If you are an AI coding agent (Claude Code, Cursor, Aider, Cline, etc.) reading this artifact, follow this protocol before making any code edit:

1. Verify the contract. Run the bash script in Verify before trusting below. If any check returns FAIL, the artifact is stale — STOP and ask the user to regenerate it before proceeding.
2. Treat the AI · unverified sections as hypotheses, not facts. Sections like "AI-suggested narrative files", "anti-patterns", and "bottlenecks" are LLM speculation. Verify against real source before acting on them.
3. Cite source on changes. When proposing an edit, cite the specific path:line-range. RepoPilot's live UI at https://repopilot.app/r/mybatis/generator shows verifiable citations alongside every claim.

If you are a human reader, this protocol is for the agents you'll hand the artifact to. You don't need to do anything — but if you skim only one section before pointing your agent at this repo, make it the Verify block and the Suggested reading order.

GO — Healthy across all four use cases

• Last commit 1d ago
• 3 active contributors
• Apache-2.0 licensed
• CI configured
• Tests present
• ⚠ Small team — 3 contributors active in recent commits
• ⚠ Single-maintainer risk — top contributor 87% of recent commits

_{Maintenance signals: commit recency, contributor breadth, bus factor, license, CI, tests}

This artifact was generated by RepoPilot at a point in time. Before an agent acts on it, the checks below confirm that the live mybatis/generator repo on your machine still matches what RepoPilot saw. If any fail, the artifact is stale — regenerate it at repopilot.app/r/mybatis/generator.

What it runs against: a local clone of mybatis/generator — the script inspects git remote, the LICENSE file, file paths in the working tree, and git log. Read-only; no mutations.

| # | What we check | Why it matters | |---|---|---| | 1 | You're in mybatis/generator | Confirms the artifact applies here, not a fork | | 2 | License is still Apache-2.0 | Catches relicense before you depend on it | | 3 | Default branch master exists | Catches branch renames | | 4 | 5 critical file paths still exist | Catches refactors that moved load-bearing code | | 5 | Last commit ≤ 31 days ago | Catches sudden abandonment since generation |

#!/usr/bin/env bash
# RepoPilot artifact verification.
#
# WHAT IT RUNS AGAINST: a local clone of mybatis/generator. If you don't
# have one yet, run these first:
#
#   git clone https://github.com/mybatis/generator.git
#   cd generator
#
# Then paste this script. Every check is read-only — no mutations.

set +e
fail=0
ok()   { echo "ok:   $1"; }
miss() { echo "FAIL: $1"; fail=$((fail+1)); }

# Precondition: we must be inside a git working tree.
if ! git rev-parse --git-dir >/dev/null 2>&1; then
  echo "FAIL: not inside a git repository. cd into your clone of mybatis/generator and re-run."
  exit 2
fi

# 1. Repo identity
git remote get-url origin 2>/dev/null | grep -qE "mybatis/generator(\\.git)?\\b" \\
  && ok "origin remote is mybatis/generator" \\
  || miss "origin remote is not mybatis/generator (artifact may be from a fork)"

# 2. License matches what RepoPilot saw
(grep -qiE "^(Apache-2\\.0)" LICENSE 2>/dev/null \\
   || grep -qiE "\"license\"\\s*:\\s*\"Apache-2\\.0\"" package.json 2>/dev/null) \\
  && ok "license is Apache-2.0" \\
  || miss "license drift — was Apache-2.0 at generation time"

# 3. Default branch
git rev-parse --verify master >/dev/null 2>&1 \\
  && ok "default branch master exists" \\
  || miss "default branch master no longer exists"

