MXH · For your security review

You can run an assessment without anything leaving your network.

Run the command-line assessment locally over an export you control. Inputs and reports stay on your machine. This page describes the offline assessment workflow and the separate developer-testing workflow.

Run it yourself, offline.

With Java 17 or newer and the required package on your machine, the assessment runs offline. Your dictionary export, code, screens and configuration stay on your side of the firewall, and the report is written there too. Core tool: free. Versioned metadata packs: separate evaluation and subscription terms.

Export collection is a separate step. You choose the approved read-only export method and the files to assess. Requesting a package through Get MXH sends your contact details for follow-up, not your Maximo export.

Nothing is installed in your Maximo.

The offline assessment reads a copy of your configuration. It requires no component in your Maximo system, does not execute your customisations and does not write to your database.

Static JAR analysis reads class references and signatures without executing or decompiling your code. Developers can separately run selected custom code in the local modelled test harness. See how developer testing works.

The export is your configuration, not your records.

The assessment uses definitions: objects, attributes, relationships, customisation code, screens and the configuration you choose to include. Business transaction records are not required.

• Dictionary — five tables of definitions: MAXOBJECT, MAXATTRIBUTE, MAXRELATIONSHIP, SYNONYMDOMAIN and ALNDOMAIN. Read-only SELECTs.
• No work orders, no assets, no people, no transactions. None of it is needed, and none of it belongs in the export.
• Customisation code and screens — your own Java, automation scripts, Application Designer exports and role-based MAF application definitions.
• Optional configuration and security definitions — reports, workflows, integrations, group grants and restrictions. Supply group membership as counts, without user identities. Review exported configuration for secrets before including it.

A lower environment matching production customisations is the better place to take the export from, and the REST fetcher that ships with the tool reads only. It writes nothing back.

Your export never leaves your side.

MXH is self-service. You run it on your own machine, so your export is never sent to Assetize and nobody here sees it. You decide where the export and the report are kept, and for how long.

What you can hold us to afterwards.

The assessment fingerprints its inputs and records them in a lock file; signing is available. Keep the inputs, selected release packs and run configuration with the report so the assessment can be reproduced and compared with a later run.