First-party. This plugin is built and maintained by ShipWithAI. Unlike the reviewed third-party tools in this toolkit, it is our own product — judge it accordingly.
Problem it solves
Generic Spring Boot skill packs are exhaustive and passive: one large reference document that
loads only when a keyword happens to match. When the model scaffolds an @Entity, nothing
guarantees the “add @Version” rule fires. The knowledge exists but is not activated at the
moment of the mistake.
This toolkit inverts that. A deterministic hook runs on every Java edit and surfaces an advisory the instant a known anti-pattern appears. The reference material is there to explain why — it is not the mechanism.
How to install
/plugin marketplace add ShipWithAI/shipwithai-plugins/plugin install shipwithai-java-backend-toolkit@shipwithaiThen run the setup skill to wire the guardrail hook into the project.
How to use
Four mechanisms, in the order they matter:
- Guardrail hook —
hooks/jpa-guardrail.pyruns PostToolUse onWrite/Editof*.java(plusapplication.properties/.ymlfor config rules), and emits an advisory or blocks. - Scaffold skills —
jpa-entity,spring-rest-endpoint,db-migration,rest-error-handler,idempotent-endpoint,security-filter-chain,jwt-auth,integration-test,test-slice. Generate code that never trips the guardrail. - Knowledge skill —
springboot-conventions, split by domain: persistence, web, transactions, testing. - Reviewer agent —
springboot-reviewer, whose checklist is the ruleset.
A sample of what the ruleset catches:
| Rule | What it catches | Severity |
|---|---|---|
jpa-optimistic-lock | @Entity without @Version — lost updates | warning |
tx-proxy | @Transactional on a non-public method — silently not proxied | warning |
jpa-eager-fetch | FetchType.EAGER association — over-fetch and N+1 | warning |
jpa-osiv | spring.jpa.open-in-view=true — lazy loads leak to the view | warning |
nplus1-heuristic | repository call inside a loop | info |
jpql-injection | query built by string concatenation | blocks |
Pro tips
- Prefer the scaffold skills over asking for an entity in prose. Correct-by-default generation means the guardrail never has to fire.
- When the hook flags something you believe is fine, read the matching
springboot-conventionsreference before overriding — the rules encode failure modes that look harmless in review. - Keep the reviewer agent and the hook on the same version. They share one ruleset; that is the whole point.
When NOT to use
Not for anything that is not Spring Boot + JPA. Not a substitute for tests — it catches a specific class of persistence and web mistakes, and it is silent about your business logic.