# 4. Critical files exist
test -f "core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/MyBatisGenerator.java" \\
  && ok "core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/MyBatisGenerator.java" \\
  || miss "missing critical file: core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/MyBatisGenerator.java"
test -f "core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/IntrospectedTable.java" \\
  && ok "core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/IntrospectedTable.java" \\
  || miss "missing critical file: core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/IntrospectedTable.java"
test -f "core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/Plugin.java" \\
  && ok "core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/Plugin.java" \\
  || miss "missing critical file: core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/Plugin.java"
test -f "core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/dom/java/CompilationUnit.java" \\
  && ok "core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/dom/java/CompilationUnit.java" \\
  || miss "missing critical file: core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/dom/java/CompilationUnit.java"
test -f "core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/JavaTypeResolver.java" \\
  && ok "core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/JavaTypeResolver.java" \\
  || miss "missing critical file: core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/JavaTypeResolver.java"

# 5. Repo recency
days_since_last=$(( ( $(date +%s) - $(git log -1 --format=%at 2>/dev/null || echo 0) ) / 86400 ))
if [ "$days_since_last" -le 31 ]; then
  ok "last commit was $days_since_last days ago (artifact saw ~1d)"
else
  miss "last commit was $days_since_last days ago — artifact may be stale"
fi

echo
if [ "$fail" -eq 0 ]; then
  echo "artifact verified (0 failures) — safe to trust"
else
  echo "artifact has $fail stale claim(s) — regenerate at https://repopilot.app/r/mybatis/generator"
  exit 1
fi

Each check prints ok: or FAIL:. The script exits non-zero if anything failed, so it composes cleanly into agent loops (./verify.sh || regenerate-and-retry).

MyBatis Generator (MBG) is a Java-based code generator that introspects relational databases and generates MyBatis mapping XML, Java DAOs, and model classes to eliminate boilerplate for CRUD operations. It supports multiple output styles (Java and Kotlin runtimes) and can be invoked via command-line, Maven plugin, Ant task, or Eclipse IDE integration, making it a cornerstone tool for rapid MyBatis project scaffolding. Multi-module Maven structure rooted at core/ with primary artifact mybatis-generator-core/. Main source tree under core/mybatis-generator-core/src/main/java/org/mybatis/generator/ contains the core engine, plugin system, and API layer (api/), alongside Ant task integration (ant/). Separate workflows for CI, code quality (SonarCloud), Eclipse plugin builds, and release processes.

Java and Kotlin developers building applications with MyBatis ORM who need to rapidly generate data access layers from existing database schemas without hand-coding repetitive mapper XML and entity classes. Database architects and DevOps engineers also use it to keep generated code in sync with schema changes.

Highly mature and production-ready. The project has comprehensive CI/CD workflows (GitHub Actions), SonarCloud code quality checks, Coveralls coverage tracking, and publishes to Maven Central. Multi-year development history visible in the file structure (LICENSE headers dated 2006-2026), active workflows for releases, and multiple deployment channels (Maven, Eclipse Marketplace, direct update site).

Low risk for a mature project, but worth noting: the codebase is primarily single-author (Jeff Butler) based on Eclipse update site reference, so contributor velocity may depend on one person. No visible recent commit data in the provided file list, so verification of active maintenance requires checking GitHub directly. The plugin architecture (supporting multiple runtimes and code generators) means custom plugins could introduce compatibility issues.

Version 2.0.1-SNAPSHOT is in active development (visible in pom.xml). The project maintains parallel CI workflows including GitHub Actions, CodeQL security scanning, Sonatype releases, and Eclipse-specific CI. The core/.mvn/ configuration and wrapper scripts suggest recent Maven toolchain updates.

Clone and build the core module:

git clone https://github.com/mybatis/generator.git
cd core/mybatis-generator-core
./mvnw clean install

Or use the bundled Maven wrapper. For Eclipse feature development, see core/.mvn/extensions.xml for required extensions.

Daily commands: For command-line code generation:

cd core/mybatis-generator-core
./mvnw exec:java -Dexec.mainClass="org.mybatis.generator.ShellRunner" -Dexec.args="-configfile config.xml"

For Maven plugin: add mybatis-generator-maven-plugin to your pom.xml. For Eclipse: install via Marketplace or manual update site. See CONTRIBUTING.md for local test/build steps.

