# `au.com.assetize/maximo` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/au.com.assetize/maximo
- JSON: https://anlyon.dev/api/v1/servers/au.com.assetize/maximo
- Version: 1.0.0 (active)
- Publisher: au.com.assetize (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Repository: https://github.com/softwarecomparereview/Assetize
- Metadata from the official MCP Registry, synced 2026-10-21T17:45:49.728Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Assetize — IBM Maximo knowledge
Cited IBM Maximo and MAS answers: upgrades, error codes, gotchas, versions and lifecycle.
```

Scanned 2026-10-21T18:32:00.272Z over streamable-http.

**19 tools: 3 do something that can't be undone, 12 change things and 4 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 3 | ask |
| Changes things | write | 12 | ask |
| Only reads | read | 4 | allow |

## Exfil surface

No private-data -> untrusted-input -> outbound path in this server alone: no tool is tagged private-data.

| Tag | Meaning | Tools |
| --- | --- | --- |
| private-data | Reads files, mail, messages, databases, secrets, calendars or repositories. | none |
| untrusted-input | Brings in text someone else can write: web pages, inbound email, messages, issues and comments. | `mcp__maximo__get_record` `mcp__maximo__list_gotchas` |
| outbound | Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL. | `mcp__maximo__fixes_gained` `mcp__maximo__upgrade_checklist` `mcp__maximo__upgrade_plan` |

## Findings

No check matched anything in these tool definitions.


## Can't be undone (3)

Sends, pays, publishes or merges: once done, it cannot be taken back. Claude Code: ask.

### `fixes_gained`

- The input addresses people (input.to): what it sends cannot be taken back.
- Tag outbound: The input takes a destination (input.to): what the tool writes goes there.

Description, as the server wrote it:

```untrusted-server-text
Every FIX and SECURITY record the 9.x change log holds for the releases inside a move (the 9.x log starts at 9.1). Optionally one functional area. Counted, never scored as upgrade weight.
```

### `upgrade_checklist`

- The input addresses people (input.to): what it sends cannot be taken back.
- Tag outbound: The input takes a destination (input.to): what the tool writes goes there.

Description, as the server wrote it:

```untrusted-server-text
The phased checklist (before / during / after) for one Maximo move. Every item is CITED — its published records are resolved against the corpus on this call and an item whose records are not published is dropped — or VERIFY, a level-dependent question to settle against IBM. Optionally one phase.
```

### `upgrade_plan`

- The input addresses people (input.to): what it sends cannot be taken back.
- Tag outbound: The input takes a destination (input.to): what the tool writes goes there.

Description, as the server wrote it:

```untrusted-server-text
One Maximo move from an earlier catalogue release to a later one (7.6.1, 8.11, 9.0, 9.1, 9.2), composed from the published record: the support clock on the source release, the staged route (IBM's n-1 policy), what IBM says about the move (route, platform, database, Java, users, add-ons, reports; each with IBM's words and page), the few items only the customer's own system can answer, break-class changes (deprecations, behaviour changes) and landmines (upgrade notes, gotchas) in range from the 9.x change log, fix and security counts, the deprecation-register rows touching the range, and the curated Change Watch entries. Every item links its record or IBM page. Same composition as assetize.com.au/upgrade/<from>/<to>.
```

## Changes things (12)

Creates or changes something that can be changed back. Claude Code: ask.

### `ask_maximo`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
Answer a practical IBM Maximo question from Assetize’s published, source-backed knowledge. The answer cites its evidence ([R#] markers with source URLs) and DECLINES when the published record cannot support one — it never guesses. Best for how-to, troubleshooting, version-behaviour and error questions.
```

### `behaviour_history`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
Historical, lifecycle, behaviour-change, deprecation, architecture and API records — the "how did this get here / when does it end" archaeology. Same data as assetize.com.au/archaeology.
```

### `change_watch`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
The curated feed of genuinely material IBM Maximo / MAS 9.x changes — security, upgrades, deprecations, releases, behaviour and migration breaks. Each carries What Changed / Why It Matters, previous behaviour, a version comparison, a clearly-labelled Assetize interpretation (never presented as IBM’s), the IBM sources, and the corpus records that grounded it. Pass a slug for one change in full; omit it to list, optionally filtered by category. Same data as assetize.com.au/change-watch.
```

