Is it possible to externalize a compiler from the runtime environment when I run JSP?
I never had security issue in leaving the full JDK on a production environment, in particular on real servers (Unix based), where you can easily restrict the access to just the user that runs the servlet-compiler.
If this doesn't satisfy you (and I would be curious of the reasons), you can take a look at the jspc program of Tomcat. It's a Jsp precompiler. You can use it for compiling all the jsp files and generating the servlets. One option (I used this program once, so I don't know it well) is to generate servlets and denote them within the corresponding web.xml file, so you can altogether avoid putting jsp on the server.