[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-jetbrains-spring-security-configurator-auditor":3,"mdc-pmfoc7-key":39,"related-repo-jetbrains-spring-security-configurator-auditor":451,"related-org-jetbrains-spring-security-configurator-auditor":573},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":28,"repoUrl":29,"updatedAt":30,"license":31,"forks":32,"topics":33,"repo":34,"sourceUrl":37,"mdContent":38},"spring-security-configurator-auditor","configure and audit Spring Security settings","Design and audit Spring Security configurations for Kotlin plus Spring services, including filter chains, JWT or OAuth2 resource server setup, method security, CORS, CSRF rationale, and public endpoint exposure. Use when adding or reviewing authentication and authorization, narrowing access rules, validating token handling, or checking for insecure defaults and accidental exposure.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},"jetbrains","JetBrains","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fjetbrains.png",[12,16,19,22,25],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Kotlin","kotlin",{"name":20,"slug":21,"type":15},"Auth","auth",{"name":23,"slug":24,"type":15},"Audit","audit",{"name":26,"slug":27,"type":15},"Spring","spring",252,"https:\u002F\u002Fgithub.com\u002FJetBrains\u002Fskills","2026-07-13T06:41:53.005719",null,17,[],{"repoUrl":29,"stars":28,"forks":32,"topics":35,"description":36},[],"Curated agent skills collection verified by JetBrains","https:\u002F\u002Fgithub.com\u002FJetBrains\u002Fskills\u002Ftree\u002FHEAD\u002Fspring-security-configurator-auditor","---\nname: spring-security-configurator-auditor\ndescription: Design and audit Spring Security configurations for Kotlin plus Spring services, including filter chains, JWT or OAuth2 resource server setup, method security, CORS, CSRF rationale, and public endpoint exposure. Use when adding or reviewing authentication and authorization, narrowing access rules, validating token handling, or checking for insecure defaults and accidental exposure.\nmetadata:\n  short-description: \"Build and audit secure filter chains\"\n  author: Kotlin\n  source: https:\u002F\u002Fgithub.com\u002FKotlin\u002Fkotlin-backend-agent-skills\u002Ftree\u002Fmain\u002F.agents\u002Fskills\u002Fspring-security-configurator-auditor\n---\n\n# Spring Security Configurator Auditor\n\nSource mapping: Tier 2 high-value skill derived from `Kotlin_Spring_Developer_Pipeline.md` (`SK-13`).\n\n## Mission\n\nProduce a security model that is explicit, minimal, and testable.\nOptimize for least privilege and correct failure semantics, not for shortest config.\n\n## Read First\n\n- Current `SecurityFilterChain` or chains.\n- Endpoint inventory, including actuator, docs, and internal admin routes.\n- Authentication model: session, JWT, OAuth2 resource server, API keys, mTLS, or mixed.\n- Authorization model: roles, scopes, claims, method security, tenant boundaries.\n- CORS, CSRF, and security-related tests.\n\n## Design Sequence\n\n1. Define who the clients are: browser, internal service, public API consumer, job, or operator.\n2. Define authentication mechanism and token trust boundaries.\n3. Enumerate public endpoints explicitly.\n4. Define authorization at URL and method level.\n5. Define 401 and 403 behavior.\n6. Add tests for the critical allowed and denied paths.\n\n## Core Security Rules\n\n- Prefer explicit allowlists for public endpoints.\n- Validate JWT issuer, audience, expiration, signature, and clock-skew assumptions deliberately.\n- Map claims to authorities with a documented rule. Do not assume the default claim mapping is correct for the identity provider.\n- Keep method security and request security aligned. One should not silently compensate for the other.\n- Treat CORS as a policy surface, not a browser nuisance.\n\n## Advanced Security Traps\n\n- Multiple filter chains are ordered. A broad matcher in the wrong chain can shadow a more specific secure chain.\n- `permitAll` for docs or actuator endpoints often expands further than intended when matchers are too broad.\n- CSRF is not automatically irrelevant just because the app uses tokens somewhere. Browser-based flows and cookie-backed auth change the answer.\n- Async execution, schedulers, and message listeners may not carry the same security context as request threads.\n- Method security on internal helper methods does not help if the call never crosses the proxy boundary.