# The Culture of Code > Thoughts on Software Development ## Blog - [Tachyon MCP: A Spec-Forward Java Runtime for the MCP Ecosystem](https://kpavlov.me/blog/tachyon-mcp-jvm-runtime): Tachyon is a standalone, Java MCP server runtime built on Netty — no framework required. Wire up tools, resources, and prompts in a few lines, and run against both MCP 2025-11-25 and the upcoming 2026-07-28 specification. First-class protocol extensions, virtual-thread handlers, and a stateless mode for serverless. - [Integration Testing on the JVM: My Ideal Process, End to End](https://kpavlov.me/blog/integration-testing-on-jvm): Unit tests ensure functions work in isolation, but production incidents thrive at the boundaries. This post details a pragmatic, parallel-ready architecture for integration-testing JVM web services. Learn how to isolate tests into a dedicated module, safely simulate flaky external dependencies (like LLMs and Kafka) using Testcontainers and Mokksy, execute concurrent suites without flaky race conditions, and keep your full local test run under 5 minutes—all while running a fully booted, debuggable application. - [Higher-Order Attacks on AI Code Agents](https://kpavlov.me/blog/agent-higher-order-attacks): Beyond direct prompt injection lies a more dangerous class of attacks: manipulating the agent into writing malicious code that executes later in CI or production. This article examines second-order code injection, toolchain abuse, multi-agent propagation, and practical defenses including security enforcement skills for AI agents. - [When Your AI Code Agent Becomes an RCE Engine](https://kpavlov.me/blog/agent-prompt-injection-basics): AI code agents that read repositories and execute commands introduce a new attack surface: anyone who can write to the repository can potentially execute code on the agent's machine. This article examines direct prompt injection vectors through GitHub comments, source code, README files, and test suites — and shows how to defend against them. - [Javable: generate Java-friendly wrappers for Kotlin with KSP](https://kpavlov.me/blog/javable): When building a Kotlin library, the JVM interop story is often painful: suspend functions expose a raw Continuation parameter in Java, Flow has no Java equivalent, and data classes with many parameters need hand-written builders. Javable is a KSP processor that eliminates this boilerplate — annotate your class once and get CompletableFuture wrappers, blocking adapters, and Stream-based Flow collectors generated automatically. - [kotlinx-schema: Three Ways to Generate JSON Schemas from Kotlin Code](https://kpavlov.me/blog/kotlinx-schema): Hand-written JSON schemas for LLM function calling drift silently every time you rename a parameter or change a type. Kotlinx-schema fixes that by generating schemas directly from Kotlin code — via kotlinx.serialization descriptors, JVM reflection, or KSP compile-time processing. This post walks through all three strategies with working code and verified schema output. - [Large files in Kotlin: causes, trade-offs, and practical remedies](https://kpavlov.me/blog/kotlin-large-files): Kotlin's permissive file organization model enables expressive, cohesive code — but it also explains why large files are commonplace even in mature Kotlin libraries. This article examines the cultural, tooling, and language-level factors behind that pattern, explores the impact on LLM-based coding agents, and offers practical guidance for teams seeking a sustainable balance. - [Mokksy: a mock server that actually streams — and why your AI app needs integration tests](https://kpavlov.me/blog/mokksy): Why unit tests alone won’t save your LLM application in production, and how Mokksy — a Kotlin mock server with true SSE and streaming support — … - [Open source deserves better than 'Move Fast'](https://kpavlov.me/blog/open-source-mindset): Open-source libraries run on millions of devices, sometimes powering critical infrastructure where failures carry severe consequences. The old excuse of not having time to test no longer works: AI tools can identify gaps, generate tests, and analyze entire repositories for design weaknesses. But the engineer must retain final responsibility for shipping correct, maintainable code. - [Introducing Kotlinx-schema: generate JSON Schema from Kotlin types and functions](https://kpavlov.me/blog/kotlinx-schema): Kotlinx-schema is an experimental JetBrains library that automates JSON Schema generation from Kotlin and Java code, eliminating schema drift by deriving schemas directly from source. By supporting both runtime reflection and compile-time generation via KSP, it ensures that API documentation and implementation stay synchronized across all Kotlin Multiplatform targets. This article explores how to generate polymorphic class schemas, extract metadata from KDoc, and handle function signatures for LLM tool calling, providing a type-safe approach to schema management. - [Weekend hack: Kotlin Symbol Processing Maven plugin](https://kpavlov.me/blog/ksp-maven-plugin): KSP only works with Gradle, leaving Maven users out in the cold. I built ksp-maven-plugin to fix that - minimal setup, auto-discovers processors, … - [The cookie story: when build failures became sweet accountability](https://kpavlov.me/blog/the-cookie-story): Twelve developers. One trunk. And a cookie jar. Zero tolerance for broken builds. Watch as pair programming sessions intensify, commits shrink to surgical precision, and a team discovers that the path to engineering perfection is paved with chocolate chips and mutual accountability. Sometimes the most profound transformations begin with the smallest consequences. Based on a true story. - [LLM evaluation testing with promptfoo: a practical guide](https://kpavlov.me/blog/llm-evaluation-testing-with-promptfoo-a-practical-guide): This article shows how to implement automated testing for LLM applications using promptfoo with a real application server, addressing the challenge … - [Contract-first vs. code-first development: why API contracts matter from day one](https://kpavlov.me/blog/contract-first-vs-contract-last): Contract-first development means designing API specifications before writing code. This approach creates a clear contract that guides implementation, generates code stubs automatically, and ensures consistency across services. Code-first development does the opposite - you write implementation first, then generate API docs from your code. While faster initially, this often leads to inconsistent