns Reference

Note: All patterns work with both Java (*.java) and Kotlin (*.kt) files.

Web API Patterns

grep -E "@RestController|@GetMapping|@PostMapping|@PutMapping|@DeleteMapping|@PatchMapping|@RequestMapping|@ResponseBody|@RequestBody|@PathVariable|@RequestParam" **/*.java **/*.kt

Data/Repository Patterns

grep -E "@Entity|@Repository|@Aggregate|@MappedSuperclass|@EmbeddedId|@Embeddable|@OneToMany|@ManyToOne|@JoinColumn" **/*.java **/*.kt

Security Patterns

grep -E "@EnableWebSecurity|@EnableMethodSecurity|@PreAuthorize|@PostAuthorize|@Secured|@RolesAllowed|SecurityFilterChain|AuthenticationManager|UserDetailsService" **/*.java **/*.kt

Testing Patterns

grep -E "@SpringBootTest|@WebMvcTest|@DataJpaTest|@DataJdbcTest|@JsonTest|@MockitoBean|@MockBean|@SpyBean|@ServiceConnection|Testcontainers" **/*.java **/*.kt

Modulith Patterns

grep -E "@ApplicationModule|@ApplicationModuleListener|@NamedInterface|@Externalized|ApplicationModuleTest" **/*.java **/*.kt

Observability Patterns

grep -E "@Timed|@Counted|@Observed|HealthIndicator|MeterRegistry|Tracer|Span|ObservationRegistry" **/*.java **/*.kt

Escalation Triggers

# Deprecated patterns requiring immediate attention
grep -E "@MockBean|@EnableGlobalMethodSecurity|\.and\(\)|antMatchers|authorizeRequests|com\.fasterxml\.jackson" **/*.java **/*.kt

Model Tier Performance

The scanner is designed for reliability across all model tiers:

The Python detection script handles heavy lifting, making results model-independent.

---

Response Templates

Low Risk Auto-Invoke Template

I notice you're working with {patterns}. Here's relevant guidance:

**From spring-boot-{skill}:**
- {quick reference point 1}
- {quick reference point 2}
- {quick reference point 3}

For detailed patterns, I can load the full skill guidance.

High Risk Confirmation Template

I detected {patterns} in your code. This involves {security/testing/migration} considerations.

Would you like me to:
1. Load spring-boot-{skill} for detailed guidance
2. Run a comprehensive verification scan
3. Continue without additional guidance

[AskUserQuestion with these options]

Escalation Warning Template

⚠️ **Deprecated Pattern Detected**

Found `{pattern}` which is {reason}.

**Recommended action:** {action}

**Migration:**

// Before (deprecated) {old_code}

// After (current) {new_code}

Would you like me to help migrate this pattern?

Delegation to Agent Template

This analysis requires reviewing multiple files. I'll delegate to the spring-boot-reviewer agent for a comprehensive scan.

**Scope:** {scope}
**Skills to check:** {relevant_skills}

Launching review...

[Agent tool to invoke spring-boot-reviewer agent]