\n- JWT validation without issuer or audience checks is weaker than many teams realize.\n- CORS preflight failures can look like auth failures even when the backend logic is correct.\n- Security behavior differs between servlet and reactive stacks; do not transplant config blindly.\n\n## Advanced AuthZ And Token Nuances\n\n- Path-based authorization is often necessary but rarely sufficient. Tenant, ownership, or resource-state checks may belong in method or domain-level authorization.\n- JWT key rotation, JWKS caching, and clock skew policy are operational concerns as well as security concerns. Token validation must keep working during key rollover.\n- Opaque token introspection, JWT validation, and gateway-terminated auth have different failure modes and trust boundaries. Be explicit about which layer owns what.\n- Custom claim mapping can accidentally drop scopes or elevate privileges if the mapping rule is too permissive.\n- Security headers, session creation policy, and stateless assumptions should match the actual client model rather than copied boilerplate.\n\n## Expert Heuristics\n\n- Model \"who can do what to which resource under which tenant or context\" before writing matcher code.\n- Prefer deny-by-default designs where new endpoints start closed unless explicitly opened.\n- If browser and machine clients coexist, treat them as separate security surfaces even inside one service.\n- If an endpoint is operationally sensitive but \"internal,\" still secure it explicitly. Internal does not mean safe.\n\n## Output Contract\n\nReturn these sections:\n\n- `Threat surface`: what must be protected and from whom.\n- `Authentication model`: how identity is established and verified.\n- `Authorization model`: how access decisions are made.\n- `Critical findings or risks`: insecure defaults, over-broad rules, missing checks, missing tests.\n- `Minimal secure config plan`: the smallest safe configuration or patch.\n- `Verification`: security tests for both allowed and denied access.\n\n## Guardrails\n\n- Do not disable CSRF or frame options without explaining the trust model.\n- Do not rely on default matcher behavior without checking path coverage.\n- Do not leave actuator, Swagger, or internal diagnostics exposed by convenience.\n- Do not generate security config without tests for the key routes.\n- Do not conflate authentication failure with authorization failure.\n\n## Quality Bar\n\nA good run of this skill makes the access model explicit and auditable.\nA bad run produces a working login flow while leaving route exposure, token validation, or test coverage dangerously vague.\n",{"data":40,"body":44},{"name":4,"description":6,"metadata":41},{"short-description":42,"author":17,"source":43},"Build and audit secure filter chains","https:\u002F\u002Fgithub.com\u002FKotlin\u002Fkotlin-backend-agent-skills\u002Ftree\u002Fmain\u002F.agents\u002Fskills\u002Fspring-security-configurator-auditor",{"type":45,"children":46},"root",[47,55,78,85,90,96,134,140,174,180,208,214,263,269,297,303,326,332,337,406,412,440,446],{"type":48,"tag":49,"props":50,"children":51},"element","h1",{"id":4},[52],{"type":53,"value":54},"text","Spring Security Configurator Auditor",{"type":48,"tag":56,"props":57,"children":58},"p",{},[59,61,68,70,76],{"type":53,"value":60},"Source mapping: Tier 2 high-value skill derived from ",{"type":48,"tag":62,"props":63,"children":65},"code",{"className":64},[],[66],{"type":53,"value":67},"Kotlin_Spring_Developer_Pipeline.md",{"type":53,"value":69}," (",{"type":48,"tag":62,"props":71,"children":73},{"className":72},[],[74],{"type":53,"value":75},"SK-13",{"type":53,"value":77},").",{"type":48,"tag":79,"props":80,"children":82},"h2",{"id":81},"mission",[83],{"type":53,"value":84},"Mission",{"type":48,"tag":56,"props":86,"children":87},{},[88],{"type":53,"value":89},"Produce a security model that is explicit, minimal, and testable.