MXH · For your security review

You can run an assessment without anything leaving your network.

Run the command-line assessment locally over an export you control. Inputs and reports stay on your machine. This page covers the offline assessment and the separate developer-testing workflow.

Get MXH · Read the documentation

BUILT NOW — shipped and working today.

Run it yourself, offline.

With Java 17 or newer and the package on your machine, the assessment runs offline.

Your dictionary export, code, screens and configuration stay on your side of the firewall, and the report is written there too. The tool and the metadata packs are free to use, and nothing checks a licence over the network.

Export collection is a separate step. You choose the approved read-only export method and the files to assess. The optional form on Get MXH sends only the contact details you type, never your Maximo export.

Nothing is installed in your Maximo.

The offline assessment reads a copy of your configuration.

It needs no component in your Maximo system. It reads your customisations without running them, and it writes nothing to your database.

Static JAR analysis reads class references and signatures, without running or decompiling your code. Developers can separately run selected custom code in the local modelled test harness. See how developer testing works.

The export is your configuration, not your records.

The assessment uses definitions: objects, attributes, relationships, customisation code, screens and the configuration you choose to include.

Dictionary: four tables of definitions, MAXOBJECT, MAXATTRIBUTE, MAXRELATIONSHIP and SYNONYMDOMAIN, plus ALNDOMAIN when you use ALN domains. Read-only SELECTs.
Structure only. Work orders, assets, people and transactions stay out of the export.
Customisation code and screens: your own Java, automation scripts, Application Designer exports and role-based MAF application definitions.
Configuration and security definitions, if you choose: reports, workflows, integrations, group grants and restrictions. Supply group membership as counts, without user identities. MXH rejects a membership file that carries a user id column.

Take the export from a lower environment that matches production customisations. The REST collector that ships with the tool reads only. Review exported configuration for secrets before you include it. The export SQL is in the documentation.

Your export stays on your side.

MXH is self-service. You run it on your own machine.

Your export is never sent to Assetize, and nobody here sees it. You decide where the export and the report are kept, and for how long.

Reproduce and check any run.

The assessment fingerprints its inputs and outputs in mxh.lock.json; signing is available.

Keep the inputs, the release packs and the run configuration with the report. Anyone can rerun the same inputs and get byte-identical output, or compare the report with a later run. Sign the lock with your own key using --sign.

A checklist for your change board.

Each answer holds for the offline assessment described above.

Question	Answer
Where does it run?	On a machine you choose, with Java 17 or newer.
Does it connect to anything during a run?	The assessment runs offline. The optional collector reads your Maximo over the URL or database you give it.
What is installed in Maximo?	Nothing. It reads an export.
Does it write to the database?	No. The export SQL is read-only SELECTs.
Does it run our code?	The assessment reads code statically. Running code is the separate developer harness, on a developer machine.
Does the export hold personal data?	Group membership goes in as counts. A file carrying user ids is rejected.
Where are the reports written?	To the output folder you name, on the same machine.
Can we audit a run later?	Yes. The lock file fingerprints every input and output, and you can sign it.

Built from MXH integration package be0f912086adbe93 (mxh 2026.09).