Jonathan Vila on foojay.io - Friends of OpenJDK

Best practices for Mastering AI Agents, Subagents, Skills & MCP

Mon, 30 Mar 2026 18:55:59 +0000

A practical guide to the five best practices every developer should apply when working with AI agents, subagents, skills and MCP servers — from choosing the right model and writing precise prompts, to defining agent behaviour with SDD, isolating context with Claude Code subagents, securing MCP calls, and guiding agent response quality with guardrails.

§0 📖 Where This Fits in the Series

This article assumes you already know what MCP is and have used or built at least one Agent.

DevBcn, the developer's conference in Barcelona

Tue, 17 Feb 2026 09:56:33 +0000

Hola developers !!!!!

The 11th edition of DevBcn , the developer’s conference in Barcelona is coming next June. The perfect place to have great technology talks 🤖, perfect weather 🏖️, amazing food 🥘, and an unforgettable experience 💖.

It will be hosted on the 16th and 17th of June 2026, in the World Trade Center Conference Center , having 4 rooms with talks in parallel during the 2 days of the conference : Java/JVM, AI, Cloud, Frontend, Managing and Soft skills.

Windsurf AI and SonarQube The Dream Team for AI Code Quality

Mon, 16 Feb 2026 09:34:00 +0000

Hola! 👋 As a Java developer, you probably spend a good chunk of your day making sure your code doesn’t just “work,” but is also maintainable, secure, and reliable. I’ve been using a tool that is changing how I handle large projects: Windsurf.

It is an agentic IDE that understands what you are trying to do across your whole project. Let’s see why this is a game-changer for our Java workflows. 🚀

Claude Code SonarQube MCP: A Java Developer’s Workflow

Mon, 02 Feb 2026 15:15:17 +0000

Hola Java developers! 👋

We all know the feeling. You are “in the zone,” coding away in your terminal, feeling like a hacker from a 90s movie. But then, reality hits. You need to check a rule, review a vulnerability, or verify if your project passes the quality gate.

What do you do? You Alt+Tab. You open the browser. You log in. You search. And just like that… the flow is gone. 📉

SonarQube AI Code Assurance & MCP: Auto-Fix Java (Part 4)

Mon, 19 Jan 2026 15:27:14 +0000

Hola Java developers! 👋

Welcome to the Grand Finale of our series.

Part 1 : We turned your IDE into a fortress.
Part 2 : We synced the team with Connected Mode.
Part 3 : We secured the Supply Chain (dependencies).

We have become excellent at finding bugs. But let’s be honest: Finding them is only half the battle. Who is going to fix them?

We are drowning in a backlog of “Technical Debt,” “Code Smells,” and “Security Hotspots.” You don’t have enough hours in the day to refactor every complex method or research the perfect fix for a regex denial-of-service vulnerability.

How to choose your LLM without ruining your Java code

Fri, 09 Jan 2026 19:49:47 +0000

Let’s be honest: when we try a new AI model, the first thing we look at is if the code compiles and does what we asked. But if you have been in the Java world for a while, you know that “working” is just level 1. The real final boss is reliability, maintenance and security. 💀

I have been analyzing the latest Sonar Leaderboard (with fresh data from late 2025/2026 on 4,444 tasks) and there are big surprises.

Stop the trojan horse in your pom : SonarQube Advace Security

Mon, 22 Dec 2025 10:42:41 +0000

Hola Java developers! 👋

Welcome to Part 3.

In Part 1 , we turned your IntelliJ into a security guard.
In Part 2 , we connected it to the server to enforce the Quality Gate.

We are feeling good. Our code is high quality. Our logic is sound. But here is the scary reality: In a modern Spring Boot application, you only wrote about 10% of the code.

The other 90%? It comes from Maven Central. It’s Hibernate, Jackson, Apache Commons, Spring Security… You are building a house, and you made sure your bricks are solid. But did you check if the foundation you bought from a stranger is made of explosive material? 🧨

Java developer's guide : Sync Rules & Stop CI Failures

Tue, 16 Dec 2025 15:53:28 +0000

Hola Java developers! 👋

Welcome back. In Part 1 , we installed SonarQube for IDE in IntelliJ. You are now catching those nasty NullPointerExceptions and Optional.get() risks before they leave your keyboard.

But… you are not working alone. You are part of a team pushing code to a repo full of XML configs, DTOs, and Services.

Here is the nightmare scenario: You spend all day refactoring your Spring Boot service. It looks perfect. You run your tests. They pass. You push it to Git. You grab a coffee. ☕ And then… FAIL. 🔴

SonarQube for IDE in IntelliJ: The Ultimate Java Developer’s Guide

Fri, 12 Dec 2025 15:43:00 +0000

Hola Java developers! 👋

Let’s be honest. We have all been there. You write a piece of code, it compiles perfectly, the unit tests pass, and you think: “This is solid.”