\nOptimize for least privilege and correct failure semantics, not for shortest config.",{"type":48,"tag":79,"props":91,"children":93},{"id":92},"read-first",[94],{"type":53,"value":95},"Read First",{"type":48,"tag":97,"props":98,"children":99},"ul",{},[100,114,119,124,129],{"type":48,"tag":101,"props":102,"children":103},"li",{},[104,106,112],{"type":53,"value":105},"Current ",{"type":48,"tag":62,"props":107,"children":109},{"className":108},[],[110],{"type":53,"value":111},"SecurityFilterChain",{"type":53,"value":113}," or chains.",{"type":48,"tag":101,"props":115,"children":116},{},[117],{"type":53,"value":118},"Endpoint inventory, including actuator, docs, and internal admin routes.",{"type":48,"tag":101,"props":120,"children":121},{},[122],{"type":53,"value":123},"Authentication model: session, JWT, OAuth2 resource server, API keys, mTLS, or mixed.",{"type":48,"tag":101,"props":125,"children":126},{},[127],{"type":53,"value":128},"Authorization model: roles, scopes, claims, method security, tenant boundaries.",{"type":48,"tag":101,"props":130,"children":131},{},[132],{"type":53,"value":133},"CORS, CSRF, and security-related tests.",{"type":48,"tag":79,"props":135,"children":137},{"id":136},"design-sequence",[138],{"type":53,"value":139},"Design Sequence",{"type":48,"tag":141,"props":142,"children":143},"ol",{},[144,149,154,159,164,169],{"type":48,"tag":101,"props":145,"children":146},{},[147],{"type":53,"value":148},"Define who the clients are: browser, internal service, public API consumer, job, or operator.",{"type":48,"tag":101,"props":150,"children":151},{},[152],{"type":53,"value":153},"Define authentication mechanism and token trust boundaries.",{"type":48,"tag":101,"props":155,"children":156},{},[157],{"type":53,"value":158},"Enumerate public endpoints explicitly.",{"type":48,"tag":101,"props":160,"children":161},{},[162],{"type":53,"value":163},"Define authorization at URL and method level.",{"type":48,"tag":101,"props":165,"children":166},{},[167],{"type":53,"value":168},"Define 401 and 403 behavior.",{"type":48,"tag":101,"props":170,"children":171},{},[172],{"type":53,"value":173},"Add tests for the critical allowed and denied paths.",{"type":48,"tag":79,"props":175,"children":177},{"id":176},"core-security-rules",[178],{"type":53,"value":179},"Core Security Rules",{"type":48,"tag":97,"props":181,"children":182},{},[183,188,193,198,203],{"type":48,"tag":101,"props":184,"children":185},{},[186],{"type":53,"value":187},"Prefer explicit allowlists for public endpoints.",{"type":48,"tag":101,"props":189,"children":190},{},[191],{"type":53,"value":192},"Validate JWT issuer, audience, expiration, signature, and clock-skew assumptions deliberately.",{"type":48,"tag":101,"props":194,"children":195},{},[196],{"type":53,"value":197},"Map claims to authorities with a documented rule. Do not assume the default claim mapping is correct for the identity provider.",{"type":48,"tag":101,"props":199,"children":200},{},[201],{"type":53,"value":202},"Keep method security and request security aligned. One should not silently compensate for the other.",{"type":48,"tag":101,"props":204,"children":205},{},[206],{"type":53,"value":207},"Treat CORS as a policy surface, not a browser nuisance.",{"type":48,"tag":79,"props":209,"children":211},{"id":210},"advanced-security-traps",[212],{"type":53,"value":213},"Advanced Security Traps",{"type":48,"tag":97,"props":215,"children":216},{},[217,222,233,238,243,248,253,258],{"type":48,"tag":101,"props":218,"children":219},{},[220],{"type":53,"value":221},"Multiple filter chains are ordered. A broad matcher in the wrong chain can shadow a more specific secure chain.",{"type":48,"tag":101,"props":223,"children":224},{},[225,231],{"type":48,"tag":62,"props":226,"children":228},{"className":227},[],[229],{"type":53,"value":230},"permitAll",{"type":53,"value":232}," for docs or actuator endpoints often expands further than intended when matchers are too broad.",{"type":48,"tag":101,"props":234,"children":235},{},[236],{"type":53,"value":237},"CSRF is not automatically irrelevant just because the app uses tokens somewhere. Browser-based flows and cookie-backed auth change the answer.",{"type":48,"tag":101,"props":239,"children":240},{},[241],{"type":53,"value":242},"Async execution, schedulers, and message listeners may not carry the same security context as request threads.",{"type":48,"tag":101,"props":244,"children":245},{},[246],{"type":53,"value":247},"Method security on internal helper methods does not help if the call never crosses the proxy boundary.",{"type":48,"tag":101,"props":249,"children":250},{},[251],{"type":53,"value":252},"JWT validation without issuer or audience checks is weaker than many teams realize.",{"type":48,"tag":101,"props":254,"children":255},{},[256],{"type":53,"value":257},"CORS preflight failures can look like auth failures even when