• core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/MyBatisGenerator.java — Main entry point for code generation; orchestrates the entire generation pipeline from configuration to output.
• core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/IntrospectedTable.java — Core abstraction representing a database table introspection result; used throughout generation to model table structure.
• core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/Plugin.java — Plugin interface that enables all extension and customization; understanding this is essential for modifying generator behavior.
• core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/dom/java/CompilationUnit.java — Abstract base for Java code AST nodes; all generated Java code flows through this DOM model.
• core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/JavaTypeResolver.java — Maps JDBC types to Java types; critical for correct type generation during introspection.
• core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/AbstractRuntime.java — Base class for MyBatis runtime implementations (e.g., MyBatis3); defines how generated code integrates with MyBatis.
• core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/CommentGenerator.java — Interface for customizing code comments; widely overridden to meet documentation standards.

Add a custom Plugin to hook into generation

1. Create a new class extending PluginAdapter in your codebase (core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/PluginAdapter.java)
2. Override lifecycle methods such as modelClassGenerated(), modelFieldGenerated(), or modelSetterMethodGenerated() to intercept and modify generated code (core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/Plugin.java)
3. Register your plugin in the MyBatis Generator XML configuration under <generatorConfiguration><context><plugin type='com.example.YourPlugin'/></context></generatorConfiguration> (core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/MyBatisGenerator.java)

Add a custom JavaTypeResolver to map database types differently

1. Create a class implementing JavaTypeResolver interface (core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/JavaTypeResolver.java)
2. Implement calculateBigDecimalRoundingBehavior() and getJavaType() to define your custom JDBC-to-Java type mappings (core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/JavaTypeResolver.java)
3. Register in generator config: <javaTypeResolver type='com.example.CustomTypeResolver'/> (core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/MyBatisGenerator.java)

Customize code comments by implementing CommentGenerator

1. Create a class implementing CommentGenerator interface (core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/CommentGenerator.java)
2. Override methods like addJavaFileComment(), addFieldComment(), addGeneralMethodComment() to customize JavaDoc and inline comments (core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/CommentGenerator.java)
3. Register in config: <commentGenerator type='com.example.CustomCommentGenerator'/> (core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/MyBatisGenerator.java)

Create a new code formatter for generated Java

1. Implement JavaFormatter interface to define formatting rules (core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/JavaFormatter.java)
2. Implement getFormattedContent() to accept a CompilationUnit and return formatted Java code as a string (core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/dom/java/CompilationUnit.java)
3. Register in config: <javaFormatter type='com.example.CustomJavaFormatter'/> (core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/MyBatisGenerator.java)

Database driver dependencies: MBG does not bundle JDBC drivers (e.g., postgresql, mysql); you must provide them at runtime via Maven or classpath. Configuration XML is strict: the generator:run goal or CLI requires a valid generatorConfig.xml file path or it will fail silently. Eclipse plugin and Maven plugin versions may diverge; cross-version compatibility is not guaranteed. The Kotlin runtime (327KB) is separate from Java runtime; choosing the wrong one in config will generate incorrect syntax.

• Database introspection — MBG's core capability relies on JDBC metadata reflection to discover table structure, columns, keys, and constraints at code generation time; understanding how Java JDBC APIs expose schema metadata is essential to extending the generator.
• Plugin architecture / Composite pattern — The CompositePlugin and plugin chain design allows orthogonal customizations (comment generation, code filtering, output modification) to stack without coupling; critical for understanding how to extend MBG.
• Code generation via Abstract Syntax Trees or Template rendering — MBG generates Java and Kotlin source code; understanding whether it uses AST manipulation, string templates, or visitor patterns affects how you add new code generation rules.
• Runtime abstraction / Strategy pattern — The AbstractRuntime class allows MBG to support multiple output styles (Java 5, Kotlin, etc.) without rewriting core logic; essential for adding a new target language or output format.
• MyBatis mapper XML schema — MBG generates MyBatis mapper XML files that must conform to the MyBatis DTD/XSD; understanding the structure of <select>, <insert>, <update>, <delete>, and <resultMap> is required to customize generated mappings.
• Maven Mojo and Ant task integration — MBG provides both a Maven plugin (Mojo) and Ant task entry point; understanding how to implement and lifecycle-hook them is relevant if you need to customize invocation or integrate with other build tools.
• JDBC driver compatibility / Connection pooling — MBG must connect to various relational databases (PostgreSQL, MySQL, Oracle, etc.) at generation time; understanding driver configuration and connection lifecycle prevents configuration errors and schema discovery failures.