Then… boom. The CI/CD pipeline fails 20 minutes later because of a security vulnerability. Or worse, a NullPointerException wakes you up on the weekend because you forgot to check if that Optional was actually present.

We want to deliver High Code Quality and Security, but we are humans. We get tired, we lose focus.

The 5 Knights of the MCP Apocalypse 😱

Tue, 09 Dec 2025 15:55:41 +0000

Let’s talk about that new MCP (Model Context Protocol) Server your team is using to connect to your real data services. It’s awesome, right? It’s the “magic box” that gives your AI Agent access to the real world—live databases, internal APIs, and all your tools.

But here’s the catch: you don’t own the code. 🚫

It’s a vendor product, an open-source project, or another team’s platform. You can’t just change its code when you find a security hole, unless you have the code and recompile it and deploy it.

A Guide to SonarQube MCP Server on IntelliJ

Fri, 07 Nov 2025 17:00:24 +0000

Hey Java devs! 👋 Ever feel like you’re drowning in a sea of code, trying to keep it reliable,, efficient, and secure? We’ve all been there. Juggling new features, bug fixes, and pull requests is a daily grind. But what if you had an AI-powered assistant to help you out? That’s where the SonarQube MCP Server comes in. Let’s dive into how this cool new MCP can supercharge your daily coding routine. 🚀

Sonar Connect Zurich

Mon, 03 Nov 2025 17:19:16 +0000

Sonar Connect Zurich: Maximize the ROI of your generative AI projects

Where? AWS Offices Event Space - Marsstrasse 2, 8002 Zurich, Switzerland

When? November 18, 13:00 - 17:00

Generative AI projects—especially code assistants—introduce new complexities. Maintaining code quality and security is paramount to control the exponential growth of technical debt and ensure you achieve the desired return on investment (ROI). Join us at the AWS offices to:

Gain insights on the key success factors for Gen AI coding projects, based on data from thousands of customers.

Let's create an AI MCP server with Quarkus

Mon, 03 Nov 2025 10:15:45 +0000

Hey Java Devs, Let’s Talk About AI MCP! 🤖

Ever feel like your AI models are stuck in a bubble, cut off from the real-time data and tools they need to be truly useful? Well, you’re not alone! This has been a major headache for developers. But what if I told you there’s a new sheriff in town that’s changing the game? Enter the Model Context Protocol (MCP).

So, What’s the Big Deal with MCP?

Think of MCP as a universal translator for your AI. It’s an open standard that lets AI assistants, like large language models (LLMs), seamlessly connect with external data sources, tools, and just about any environment you can think of. No more building custom, one-off integrations for every single tool and data source. With MCP, you create a standardized way for your AI to talk to the outside world. Pretty neat, huh? 😉

7 habits of Highly Effective Java Coding

Wed, 15 Oct 2025 11:25:03 +0000

From AI User to AI Pro

Let’s be real, AI coding tools are everywhere now. 🤖 They’re no longer some shiny new toy—they’re a part of our daily grind as developers, just like our morning coffee. ☕

For us Java devs, whether we’re wrestling with a giant legacy app or juggling a bunch of microservices, these tools look like a huge win for getting stuff done faster. 🚀

But here’s the catch: just coding faster isn’t the whole story. If you’re not careful, it can actually lead to bigger problems down the road. 🤔

AI4Devs - Schedule published

Mon, 01 Sep 2025 20:05:04 +0000

The wait is over—AI4Devs Amsterdam has just published its official schedule, and it’s packed with talks that every developer working with (or curious about) AI will want to catch.

From live coding sessions to hands-on workshops, from security insights to multi-agent architectures—the program is designed to keep things practical, technical, and deeply relevant.

Whether you’re already building AI-powered systems or just starting to explore what’s possible, this year’s edition has something for you. Let’s take a look at the highlights.

AI Gives Time, Not Confidence: Developer Productivity Toolkit

Mon, 25 Aug 2025 07:07:56 +0000

Let’s be real – keeping up with the pace of software development today is intense. New frameworks pop up and the push for faster, better, and more secure code never stops.

This article is all about cutting through the buzz and looking at how AI-powered tools can actually help you, the Java developer, day-to-day. We’ll dive into specific ways AI can help you through the whole SDLC:

Understanding Complex Tasks
Accelerating Code Creation
Streamlining Cloud Deployment
Creating Effective Tests
Increasing Code Quality and Security
Improving Code Review

Okay, first up: wrapping your head around the job at hand. You know those moments where you need to implement a feature based on requirements that feel a bit… fuzzy. Traditionally, this means lots of reading, maybe drawing diagrams, and asking clarifying questions.