the backend logic is correct.",{"type":48,"tag":101,"props":259,"children":260},{},[261],{"type":53,"value":262},"Security behavior differs between servlet and reactive stacks; do not transplant config blindly.",{"type":48,"tag":79,"props":264,"children":266},{"id":265},"advanced-authz-and-token-nuances",[267],{"type":53,"value":268},"Advanced AuthZ And Token Nuances",{"type":48,"tag":97,"props":270,"children":271},{},[272,277,282,287,292],{"type":48,"tag":101,"props":273,"children":274},{},[275],{"type":53,"value":276},"Path-based authorization is often necessary but rarely sufficient. Tenant, ownership, or resource-state checks may belong in method or domain-level authorization.",{"type":48,"tag":101,"props":278,"children":279},{},[280],{"type":53,"value":281},"JWT key rotation, JWKS caching, and clock skew policy are operational concerns as well as security concerns. Token validation must keep working during key rollover.",{"type":48,"tag":101,"props":283,"children":284},{},[285],{"type":53,"value":286},"Opaque token introspection, JWT validation, and gateway-terminated auth have different failure modes and trust boundaries. Be explicit about which layer owns what.",{"type":48,"tag":101,"props":288,"children":289},{},[290],{"type":53,"value":291},"Custom claim mapping can accidentally drop scopes or elevate privileges if the mapping rule is too permissive.",{"type":48,"tag":101,"props":293,"children":294},{},[295],{"type":53,"value":296},"Security headers, session creation policy, and stateless assumptions should match the actual client model rather than copied boilerplate.",{"type":48,"tag":79,"props":298,"children":300},{"id":299},"expert-heuristics",[301],{"type":53,"value":302},"Expert Heuristics",{"type":48,"tag":97,"props":304,"children":305},{},[306,311,316,321],{"type":48,"tag":101,"props":307,"children":308},{},[309],{"type":53,"value":310},"Model \"who can do what to which resource under which tenant or context\" before writing matcher code.",{"type":48,"tag":101,"props":312,"children":313},{},[314],{"type":53,"value":315},"Prefer deny-by-default designs where new endpoints start closed unless explicitly opened.",{"type":48,"tag":101,"props":317,"children":318},{},[319],{"type":53,"value":320},"If browser and machine clients coexist, treat them as separate security surfaces even inside one service.",{"type":48,"tag":101,"props":322,"children":323},{},[324],{"type":53,"value":325},"If an endpoint is operationally sensitive but \"internal,\" still secure it explicitly. Internal does not mean safe.",{"type":48,"tag":79,"props":327,"children":329},{"id":328},"output-contract",[330],{"type":53,"value":331},"Output Contract",{"type":48,"tag":56,"props":333,"children":334},{},[335],{"type":53,"value":336},"Return these sections:",{"type":48,"tag":97,"props":338,"children":339},{},[340,351,362,373,384,395],{"type":48,"tag":101,"props":341,"children":342},{},[343,349],{"type":48,"tag":62,"props":344,"children":346},{"className":345},[],[347],{"type":53,"value":348},"Threat surface",{"type":53,"value":350},": what must be protected and from whom.",{"type":48,"tag":101,"props":352,"children":353},{},[354,360],{"type":48,"tag":62,"props":355,"children":357},{"className":356},[],[358],{"type":53,"value":359},"Authentication model",{"type":53,"value":361},": how identity is established and verified.",{"type":48,"tag":101,"props":363,"children":364},{},[365,371],{"type":48,"tag":62,"props":366,"children":368},{"className":367},[],[369],{"type":53,"value":370},"Authorization model",{"type":53,"value":372},": how access decisions are made.",{"type":48,"tag":101,"props":374,"children":375},{},[376,382],{"type":48,"tag":62,"props":377,"children":379},{"className":378},[],[380],{"type":53,"value":381},"Critical findings or risks",{"type":53,"value":383},": insecure defaults, over-broad rules, missing checks, missing tests.",{"type":48,"tag":101,"props":385,"children":386},{},[387,393],{"type":48,"tag":62,"props":388,"children":390},{"className":389},[],[391],{"type":53,"value":392},"Minimal secure config plan",{"type":53,"value":394},": the smallest safe configuration or patch.",{"type":48,"tag":101,"props":396,"children":397},{},[398,404],{"type":48,"tag":62,"props":399,"children":401},{"className":400},[],[402],{"type":53,"value":403},"Verification",{"type":53,"value":405},": security tests for both allowed and denied