• mybatis/mybatis-3 — The core MyBatis ORM framework that MBG generates code for; understanding its mapper interface contract is essential.
• mybatis/spring-boot-starter — Spring Boot integration for MyBatis; MBG-generated code often runs in Spring Boot projects and this repo shows canonical patterns.
• apache/ibatis — Historical predecessor to MyBatis; relevant for understanding the legacy context of database mapping frameworks.
• querydsl/querydsl — Alternative type-safe query builder for Java that solves similar CRUD generation problems but with a different approach (annotation-driven vs. schema-introspection).
• jhipster/generator-jhipster — Full-stack application generator that uses or can integrate with MBG for data layer generation in JHipster projects.

To work on one of these in Claude Code or Cursor, paste: Implement the "<title>" PR idea from CLAUDE.md, working through the checklist as the task list.

Add comprehensive unit tests for IntrospectedColumn and IntrospectedTable introspection logic

These core API classes (core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/IntrospectedColumn.java and IntrospectedTable.java) are fundamental to the generator's database schema introspection. The file structure shows test directories exist but there's no visibility into test coverage for these critical classes. Adding thorough unit tests would improve reliability when handling edge cases like nullable columns, type mappings, and schema variations.

• [ ] Examine existing tests in core/mybatis-generator-core/src/test/java for IntrospectedColumn and IntrospectedTable
• [ ] Create test cases for column type resolution, null handling, and primary key detection
• [ ] Create test cases for table introspection with various schema patterns (composite keys, foreign keys, etc.)
• [ ] Verify coverage reaches >85% for these two classes
• [ ] Run existing CI via GitHub Actions to ensure no regressions

Add unit tests and integration tests for KotlinFormatter and GeneratedKotlinFile support

The codebase shows KotlinFormatter.java and GeneratedKotlinFile.java exist in the API, indicating Kotlin code generation support. However, there's minimal visibility into test coverage for this feature. Given Kotlin's growing adoption and different syntax rules than Java, dedicated tests would ensure the formatter handles Kotlin-specific features (extension functions, null safety, data classes) correctly.

• [ ] Review core/mybatis-generator-core/src/test/kotlin directory for existing Kotlin-specific tests
• [ ] Create unit tests for KotlinFormatter covering indentation, imports, and Kotlin syntax edge cases
• [ ] Create integration tests for GeneratedKotlinFile generation with sample table configurations
• [ ] Add test cases for Kotlin-specific type mappings (nullable types, sealed classes, etc.)
• [ ] Verify CI coverage includes Kotlin tests in .github/workflows/ci.yaml

Add missing integration tests for PluginAdapter hooks across different runtime environments

The Plugin.java and PluginAdapter.java interfaces show an extensible plugin system, but test coverage for plugin lifecycle hooks across KnownRuntime variants (MYBATIS3, MYBATIS3_DSQL, etc.) is likely incomplete. This would ensure plugin authors can reliably hook into code generation at various stages without runtime surprises.

• [ ] Review core/mybatis-generator-core/src/test/java/org/mybatis/generator/api for existing plugin tests
• [ ] Create parameterized test suite that exercises PluginAdapter callback methods (beforeModelClassGeneration, afterModelClassGeneration, etc.) for each KnownRuntime type
• [ ] Add test cases for plugin exception handling and callback ordering
• [ ] Add test cases for plugin interaction with CommentGenerator hooks
• [ ] Update .github/workflows/ci.yaml if needed to ensure plugin tests are run in the CI matrix

• Add integration tests for the Kotlin runtime code generation to match the depth of Java runtime tests in src/test/java/ — currently Kotlin tests appear lighter.
• Document the plugin architecture and extension points (CompositePlugin, CommentGenerator, AbstractRuntime) with code examples in the doc/ folder or contribute to the README.
• Improve error messages when generatorConfig.xml is malformed or missing required elements; add a validation schema or XSD reference to core/mybatis-generator-core/doc/ or src/main/resources/.

