PlugWiki

Java Spring Boot skill for Claude Code: REST APIs, Security, Data and Actuator

A third-party skill that gives Claude Spring Boot 3.x patterns for REST APIs, Spring Security, Spring Data and Actuator.

Installs
11.8K
on skills.sh
Stars
41
on GitHub
Files
5
besides SKILL.md
Updated
Jan 2026
last repo commit

java-spring-boot makes Claude follow a set of Spring Boot habits: controllers and DTOs, Bean Validation, a stateless SecurityFilterChain with JWT, Spring Data repositories and Actuator endpoints. It triggers when you ask for Spring Boot work. SKILL.md holds a quick reference, an application.yml template, a troubleshooting table and a debug checklist.

It is not from the Spring team. It is one of 12 Java skills by Dr. Umit Kacar and Muhsin Elcicek, and its allowed tools are Read, Write, Bash, Glob and Grep. The folder also holds a Python validation script, a config file, a JSON schema and two generic reference files.

Good for

  • Java developers building Spring Boot REST APIs with Claude Code
  • Teams that want a quick reference for Spring Security with OAuth2 and JWT
  • Developers setting up Spring Data JPA, validation and Actuator health checks

Install java-spring-boot

Claude Code

  1. 1

    Copy this prompt.

    Install the java-spring-boot skill in Claude Code. Run this command:

npx skills add https://github.com/pluginagentmarketplace/custom-plugin-java --skill java-spring-boot

Then check that it loaded and tell me how to use it.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

The plugin route installs the whole Java Development Assistant plugin: 12 skills, 8 agents and 4 commands (counted from plugin.json). Each agent lists the tools Read, Write, Bash, Glob and Grep, and the java-new command can create files and initialise git. The repo's marketplace.json is not in the Claude Code marketplace format (it has no plugins list, and the marketplace name used in the README command does not appear in it), so this route may not work as written. The skills CLI route installs only this skill. The skills CLI route is the default here because the plugin route may fail.

Built from the package data we hold. Not yet tested by us. Source.

What's in the skill

When it loads

Build production Spring Boot applications - REST APIs, Security, Data, Actuator

Sections in SKILL.md

  1. Overview
  2. When to Use This Skill
  3. Topics Covered
  4. Spring Boot Core
  5. REST API Development
  6. Spring Security
  7. Spring Data JPA
  8. Actuator & Monitoring
  9. Quick Reference
  10. Configuration Templates
  11. Common Patterns
  12. Layer Architecture
  13. Validation Patterns
  14. Troubleshooting
  15. Common Issues
  16. Debug Properties

Key facts

Author
Dr. Umit Kacar and Muhsin Elcicek (plugin.json and LICENSE), under the Plugin Agent Marketplace organization. Not by the Spring team.
License
Custom: README badge says Custom, plugin.json says SEE LICENSE IN LICENSE. The LICENSE (All Rights Reserved) grants a limited, revocable license for personal, educational or commercial use with restrictions, an at-your-own-risk clause and an indemnity by the user. GitHub reports no standard license.
Installs on skills.sh
11,790 as of Nov 2, 2026
GitHub stars
41 for the custom-plugin-java repo, Nov 2, 2026
What is inside
6 files including SKILL.md: scripts/validate.py, assets/config.yaml, assets/schema.json, references/GUIDE.md and references/PATTERNS.md (git tree)
Skill version
3.0.0 (SKILL.md frontmatter)
Part of
The java-development-assistant plugin: 12 skills, 8 agents, 4 commands
Last commit to the repo
Jan 5, 2026
Works in
Claude Code (README: "Claude Code Plugin", needs CLI v2.0.27 or newer)

What it includes

  • Five areas: core, REST, Security, Data JPA, Actuator

    Auto-configuration and profiles, @RestController and validation, SecurityFilterChain with OAuth2 and JWT, Spring Data repositories, and health checks with Micrometer and Prometheus.

    Try: “Add a REST endpoint with validation to my Spring Boot app.”

    Read · Topics covered

  • Sample controller, security config and exception handler

    Java code for a user controller, a stateless JWT security chain that calls csrf.disable(), and a @RestControllerAdvice using ProblemDetail.

    Read · Quick Reference

  • An application.yml template

    Sets profile defaults, JPA batch size and open-in-view false, exposes the health, info, metrics and prometheus actuator endpoints, and sets server.error.include-stacktrace to never.