access.",{"type":48,"tag":79,"props":407,"children":409},{"id":408},"guardrails",[410],{"type":53,"value":411},"Guardrails",{"type":48,"tag":97,"props":413,"children":414},{},[415,420,425,430,435],{"type":48,"tag":101,"props":416,"children":417},{},[418],{"type":53,"value":419},"Do not disable CSRF or frame options without explaining the trust model.",{"type":48,"tag":101,"props":421,"children":422},{},[423],{"type":53,"value":424},"Do not rely on default matcher behavior without checking path coverage.",{"type":48,"tag":101,"props":426,"children":427},{},[428],{"type":53,"value":429},"Do not leave actuator, Swagger, or internal diagnostics exposed by convenience.",{"type":48,"tag":101,"props":431,"children":432},{},[433],{"type":53,"value":434},"Do not generate security config without tests for the key routes.",{"type":48,"tag":101,"props":436,"children":437},{},[438],{"type":53,"value":439},"Do not conflate authentication failure with authorization failure.",{"type":48,"tag":79,"props":441,"children":443},{"id":442},"quality-bar",[444],{"type":53,"value":445},"Quality Bar",{"type":48,"tag":56,"props":447,"children":448},{},[449],{"type":53,"value":450},"A good run of this skill makes the access model explicit and auditable.\nA bad run produces a working login flow while leaving route exposure, token validation, or test coverage dangerously vague.",{"items":452,"total":572},[453,472,489,505,520,539,556],{"slug":454,"name":454,"fn":455,"description":456,"org":457,"tags":458,"stars":28,"repoUrl":29,"updatedAt":471},"algorithmic-art","create generative art with p5.js","Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright violations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[459,462,465,468],{"name":460,"slug":461,"type":15},"Creative","creative",{"name":463,"slug":464,"type":15},"Generative Art","generative-art",{"name":466,"slug":467,"type":15},"Graphics","graphics",{"name":469,"slug":470,"type":15},"JavaScript","javascript","2026-07-13T06:41:35.540127",{"slug":473,"name":473,"fn":474,"description":475,"org":476,"tags":477,"stars":28,"repoUrl":29,"updatedAt":488},"antfu","configure JavaScript projects with Anthony Fu's tools","Anthony Fu's opinionated tooling and conventions for JavaScript\u002FTypeScript projects. Use when setting up new projects, configuring ESLint\u002FPrettier alternatives, monorepos, library publishing, or when the user mentions Anthony Fu's preferences.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[478,481,484,485],{"name":479,"slug":480,"type":15},"Best Practices","best-practices",{"name":482,"slug":483,"type":15},"Engineering","engineering",{"name":469,"slug":470,"type":15},{"name":486,"slug":487,"type":15},"TypeScript","typescript","2026-07-13T06:43:13.153309",{"slug":490,"name":490,"fn":491,"description":492,"org":493,"tags":494,"stars":28,"repoUrl":29,"updatedAt":504},"brand-guidelines","apply Anthropic brand guidelines","Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use it when brand colors or style guidelines, visual formatting, or company design standards apply.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[495,498,501],{"name":496,"slug":497,"type":15},"Branding","branding",{"name":499,"slug":500,"type":15},"Design","design",{"name":502,"slug":503,"type":15},"Typography","typography","2026-07-13T06:43:06.077629",{"slug":506,"name":506,"fn":507,"description":508,"org":509,"tags":510,"stars":28,"repoUrl":29,"updatedAt":519},"canvas-design","create visual art and design assets","Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[511,512,513,516],{"name":460,"slug":461,"type":15},{"name":499,"slug":500,"type":15},{"name":514,"slug":515,"type":15},"Images","images",{"name":517,"slug":518,"type":15},"PDF","pdf","2026-07-13T06:39:58.803113",{"slug":521,"name":521,"fn":522,"description":523,"org":524,"tags":525,"stars":28,"repoUrl":29,"updatedAt":538},"ci-cd-containerization-advisor","design CI\u002FCD pipelines for Kotlin applications","Design reproducible build, image, and deployment pipelines for Kotlin plus Spring applications, including CI verification, layered containers, rollout safety, and deployment-time migration coordination. Use when creating or improving Dockerfiles, CI workflows, image hardening, Kubernetes manifests, release gates, or deployment strategies for Spring Boot services, especially where build reproducibility and operational safety matter.