I just deployed a sample application with all classpath references for a webapp in the MANIFEST.MF, instead of the WEB-INF/lib directory. However, the TLD scanner threw an exception when trying to scan the jars, which seems like the scanner isn't following the rules for using the classpath.