    Read · Configuration Templates

  • Layer architecture and validation records

    Controller to service to repository, plus a record with @NotBlank, @Email and @Min validation.

    Read · Common Patterns

  • Table of four common problems and a debug checklist

    Covers a missing bean, circular dependency, 401 Unauthorized and slow startup, plus debug properties such as spring.jpa.show-sql=true.

    Read · Troubleshooting

  • spring_version (default 3.2) and a module focus

    The frontmatter lists module values web, security, data, actuator and cloud.

    Read · Parameters

  • Checks the skill folder layout and config.yaml

    A Python script that imports yaml and checks that SKILL.md, assets, scripts and references exist and that config.yaml has the expected fields. SKILL.md does not tell Claude to run it.

    Runs code · scripts/validate.py

  • GUIDE.md and PATTERNS.md use generic Python examples

    Both files are generic: they use placeholder Python examples and name java-spring-boot as a label. The Spring content lives in SKILL.md.

    Read · Reference files

From the official docs

Permissions

Medium risk

This skill is allowed to write files and run shell commands in your project. Use a clean git branch and review the diff, especially any security config.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • It can write files and run shell commands

    SKILL.md allows Read, Write, Bash, Glob and Grep. Run it on a clean git branch and review each change before you accept it. github.com

  • The sample security config disables CSRF

    The Quick Reference calls csrf.disable() with stateless sessions and JWT. That fits a token-only API but not a browser app that uses cookies, so check before copying it. github.com

  • The config template exposes metrics endpoints

    The application.yml template exposes health, info, metrics and prometheus over HTTP. Restrict who can reach them in production. github.com

  • The plugin route adds agents and commands

    plugin.json lists 8 agents (each with Read, Write, Bash, Glob, Grep) and 4 commands. java-new can create a project and run git init. hooks.json is empty. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details
Turning on read-onlySKILL.md names no read-only setting.
Scopes

  • Allowed tools: Read, Write, Bash, Glob, Grep (SKILL.md frontmatter)

  • Bundles scripts/validate.py, which reads files in the skill folder

  • The plugin route adds 8 agents with Bash and Write access and 4 commands

Questions

What does the java-spring-boot skill do?

It gives Claude a Spring Boot 3.x playbook: REST controllers with validation, a stateless JWT security config, Spring Data JPA, Actuator and a troubleshooting table. Claude uses it when you ask for Spring Boot code.

Is it made by the Spring team?

No. plugin.json names Dr. Umit Kacar and Muhsin Elcicek as authors, under the Plugin Agent Marketplace organization.

How do I install it?

Use the install box above. The skills CLI route installs only this skill. The README documents a plugin route that adds 12 skills, 8 agents and 4 commands, but the repo's marketplace.json is not in the Claude Code marketplace format, so that route may not work.

Is it safe to use?

It can write files and run shell commands, because its allowed tools are Read, Write, Bash, Glob and Grep. It bundles one Python script that checks the skill folder layout and config file. Our advice: use it on a clean git branch and read the security config it writes before you deploy.

Can I use it in a commercial project?

The LICENSE says All Rights Reserved and grants a limited, non-exclusive, revocable license to use, modify and copy the software for personal, educational or commercial purposes. You may not remove notices, claim authorship, sublicense or sell it, or use the authors' names for endorsement. You use it at your own risk with no warranty, and section 8 has you indemnify the authors against claims from your use. It is a custom license, not MIT or Apache, so read it before you ship anything built on it.

Does it need other skills?

No. SKILL.md lists java-testing and java-jpa-hibernate as related skills, but the skill does not call them. They are in the same repo if you want Spring test and data-access patterns.

Information

updated Nov 2, 2026

Repository
pluginagentmarketplace/custom-plugin-java
Folder
skills/java-spring-boot

pluginagentmarketplace/custom-plugin-javaskills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 9
  1. custom-plugin-java README · github.com
  2. plugin.json · github.com
  3. marketplace.json · github.com
  4. java-spring-boot SKILL.md · github.com
  5. skills.sh listing · skills.sh
  6. LICENSE · github.com
  7. hooks.json · github.com
  8. validate.py · github.com
  9. 03-java-spring agent · github.com

Updated Nov 2, 2026.