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[526,529,532,535,536,537],{"name":527,"slug":528,"type":15},"CI\u002FCD","ci-cd",{"name":530,"slug":531,"type":15},"Containers","containers",{"name":533,"slug":534,"type":15},"Deployment","deployment",{"name":482,"slug":483,"type":15},{"name":17,"slug":18,"type":15},{"name":26,"slug":27,"type":15},"2026-07-13T06:41:47.83899",{"slug":540,"name":540,"fn":541,"description":542,"org":543,"tags":544,"stars":28,"repoUrl":29,"updatedAt":555},"cloudflare-deploy","deploy applications to Cloudflare","Deploy applications and infrastructure to Cloudflare using Workers, Pages, and related platform services. Use when the user asks to deploy, host, publish, or set up a project on Cloudflare.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[545,548,551,554],{"name":546,"slug":547,"type":15},"Cloudflare","cloudflare",{"name":549,"slug":550,"type":15},"Cloudflare Pages","cloudflare-pages",{"name":552,"slug":553,"type":15},"Cloudflare Workers","cloudflare-workers",{"name":533,"slug":534,"type":15},"2026-07-17T06:04:42.853896",{"slug":557,"name":557,"fn":558,"description":559,"org":560,"tags":561,"stars":28,"repoUrl":29,"updatedAt":571},"compose-ui-control","interact with Compose Desktop applications","Control a running Compose Desktop application via HTTP. Use when you need to interact with UI elements, click buttons, enter text, wait for elements to appear, or capture screenshots in a Compose Desktop app that has compose-ui-test-server enabled.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[562,565,568],{"name":563,"slug":564,"type":15},"Automation","automation",{"name":566,"slug":567,"type":15},"Desktop","desktop",{"name":569,"slug":570,"type":15},"UI Components","ui-components","2026-07-13T06:40:38.798626",128,{"items":574,"total":699},[575,591,600,609,620,630,639,648,657,667,676,689],{"slug":576,"name":576,"fn":577,"description":578,"org":579,"tags":580,"stars":588,"repoUrl":589,"updatedAt":590},"mps-aspect-accessories","configure JetBrains MPS module dependencies","Wire MPS module and model dependencies, used languages, used devkits, extended languages, runtime solutions, accessory models, and language\u002Fdependency versions. Use when adding\u002Fremoving module dependencies, importing languages or devkits into a model, declaring runtime solutions, or shipping accessory content visible to consumers without explicit import.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[581,584,587],{"name":582,"slug":583,"type":15},"Architecture","architecture",{"name":585,"slug":586,"type":15},"Configuration","configuration",{"name":482,"slug":483,"type":15},1650,"https:\u002F\u002Fgithub.com\u002FJetBrains\u002FMPS","2026-07-17T06:06:57.311661",{"slug":592,"name":592,"fn":593,"description":594,"org":595,"tags":596,"stars":588,"repoUrl":589,"updatedAt":599},"mps-aspect-actions","define and edit MPS node factories","Use when defining or editing MPS node factories (the \"actions\" aspect) — `NodeFactories` roots, per-concept `NodeFactory` setup functions that initialize a freshly created node and optionally copy data from a replaced `sampleNode`, plus the actions aspect's `CopyPasteHandlers` and `PasteWrappers` roots. Reach for this skill when a substitution, side transform, completion replacement, or `add new initialized(...)` should preserve fields from the node it is replacing, or when defaults set in a constructor are not enough.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[597,598],{"name":582,"slug":583,"type":15},{"name":482,"slug":483,"type":15},"2026-07-17T06:04:48.066901",{"slug":601,"name":601,"fn":602,"description":603,"org":604,"tags":605,"stars":588,"repoUrl":589,"updatedAt":608},"mps-aspect-behavior","define and edit MPS concept behavior","Use when defining or editing MPS `ConceptBehavior` — per-concept methods (non-virtual \u002F virtual \u002F abstract \u002F static \u002F virtual static), constructors, virtual dispatch (MRO), super and interface-default calls (`super\u003CInterface>.method`), overriding methods from `lang.core.behavior` interfaces such as `ScopeProvider.getScope` \u002F `INamedConcept.getName` \u002F `BaseConcept.getPresentation`, calling sibling methods (`LocalBehaviorMethodCall`) and behavior methods from other aspects via `node.method(...)`. Reach for this skill whenever the task involves authoring or modifying `\u003Clang>\u002FlanguageModels\u002Fbehavior.mps`.