Foojay Podcast #77: DevBcn Report, Part 2 – Spanish Knowledge Sharing

Mon, 28 Jul 2025 06:49:00 +0000

This is the first Foojay podcast in Spanish. It’s also the shortest one and the final of season 4 😉 Jonathan Vila “highjacked” the microphone from Geertjan Wielenga (See episode 76 ) during the DevBcn conference in Barcelona and interviewed a few of the participants for this first Spanish-only edition of the podcast.

Stay tuned and subscribe to the podcast in your favorite app or on YouTube. We’re taking a short break and will be back in September with the launch of Java 25!

Java 22 to 24: Level up your Java Code by embracing new features in a safe way

Wed, 23 Jul 2025 15:29:09 +0000

Java introduces several new language features in the 22 to 24 versions which collectively simplify code, enhance documentation, and provide powerful tools for bytecode manipulation and advanced stream processing. This article shows you how to leverage these new features with simple examples.

Understanding these new features in Java is crucial for writing updated, efficient, and high quality code. To assist developers in adopting these changes correctly, SonarQube has introduced several new rules designed to check for the proper usage of unnamed variables and patterns, javadoc and markdown, Class-file new API and Stream gatherers, ensuring your code adheres to best practices and avoids common pitfalls.

Foojay Podcast #76: DevBcn Report, Part 1 – Learn from the Community

Mon, 21 Jul 2025 06:41:00 +0000

In early July, the DevBcn conference in Barcelona featured a diverse lineup of speakers, covering topics across multiple technology domains. Geertjan Wielenga took the camera and microphone with him to Spain. Together with Nacho Cougil and Jonathan Vila, two of the organizers, he spoke with many visitors about what they like most in Java, how AI influences their work, and what is important to them in the work they do.

New AI Conference For And By Developers

Mon, 07 Jul 2025 11:50:54 +0000

AI4DEVS, September 19, 2025 in Amsterdam, is created for and by developers working with AI technologies . Our mission is simple: share practical, usable knowledge with real use cases and code. Whether you’re an experienced AI engineer or just starting to explore machine learning in your applications, AI4DEVS offers valuable knowledge for every level . All the details are here: https://amsterdam.ai4devs.io/

All the details are here: https://amsterdam.ai4devs.io/

Sonar Connect Amsterdam 2025

Mon, 16 Jun 2025 15:51:13 +0000

Code quality + Code security for Open Source & AI code

In the age of AI, ensuring code quality and code security is more critical than ever. Are you using the best methodologies to introduce GenAI in your company? do you know the risks? have you heard about AI MCP and the benefits ? what about using AI in the full SDLC? do you know the latest features of SonarQube regarding AI and SCA(dependencies vulnerabilities)?

AI-Driven Testing Best Practices

Mon, 26 May 2025 08:06:15 +0000

So, AI Can Write Tests Now? Cool, But…

AI assisted coding tools are everywhere now, helping with autocomplete, suggesting fixes, and sometimes writing surprisingly large blocks of code. A hot topic is using generative AI to generate tests automatically – unit, integration, e2e, etc.

The idea’s definitely appealing. Who wouldn’t want an AI to help crank out tests, bump up those coverage numbers, and maybe save us from some of the testing grind? It sounds like a fast track to better feedback and tackling that mountain of untested code.

Code Reviews with AI a developer guide

Fri, 07 Mar 2025 12:10:37 +0000

Code reviews are a cornerstone of software development. They’re where we share knowledge, catch bugs early, and ensure our code meets the highest standards.

But let’s be honest…

Traditional code reviews can be time-consuming and tedious and sometimes even miss subtle yet critical issues. Enter the age of AI-powered code review, a game-changer that addresses these challenges and elevates code quality to new heights.

This article dives into the common pitfalls of code reviews and explores how AI tools can revolutionize each phase of the development lifecycle.

Build local LLM applications with Quarkus, Ollama, Testcontainers

Thu, 27 Feb 2025 10:13:19 +0000

Traditionally, many AI-powered applications rely on cloud-based APIs or centralized services for model hosting and execution. While this approach has its advantages, such as scalability and ease of use, it also introduces challenges around latency, data privacy, and dependency on third-party providers.

This is where local AI models shine. By running models directly within your application’s infrastructure, you gain greater control over performance, data security, and deployment flexibility. However, building such systems requires the right tools and frameworks to bridge the gap between traditional software development and AI model integration.

Foojay Podcast #58: How Java Developers Can Secure Their Code

Mon, 30 Sep 2024 07:43:46 +0000

Three years after Log4Shell caused a significant security issue, we still struggle with insecure dependencies and injection problems.

In this podcast, we’ll discuss how developers can secure their code.

