The AI intelligence suite
for Spring Boot teams
18 specialized agents review your code. Semantic CodeSearch answers any question about your codebase. SpringTeam's 6 expert agents execute tasks autonomously. Three pillars — one command away.
Everything your team needs
to own your Spring Boot codebase
SpringInsight is built around three complementary capabilities that together give you unprecedented visibility, understanding, and control over your codebase.
- 🛡️ OWASP Top 10, CVEs, SpEL injection, mass assignment
- ⚡ N+1 detection, caching gaps, thread pool misconfiguration
- 🔄 @Transactional correctness, race conditions, ThreadLocal leaks
- 🚀 Spring Boot 3.x → 4.0 migration blockers with fix snippets
- 🗺️ A18 Reverse Engineering — full architecture from bytecode
- 🧠 Semantic vector search over every class, method, endpoint
- 🕸️ Code graph expansion — finds upstream and downstream context
- 📍 Source citations with exact file and line numbers
- 💬 Claude Sonnet synthesis — not just keyword matches
- ⚡ Runs locally via ChromaDB · no cloud required
- 🗺️ Planner decomposes complex tasks into ordered sub-tasks
- 👨💻 Coder implements Spring Boot features with correct idioms
- 🧪 Tester writes JUnit 5 + Mockito tests automatically
- 👁️ Reviewer audits code before you approve merge
- 🗄️ DB Optimizer + Documenter round out the team
One install.
18 agents. Three pillars. Complete picture.
SpringInsight runs on your machine. Point it at any Spring Boot project — local path or GitHub URL — and the full intelligence suite spins up automatically.
Point at any Spring Boot repo
Pass a GitHub URL or local path. SpringInsight reads your pom.xml / build.gradle, application.yml, and all Java sources. No build required.
Agents run in parallel
Phase 1 Haiku agents run first (fast, cheap pattern matching). Phase 2 Sonnet agents run deep analysis. Each agent is driven by a curated SKILL.md — a behavioral contract honed for Spring Boot idioms.
Findings saved to SQLite
Every finding has a severity, file, line number, impact description, and a concrete fix with code. Scores are calculated per dimension (Security, Performance, Quality, etc.).
Read findings your way
CLI report, filterable web dashboard, or JSON output. Pipe into CI/CD to fail builds on CRITICAL findings. Run springinsight web for the live SSE progress UI.
$ springinsight run https://github.com/acme/orders-service
Cloning repository...
Detected: Spring Boot 3.5.1 · Java 21 · Maven · 17 agents ready
Phase 1 — Haiku (fast scan)
✅ A03 CVE & License Scanner 3.2s
✅ A10 Dead Code Detector 4.1s
✅ A12 Config & Infra Review 2.8s
Phase 2 — Sonnet (deep analysis)
✅ A01 Deep Code Review 18s
✅ A02 Security Scanner 21s
✅ A04 Database & JPA Review 14s
✅ A09 PR Review 9s
✅ A11 Performance Analyzer 16s
✅ A13 API Design Auditor 12s
✅ A14 Concurrency Audit 15s
✅ A15 Dependency Graph 11s
✅ A16 Upgrade Advisor 13s [3.5→4.0 migration: 4 blockers found]
✅ A17 NFR Optimizer 17s [open-in-view=true flagged HIGH]
CRITICAL 2 HIGH 14 MEDIUM 38 LOW 22
Report: .springinsight/reports/2026-04-11_orders-service.md
Run `springinsight web` to explore findings in the browser.Purpose-built for
Spring Boot idioms
Every agent is powered by a SKILL.md — a curated behavioral contract that encodes Spring Boot-specific patterns, anti-patterns, and fix templates.
Pattern-matching agents that scan your entire repo in seconds. Run first — cheap to run on every commit.
Deep reasoning agents that understand Spring semantics — bean proxying, transaction boundaries, JPA fetch strategies — not just syntax.
WebSecurityConfigurerAdapter removal, jakarta.* migration, property renames, and Spring Boot 4.0 breaking changes.spring.jpa.open-in-view=true as HIGH severity.Opus-powered agents for architecture-level reasoning and code generation — including the new A18 Reverse Engineering agent that reconstructs full architecture from compiled bytecode.
.class bytecode — no source code required. Produces component diagrams, dependency graphs, Spring bean maps, and a plain-English architecture report. Run directly: springinsight reverse ./my-appAsk your codebase
anything. In plain English.
CodeSearch indexes every Java class, method, and endpoint into a local vector database. Ask any question — get a precise answer backed by exact source citations.