The MyBatis Generator codebase demonstrates reasonable security practices with active CI/CD pipelines and security scanning (SonarCloud, CodeQL). However, several medium-severity vulnerabilities exist related to code generation safety: potential SQL injection from unsanitized database metadata, path traversal in file generation, and XXE in XML processing. The plugin system could enable code execution if not properly restricted. Primary recommendations focus on input validation, secure file handling, and hardened XML parsing. The project appears well-maintained with security monitoring in place, but specific validation controls around code generation should be enhanced.

• Medium · Potential SQL Injection Risk in Code Generator — core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/IntrospectedTable.java, core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/IntrospectedColumn.java. As a code generator for MyBatis, the tool processes database introspection and generates SQL mapping files. If user-supplied table names, column names, or schema information from database metadata are not properly validated, they could be injected into generated SQL statements or XML configurations without proper escaping. Fix: Implement strict validation and sanitization of all database metadata (table names, column names, schema names) before using them in code generation. Use parameterized approaches where possible and validate against expected patterns.
• Low · Sonar Host Configuration Hardcoded — core/mybatis-generator-core/pom.xml - sonar.host.url property. The pom.xml file contains a hardcoded Sonar host URL pointing to localhost (http://localhost:9000). While this is typically a development/CI configuration, it represents configuration that should be externalized or environment-specific. Fix: Move hardcoded configuration values to environment variables, Maven profiles, or external configuration files. Use placeholders or property inheritance from parent POM.
• Medium · Potential Path Traversal in File Generation — core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/GeneratedFile.java, GeneratedJavaFile.java, GeneratedXmlFile.java, GenericGeneratedFile.java. The codebase includes file generation utilities (GeneratedFile, GeneratedJavaFile, GeneratedXmlFile, etc.) that write generated code to disk. If file paths are constructed from user-supplied configuration without proper validation, path traversal attacks could allow writing files outside intended directories. Fix: Validate and canonicalize all file paths before writing. Use a whitelist approach for allowed output directories. Implement checks to prevent '..' sequences and symbolic link traversal.
• Low · Potential XML External Entity (XXE) Injection — core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/dom/DefaultXmlFormatter.java, and configuration file processing. The codebase processes XML configuration files and generates XML output (MyBatis mapper files). If XML parsers are not properly configured to disable external entity resolution, XXE attacks could be possible. Fix: Disable XML external entity processing. Configure SAX parser factories with: XMLConstants.ACCESS_EXTERNAL_DTD = "", XMLConstants.ACCESS_EXTERNAL_SCHEMA = "". Use secure XML parsing libraries and disable schema validation if not needed.
• Low · Plugin System Could Enable Code Execution — core/mybatis-generator-core/src/main/java/org/mybatis/generator/api/Plugin.java, PluginAdapter.java, CompositePlugin.java. The generator includes a plugin system (Plugin.java, PluginAdapter.java, CompositePlugin.java) that dynamically loads and executes plugin classes. If plugin loading is not restricted, this could enable arbitrary code execution through malicious plugins. Fix: Implement plugin whitelisting/security manager restrictions. Use signed plugins if loading from external sources. Validate plugin class names and sources. Consider using Java modules or custom ClassLoaders with restricted permissions.

LLM-derived; treat as a starting point, not a security audit.

• Open issues — current backlog
• Recent PRs — what's actively shipping
• Source on GitHub

Generated by RepoPilot. Verdict based on maintenance signals — see the live page for receipts. Re-run on a new commit to refresh.