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[606,607],{"name":582,"slug":583,"type":15},{"name":482,"slug":483,"type":15},"2026-07-13T06:45:21.757084",{"slug":610,"name":610,"fn":611,"description":612,"org":613,"tags":614,"stars":588,"repoUrl":589,"updatedAt":619},"mps-aspect-constraints","define JetBrains MPS language constraints","Use when defining or editing MPS language constraints — property validators \u002F setters \u002F getters, referent search scopes (imperative or inherited via `ScopeProvider.getScope`), `referentSetHandler` side effects, default-scope blocks, `canBeChild` \u002F `canBeParent` \u002F `canBeAncestor` \u002F `canBeRoot` placement rules, `defaultConcreteConcept` for abstract concepts, `set \u003Cread-only>` and `{name}` aliasing, and scope helpers (`SimpleRoleScope`, `ListScope`, `CompositeScope`, `HidingByNameScope`). Reach for this skill whenever the task involves authoring or modifying `\u003Clang>\u002FlanguageModels\u002Fconstraints.mps`.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[615,616],{"name":582,"slug":583,"type":15},{"name":617,"slug":618,"type":15},"Code Analysis","code-analysis","2026-07-23T05:41:33.639365",{"slug":621,"name":621,"fn":622,"description":623,"org":624,"tags":625,"stars":588,"repoUrl":589,"updatedAt":629},"mps-aspect-dataflow","define and debug MPS dataflow builders","Use when defining or debugging MPS dataflow builders for a concept — control\u002Fdata flow declarations that drive reachability analysis and variable-use checking. Covers DataFlowBuilderDeclaration, BuilderBlock, emit instructions (code for, jump, ifjump, label, read, write, ret, mayBeUnreachable), positions (AfterPosition, BeforePosition, LabelPosition), the jetbrains.mps.lang.dataFlow language, the NodeParameter implicit, BL+smodel usage inside builder bodies, and IBuilderMode for advanced analyses such as nullable\u002Fnon-null tracking.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[626],{"name":627,"slug":628,"type":15},"Data Analysis","data-analysis","2026-07-13T06:45:19.114674",{"slug":631,"name":631,"fn":632,"description":633,"org":634,"tags":635,"stars":588,"repoUrl":589,"updatedAt":638},"mps-aspect-editor","define MPS editor layouts","Use when creating or changing MPS editor definitions — the overall workflow from scaffolding a `ConceptEditorDeclaration` through componentizing reusable `EditorComponentDeclaration`s, refining cell models and cell layouts, applying style sheets and indent-layout style items, wiring smart references, leveraging inheritance via super-concepts and interfaces, inspecting (`print_node_json`, `show_node_representation`) and validating (`check_root_node_problems`). Covers `jetbrains.mps.lang.editor` cell models (`CellModel_RefNode`\u002F`CellModel_RefNodeList`\u002F`CellModel_RefCell`\u002F`CellModel_Property`\u002F`CellModel_Constant`), layout choices, and JSON blueprints for common editor shapes. For the non-layout side (action maps, keymaps, transformation\u002Fsubstitute menus) use `mps-aspect-editor-menus-and-keymaps`.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[636,637],{"name":499,"slug":500,"type":15},{"name":569,"slug":570,"type":15},"2026-07-23T05:41:56.638151",{"slug":640,"name":640,"fn":641,"description":642,"org":643,"tags":644,"stars":588,"repoUrl":589,"updatedAt":647},"mps-aspect-editor-menus-and-keymaps","author MPS editor menus and keymaps","Use when authoring the **non-layout** parts of the MPS editor aspect — what happens when the user types, presses a key, triggers completion, pastes, or invokes a context action. Covers action maps (`CellActionMapDeclaration`), cell keymaps (`CellKeyMapDeclaration`), transformation menus (`TransformationMenu_Default` \u002F `_Named` \u002F `_Contribution`), substitute menus (`SubstituteMenu_Default` \u002F `SubstituteMenu` \u002F contributions), side transforms (LEFT\u002FRIGHT), legacy cell menus, paste wrappers and copy-paste handlers (in the actions language), completion styling, reference presentation, two-step deletion, and the editor selection API. Trigger terms: `actionMap`, `keyMap`, `delete_action_id`, `transformationMenu`, `substituteMenu`, `Ctrl+Space`, `Ctrl+Alt+B`, side transform, paste wrapper, completion styling, `PasteWrappers`, `CopyPasteHandlers`. For the **layout** side (cells, layouts, style sheets) use `mps-aspect-editor` instead.