OncePerRequestFilter) which intercepts all requests. It extracts the token from the Authorization: Bearer header, delegates to JwtTokenProvider.validateToken() for signature and expiry checks, then calls UserDetailsServiceImpl.loadUserByUsername() to build the SecurityContext.
order.getItems() inside the loop (lazy collection). ProductService.enrichWithInventory() makes one DB call per product. Consider @EntityGraph or JOIN FETCH queries to resolve these.
# Index your project once (then reindex on changes)
springinsight search index ./my-spring-app
🔍 Scanning Java files... 847 chunks
🕸️ Building code graph... 1,204 edges
🔮 Embedding (ChromaDB)... ████████████ done
✅ Index complete · 23s
# Ask anything about your codebase
springinsight search ask "explain my auth flow"
springinsight search ask "where is rate limiting configured?"
springinsight search ask "list all @Scheduled jobs"
# Or use the Web UI chat interface
springinsight web --open # → CodeSearch in sidebarFour dimensions.
One unified score.
SpringInsight doesn't just dump lint warnings. It reasons about your codebase across four interconnected intelligence dimensions.
- SQL / JPQL / SpEL / HQL injection detection
- Mass assignment via @ModelAttribute without @InitBinder
- Insecure deserialization — Jackson enableDefaultTyping
- Hardcoded credentials, weak crypto (MD5, ECB mode)
- Race conditions on shared mutable state in @Service beans
- @Transactional self-invocation bypassing the Spring proxy
- Lost updates — missing @Version on concurrently-written entities
- ThreadLocal leaks across request boundaries
- N+1 by cross-referencing service loops with lazy collections
- Missing @Cacheable on expensive read-only operations
- @Async with SimpleAsyncTaskExecutor — new thread per call
- findAll() without pagination on large tables
- Circular dependency detection with Spring-specific BeanCreation risk
- Hot-spot ranking: in-degree > 10 = change-blast risk
- God class detection: out-degree > 15 = refactor candidate
- Instability metric: 0 (stable core) → 1 (volatile leaf)
Six specialist agents.
One coherent team.
Describe what you need — SpringTeam's Planner decomposes it into tasks, routes each to the right expert, and auto-chains Tester + Reviewer after every implementation. You review, approve, and ship.
Live Kanban board with SSE real-time updates · approve/reject before merge
# Submit any task — Planner decomposes automatically
springinsight team task \
"add JWT refresh token with 7-day expiry and revocation"
# → Planner creates 5 sub-tasks automatically:
# [planner] Decompose refresh token feature
# [db_optim] Add token_revocations table
# [coder] Implement RefreshTokenService
# [tester] Write JUnit tests (auto-triggered)
# [reviewer] Review all changes (auto-triggered)
# [documenter] Update API docs
# Monitor live progress
springinsight team status
springinsight web --open # → SpringTeam Kanban board
# Approve reviewed tasks before merge
springinsight team approve <task-id>Built for every
team workflow
Designed for Spring.
Not generic Java linters.
General-purpose static analysis tools don't understand Spring's proxy model, transaction boundaries, or JPA fetch strategies. SpringInsight does.
| Feature | 🍃 SpringInsight | SonarQube | SpotBugs | Checkmarx | Manual Review |
|---|---|---|---|---|---|
| Spring-aware analysis | ✓ Built-in | ~ Plugins | ✗ | ~ Partial | ~ Depends |
| N+1 query detection | ✓ Cross-ref | ✗ | ✗ | ✗ | ~ Manual |
| @Transactional correctness | ✓ Deep | ✗ | ✗ | ✗ | ~ Manual |
| OWASP Top 10 for Spring | ✓ A02 | ~ Basic | ✗ | ✓ | ~ Manual |
| Dependency graph + Mermaid | ✓ A15 | ~ Basic | ✗ | ✗ | ✗ |
| Actionable fix code snippets | ✓ Every finding | ✗ | ✗ | ✗ | ~ Sometimes |
| Works without build | ✓ Source only | ✗ | ✗ Bytecode | ✗ | ✓ |
| pip install — no infra | ✓ | ✗ Server | ~ Plugin | ✗ SaaS | ✓ |
| Open source / MIT | ✓ | ~ Comm. Ed. | ✓ LGPL | ✗ Commercial | ✓ |
| Cost to get started | Free | Server + setup | Free | $$$ | Engineer time |
Use it how
you work.
