Assetize

MXH · For your security review

You can run an assessment without anything leaving your network.

MXH is a command-line tool. Run it yourself and your export never leaves your machine — there is no upload, no account, and no call home. Everything on this page is how it works today, written to be forwarded to a security team or a change board without a covering explanation.

Run it yourself, offline.

The tool checks its own licence against a key compiled into the build, so it makes no network call to run. An air-gapped machine or CI runner needs nothing but the licence key. Your dictionary export, your source and your screens stay on your side of the firewall, and the report is written there too.

That is the deployment a mining, utility or government site usually wants, and it needs no exception from anybody: there is nothing to allow-list, because there is no outbound connection to allow.

Nothing is installed in your Maximo.

MXH reads an export. No component is deployed into your system, no automation script runs in your JVM, nothing connects to your database, and nothing touches production. An assessment is something that happens to a copy of your configuration.

Your code is never executed either. Compiled customisations are read from the class file's own declared index — the names and signatures it publishes about itself — so nothing of yours is run, decompiled or interpreted. The documentation explains that in full.

The export is your configuration, not your records.

An assessment needs structure: how your objects, attributes and relationships are defined, your customisation code, and your screen definitions. It does not need, ask for, or read your business data.

  • Dictionary — five tables of definitions: MAXOBJECT, MAXATTRIBUTE, MAXRELATIONSHIP, SYNONYMDOMAIN and ALNDOMAIN. Read-only SELECTs.
  • No work orders, no assets, no people, no transactions. None of it is needed, and none of it belongs in the export.
  • Customisation code and screens — your own Java, automation scripts and Application Designer exports.

A lower environment matching production customisations is the better place to take the export from, and the REST fetcher that ships with the tool reads only. It writes nothing back.

If you would rather we ran it for you.

Plenty of sites would prefer to send the export and get the report back. Three things hold in that case:

  • It is processed in your own country of data residency. For Australian customers, that is Australia.
  • The export is deleted once your report is written. It is not retained for future runs; a rerun starts from a fresh export you send at that time.
  • A named set of people per engagement can see what you send, rather than anyone with general access.

What you can hold us to afterwards.

Every report carries a signed record of exactly which inputs were read, each one fingerprinted, so what was assessed is a matter of record rather than recollection. Run the same inputs again and the report is identical, which means a disputed finding can be re-derived rather than argued about.