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[645,646],{"name":482,"slug":483,"type":15},{"name":569,"slug":570,"type":15},"2026-07-23T05:41:49.666535",{"slug":649,"name":649,"fn":650,"description":651,"org":652,"tags":653,"stars":588,"repoUrl":589,"updatedAt":656},"mps-aspect-generation-plan","modify MPS generation plans","Use when defining or modifying an MPS generation plan — explicit ordering of generators, checkpoints for cross-model reference resolution, forks for parallel branches, IncludePlan composition, conditional PlanContribution activation, ParameterEquals\u002FConceptListSelector fork selectors, and InitModelAttributes for targetFacet routing. Apply when working with @genplan models, the jetbrains.mps.lang.generator.plan language, attaching plans via DevKits or the Custom generation facet, or debugging cross-model mapping label resolution.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[654,655],{"name":582,"slug":583,"type":15},{"name":482,"slug":483,"type":15},"2026-07-13T06:44:59.507855",{"slug":658,"name":658,"fn":659,"description":660,"org":661,"tags":662,"stars":588,"repoUrl":589,"updatedAt":666},"mps-aspect-generator","define JetBrains MPS generator rules","Use when defining or modifying MPS generators — author a generator module, add or edit root\u002Freduction\u002Fweaving\u002Fpattern mapping rules, attach template macros ($COPY_SRC, $LOOP, $IF, $PROPERTY, $REF, $SWITCH, $MAP_SRC, $WEAVE, $INSERT, $LABEL, $TRACE, $VAR), wire mapping labels, build template switches, write pre\u002Fpost mapping scripts, navigate `genContext`, or debug \"rule didn't fire\", missing references, empty output, infinite reduction loops, and generated-Java compile failures.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[663,664,665],{"name":582,"slug":583,"type":15},{"name":617,"slug":618,"type":15},{"name":482,"slug":483,"type":15},"2026-07-17T06:06:58.042999",{"slug":668,"name":668,"fn":669,"description":670,"org":671,"tags":672,"stars":588,"repoUrl":589,"updatedAt":675},"mps-aspect-intentions","define and edit MPS intentions","Use when defining or editing MPS intentions (the Alt+Enter context-action aspect) — adding `IntentionDeclaration` roots, parameterized or surround-with variants, description\u002FisApplicable\u002Fexecute blocks, child-filter functions, factory-initialized AST splicing, or debugging why an intention is not offered. Lives in the language's `intentions` model and uses `jetbrains.mps.lang.intentions`.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[673,674],{"name":582,"slug":583,"type":15},{"name":482,"slug":483,"type":15},"2026-07-23T05:41:48.692899",{"slug":677,"name":677,"fn":678,"description":679,"org":680,"tags":681,"stars":588,"repoUrl":589,"updatedAt":688},"mps-aspect-migrations","author and debug MPS migration scripts","Use when authoring or debugging MPS migration scripts that upgrade user models after a language definition changes — covers jetbrains.mps.lang.migration (MigrationScript class-based, PureMigrationScript declarative, MoveConcept\u002FMoveContainmentLink\u002FMoveReferenceLink\u002FMoveProperty, ordering via OrderDependency, data exchange via putData\u002FgetData, RefactoringLog, ConceptMigrationReference) and jetbrains.mps.lang.script Enhancement Scripts (MigrationScript with MigrationScriptPart_Instance, ExtractInterfaceMigration, FactoryMigrationScriptPart, CommentMigrationScriptPart) — when a model needs version-gated upgrade, concept rename or removal, link or property rename, instance-level transformation, or composition of migration steps.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[682,685],{"name":683,"slug":684,"type":15},"Debugging","debugging",{"name":686,"slug":687,"type":15},"Migration","migration","2026-07-13T06:45:20.372122",{"slug":690,"name":690,"fn":691,"description":692,"org":693,"tags":694,"stars":588,"repoUrl":589,"updatedAt":698},"mps-aspect-structure-concepts","define concepts in MPS structure aspect","Define concepts, interface concepts, enumerations, and constrained data types in an MPS language's `structure` aspect. Covers smart-reference detection, alias rules, cardinality, INamedConcept usage, bulk creation, and the full `mps_mcp_alter_structure` \u002F `mps_mcp_query_structure` reference. Use when authoring or modifying a language's structure model.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[695],{"name":696,"slug":697,"type":15},"Data Modeling","data-modeling","2026-07-23T05:41:30.705975",188]