CLI
Full analysis from your terminal. Project context, PDF exports, GitHub PR scanning — every UI feature has a CLI equivalent.
springinsight run ./my-app
springinsight run ./app --agents A03,A10,A12
springinsight report --pdf ./report.pdf
springinsight context add-rule "Use constructor injection"
springinsight context set java-version 21
springinsight github connect --token ghp_xxxx
springinsight github watch myorg/service
springinsight github scan-pr https://github.com/org/repo/pull/42Web UI
Dark dashboard with live SSE progress, clickable agent cards, agent enable/disable, project context editor, PDF export, and GitHub PR integration.
springinsight web --open
springinsight web --verbose # agent logs in terminal
# Settings → Agents — enable/disable per agent
# Settings → Context — custom rules for agents
# Settings → GitHub PR — watch repos + auto-comment
# Scan result → Export PDF
# Shared DB between CLI + Web UIMCP Server Live
Use SpringInsight tools directly from Claude Code, Cursor, or Cline via the Model Context Protocol.
pip install "springinsight[mcp]"
# Add to MCP config:
{
"mcpServers": {
"springinsight": {
"command": "springinsight",
"args": ["mcp"]
}
}
}VS Code Extension Beta
Scan from the command palette. Findings appear as diagnostics in the Problems panel with inline gutter icons.
# Install from marketplace:
SpringInsight (search in VS Code)
# Or build from source:
cd vscode-extension
npm install && npm run compile
# Commands:
⌘⇧P → SpringInsight: Scan Project
⌘⇧P → SpringInsight: Quick Scan
SpringInsight has a built-in cost engine. Preview spend before committing, set a hard budget cap, and let it
auto-select the most valuable agents within your limit. Agent-specific file scoping cuts token usage by 30–70% —
the CVE scanner only reads pom.xml, the JPA reviewer only reads @Entity classes.
Incremental scanning skips unchanged files on repeat runs, cutting cost by 80–90% on CI workflows.
--budget $1.00 and agents are auto-selected to fit.# Preview cost before running
springinsight run /path/to/project --estimate
# Cap spend at $2 — cheapest agents selected first
springinsight run /path/to/project --budget 2.00
# Security-priority within budget
springinsight run /path/to/project --budget 1.00 --budget-strategy security
Define custom rules that every agent must enforce: "never use field injection", "all endpoints need @PreAuthorize",
"use constructor injection only". Set tech-stack hints (Java version, Spring Boot, DB) so agents understand your project.
Rules are injected into every agent prompt as MUST APPLY constraints.
Use Settings → Project Context in the Web UI or:
springinsight context add-rule "Your rule here"
Connect SpringInsight to your GitHub repos and every new pull request gets scanned automatically. Changed Java files are analysed, a formatted findings summary is posted as a PR comment, and critical findings can be configured to fail the GitHub check. Works with private repos. Polls on a configurable interval (default 5 min).
springinsight github connect --token ghp_xxxx
springinsight github watch myorg/my-spring-service
springinsight github scan-pr https://github.com/org/repo/pull/42Free. Open. Yours.
SpringInsight is MIT licensed. Your code never leaves your machine unless you choose to scan a GitHub URL.
- All 18 agents across 4 phases (including A18 Reverse Engineering)
- CodeSearch — RAG semantic search over your entire codebase
- SpringTeam — 6 specialist agents for delegated task execution
- CLI + Web UI + MCP Server + VS Code extension
- Agent enable/disable, budget cap, pre-scan cost estimate
- Smart file scoping + incremental scanning (80–90% token savings on re-scans)
- Project Context — custom rules injected into every agent
- PDF export of full scan reports
- GitHub PR auto-scanning + PR comments
- SQLite persistent history — shared across all tools
- MIT license — use in commercial projects
$ pip install "springinsight[all]"
# Includes web, mcp, pdf, github extras
# Requires: ANTHROPIC_API_KEY- GitHub App integration
- PR comments with findings
- Team dashboards
- Shared finding history
- No setup required
- On-prem / air-gapped deployment
- Custom agent development
- Bring your own model (Bedrock / Vertex)
- JIRA / Confluence integration
- Dedicated support
Quick Start (3 commands)
# 1. Install
pip install springinsight
# 2. Set your API key
export ANTHROPIC_API_KEY=sk-ant-...
# or echo "ANTHROPIC_API_KEY=..." > .env
# 3. Scan a GitHub repo
springinsight run \
https://github.com/spring-petclinic/spring-petclinic
# Or scan a local project
springinsight init /path/to/your/spring-app
springinsight run /path/to/your/spring-app# With Web UI (recommended)
pip install "springinsight[web]"
springinsight web --open
# Opens http://localhost:8080
# Paste any GitHub URL → scan
# Live SSE progress stream
# Filterable findings table
# Persistent scan history
# Run specific agents only
springinsight run ./app \
--agents A02,A04,A14
# Export findings as JSON
springinsight findings --format json