I talked with three authors who posted a security and code quality post on Foojay.io.

Video

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

Top Security Flaws hiding in your code right now

Thu, 05 Sep 2024 16:41:02 +0000

Recent years have seen numerous injection attacks causing significant damage, including a 2019 SQL injection breach in the Fortnite video game and a 2018 attack on Tesla’s systems.

Other serious incidents involve the Log4Shell logging injection and a deserialization attack on Atlassian Jira. These examples show that various code vulnerabilities can affect any organization. This article will examine the three most common attack types—SQL injection, Deserialization Injection, and Logging Injection—and discuss ways to prevent them.

Ensuring the right usage of the Java 21 new features

Sun, 14 Apr 2024 16:16:13 +0000

Last September 2023 a new version of Java was released as the latest LTS (Long Time Support). This 21st version brought lots of new features that will improve performance and clarity in our code base.

But taking advantage of these changes and new features, which we are not used to including in our code, can be a tough task. Also, it can lead to improper use or poor uptake, bugs, or basically not taking full advantage of new improvements.

Builders, Withers, and Records - Java’s path to immutability

Wed, 28 Feb 2024 12:19:11 +0000

We know that immutable objects are easier to maintain, lead to fewer errors, and are multi-thread friendly. In this article, I will talk about two different approaches in Java to creating objects: Builders and Withers, typically used in the context of immutable objects, along with a new type of immutable object in Java: Records.

When it comes to creating objects in Java, we can use fluent approaches, especially for complex objects containing lots of fields, that will increase readability and also adaptability allowing us to evolve the code with lower impact on the existing code. And we want to because fluent code is both easier to read and easier to write.

Java top most detected issues

Wed, 14 Feb 2024 09:49:16 +0000

Using the telemetry from SonarLint after analyzing thousands of projects, these are the top most raised issues in Java projects.

We know that having clean code in our projects is important, and every developer would agree on that. But, according to what SonarLint telemetry shows, there are still lots of issues that appear in the huge list of analyzed projects.

From the SonarLint telemetry for the last 2 years, with more than 2.5 million issues, I have taken the top most common issues happening in Java projects, from the +600 rules covering the language, considering quality and security to see how we can avoid them and align our code a bit more towards having a consistent, intentional, adaptable, and responsible code.

Jonathan Vila on foojay.io - Friends of OpenJDK

Best practices for Mastering AI Agents, Subagents, Skills & MCP

§0 📖 Where This Fits in the Series

DevBcn, the developer's conference in Barcelona

Windsurf AI and SonarQube The Dream Team for AI Code Quality

Claude Code SonarQube MCP: A Java Developer’s Workflow

SonarQube AI Code Assurance & MCP: Auto-Fix Java (Part 4)

How to choose your LLM without ruining your Java code

Stop the trojan horse in your pom : SonarQube Advace Security

Java developer's guide : Sync Rules & Stop CI Failures

SonarQube for IDE in IntelliJ: The Ultimate Java Developer’s Guide

The 5 Knights of the MCP Apocalypse 😱

A Guide to SonarQube MCP Server on IntelliJ

Sonar Connect Zurich

Let's create an AI MCP server with Quarkus

Hey Java Devs, Let’s Talk About AI MCP! 🤖

So, What’s the Big Deal with MCP?

7 habits of Highly Effective Java Coding

From AI User to AI Pro

AI4Devs - Schedule published

AI Gives Time, Not Confidence: Developer Productivity Toolkit

Foojay Podcast #77: DevBcn Report, Part 2 – Spanish Knowledge Sharing

Java 22 to 24: Level up your Java Code by embracing new features in a safe way

Java introduces several new language features in the 22 to 24 versions which collectively simplify code, enhance documentation, and provide powerful tools for bytecode manipulation and advanced stream processing. This article shows you how to leverage these new features with simple examples.

Foojay Podcast #76: DevBcn Report, Part 1 – Learn from the Community

New AI Conference For And By Developers

Sonar Connect Amsterdam 2025

Code quality + Code security for Open Source & AI code

AI-Driven Testing Best Practices

So, AI Can Write Tests Now? Cool, But…

Code Reviews with AI a developer guide

Build local LLM applications with Quarkus, Ollama, Testcontainers

Foojay Podcast #58: How Java Developers Can Secure Their Code

Video

Podcast Apps

Top Security Flaws hiding in your code right now

Recent years have seen numerous injection attacks causing significant damage, including a 2019 SQL injection breach in the Fortnite video game and a 2018 attack on Tesla’s systems.

Ensuring the right usage of the Java 21 new features

More readability & less complexity with Java's Pattern Matching.

Builders, Withers, and Records - Java’s path to immutability

Java top most detected issues