APIs, accidental changes, and integration problems. Key benefits of contract-first: - Clearer API boundaries - Easier integration testing - Better team communication - Fewer maintenance headaches - Earlier detection of design flaws Even for small teams and alpha products, starting with contracts creates a solid foundation that prevents costly rework later. The slight upfront investment pays off through faster iteration, easier onboarding, and more reliable services as your system grows. - [From monoliths to AI proxies: real-world strategy for testing and evolving LLM integrations](https://kpavlov.me/blog/ai-proxy-pattern): Integrating Large Language Models (LLMs) into production systems presents unique architectural, testing, and operational challenges. This article … - [Kotlin extensions for LangChain4j](https://kpavlov.me/blog/kotlin-extensions-for-langchain4j): Discover Kotlin extensions for LangChain4j designed to transform the synchronous LangChain4j API into a modern, non-blocking experience with Kotlin Coroutines. Learn about key features including coroutine support for ChatLanguageModels, Kotlin Flow for streaming responses, external customizable prompt templates, and non-blocking document processing. Enhance your Kotlin programming skills and improve application efficiency by leveraging these powerful new tools. - [Keeping your software healthy: the critical role of dependency updates](https://kpavlov.me/blog/keeping-your-software-healthy-the-critical-role-of-dependency-updates): Discover best practices for effective dependency management in software development and learn strategies to keep your projects secure, efficient, and … - [Spring Boot starters](https://kpavlov.me/blog/spring-boot-starters): This post discusses Spring Boot Starters and their importance to developers, who want to make the setup and configuration of Spring Boot applications … - [Code review best practices](https://kpavlov.me/blog/code-review-best-practices): Code review is a crucial practice in software development. One can design and write great software, but we are humans after all. And all humans make … - [Running Testcontainers on dynamic ports](https://kpavlov.me/blog/running-testcontainers-on-dynamic-ports): The article explains how using fixed ports when running integration tests locally with Docker can result in port conflicts, which is particularly problematic in shared CI environments. The solution to this problem is to use testcontainers, which allows for Docker containers to listen on a random port. - [Kotlin Playground shortcode for Hugo](https://kpavlov.me/blog/kotlin-playground-shortcode-hugo): How to embed runnable Kotlin code in your Hugo-powered blog. - [Spring Boot configuration best practices](https://kpavlov.me/blog/spring-boot-configuration-practices): How to write concise and unambiguous application configurations - [What happens when you split systems into many microservices](https://kpavlov.me/blog/what-happens-when-you-split-systems-into-many-microservices): Pros and cons of splitting monolithic applications into microservices. - [Building data pipeline with Kotlin coroutines actors](https://kpavlov.me/blog/building-kotlin-data-pipelines): How to build simple data-enriching pipeline using Kotlin coroutines with Actors model. - [Applying courage in software development](https://kpavlov.me/blog/courage-in-software-development): Job is not a place for feats. But sometimes you have to be brave to make things happen. Even if it is considered "impossible" - [How does new Oracle JVM licensing encourage agility](https://kpavlov.me/blog/new-oracle-jvm-licensing-to-encourage-agility): How Oracle pushes companies to be more agile by shortening release cycle. - [Common Java application anti-patterns and their solutions](https://kpavlov.me/blog/typical-mistake-in-webservice-design): The article examines software architecture problems through biological cell analogies, describing how mixing different code layers creates maintenance issues. It compares simpler layered design to complex hexagonal architecture, using cell membranes and proteins as metaphors to explain proper component organization. A practical guide follows for improving existing systems without full rewrites, focusing on testing, API design, and gradual changes. - [Customizing REST API Error Response in Spring Boot / Spring-Security-OAuth2](https://kpavlov.me/blog/customizing-rest-api-error-response-in-spring-boot-/-spring-security-oauth2): Tuning REST API error format for Spring Boot v2 / Spring-Security-OAuth2 - [The Programmers Oath](https://kpavlov.me/blog/the-programmers-oath): The Professional Code of programmers, the Corer's Code. Robert «Uncle Bob» Martin talks about our responsibilities in our digital world and emphasize 9 principles every programmer should follow - [Logging policy](https://kpavlov.me/blog/logging-policy): One point of view on how logging levels should be used in code. - [Maximizing efficiency with UI-first development: a client-centric approach to project success](https://kpavlov.me/blog/ui-first-development): Discover how UI-first development reduces unnecessary work in conditions of business uncertainty by prioritizing UI prototyping, creating static data, defining API contracts, and gradually implementing backend components, ensuring client satisfaction throughout the project. - [How to Start Testing UI Before Backend is Ready](https://kpavlov.me/blog/how-to-start-testing-ui-before-backend-is-ready): How to develop and test UI before backend is completed - [Developing in "dirty trunk"](https://kpavlov.me/blog/developing-in-dirty-trunk): The “dirty trunk” branching strategy involves committing directly to the main branch, with CI builds triggered on each commit. While … - [Secure Java coding best practices](https://kpavlov.me/blog/secure-java-coding-best-practices): Making your web application flawless against security attacks is a challenge for every java developer. In this article I will briefly describe common … - [Secure Java logging with Logback](https://kpavlov.me/blog/secure-java-logging-with-logback): Deploying application into secure environment adds some restrictions on logging and log management. OWASP community gives some useful recommendations. … - [Implementing Automatic Reconnection for Netty Client](https://kpavlov.me/blog/implementing-automatic-reconnection-for-netty-client): One of the first requirement of Netty ISO8588 client connector is the support for automatic reconnect. One of the first receipts I came across was …