### `corpus_stats`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
Coverage / transparency stats for the Assetize corpus: published records, unique source documents, versions represented, and raw evidence items.
```

### `deprecation_register`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
What was deprecated, removed or renamed in Maximo / MAS, in which version, what IBM says replaces it (blank when IBM has not named one), and the published records that say so. Curated; rows publish only on evidence. Same data as assetize.com.au/upgrade/deprecations.
```

### `lifecycle_dates`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
End-of-support, Extended Support and Dual Support dates for Maximo and MAS as structured rows: product, version, milestone, ISO date, days remaining, and the IBM page each comes from. Optionally scope by product or version. Same data as assetize.com.au/upgrade/deadlines.
```

### `lookup_error_code`

- The name "lookup_error_code" says "lookup": a word for reading.
- The input takes a statement or command to run (input.code), which can change anything it can reach.

Description, as the server wrote it:

```untrusted-server-text
Find published records about a specific Maximo error or fix identifier (BMXAA1234E, IJ12345, APAR...).
```

### `maximo_changelog`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
The dated, source-cited log of what changed across IBM Maximo / MAS 9.x (9.1 onward): deprecations, behaviour changes, API/fixes, security, gotchas, upgrades, lifecycle and releases. Only real change records (never data-dictionary noise) and nothing the curator demoted. Same data as assetize.com.au/changelog. Optionally filter by version ("9.1", "9.2") and/or type.
```

### `maximo_mobile`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
Researched IBM statements about Maximo Mobile, by topic: what it is, the shell and Graphite-app architecture, device requirements (OS levels, memory, WebView2, ARCore, shared devices), getting the app onto devices (stores, MSIX, QR server URL, MDM), login and shared devices, data sync and attachments, administration (Mobile Configuration app, properties), the apps release by release (8.11, 9.0, 9.1, 9.2), push notifications, and coming from Maximo Anywhere or 7.6.1. Every fact carries IBM's verbatim sentence, page and read date. Scope by release and/or topic. Same data as assetize.com.au/mobile. For fixes and gotchas use search_records.
```

### `records_by_version`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
Every published record scoped to a given Maximo version or family (e.g. "9.2", "7.6.1"). Same data as assetize.com.au/maximo/<version>.
```

### `support_lifecycle`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
IBM Maximo / MAS support-lifecycle facts: end-of-support / Extended Support transitions and the 2026/2027 deadlines, drawn from source-backed lifecycle records and the curated Change Watch. Optionally scope to a version.
```

### `test_automation_script_evidence`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
Statically check a WORKORDER Object launch point Automation Script (Jython or JavaScript) against one release lens's real MXAPIWODETAIL dictionary. Extracts every attribute the script references via mbo.getString/setValue/isNull/getInt/getDate/getBoolean, then reports which ones the named lens has evidence for. Static evidence only — it does not run the script. A missing attribute is reported NOT_ASSESSED, never claimed as a runtime failure; for a real pass/fail/skip verdict, run the CLI (mvn verify) or the browser runner at assetize.com.au/test-stubs/automation-scripts. Lenses: 761 (Maximo 7.6.1), mas811 (MAS 8.11), mas90 (MAS 9.0), mas91 (MAS 9.1), mas92 (MAS 9.2).
```

## Only reads (4)

Looks things up and changes nothing. Claude Code: allow.

### `compare_maximo_versions`

- The name "compare_maximo_versions" says "compare": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Compare two Maximo versions/eras and get a cited upgrade-impact report per functional area: changes to absorb (deprecations, behaviour changes, API changes, gotchas), fixes/APARs since, and newly announced capability — the last two reported as context only, never scored as upgrade work. Same reviewed, source-backed comparison and ranking as assetize.com.au/compare. Accepts either a version label ("7.6.1.3", "9.2") or bucket id ("9-2"). Known buckets: 7.6.1.3, 7.6.x (classic Maximo 7.6/7.6.1/7.6.1.x), 8.x (Maximo Application Suite 8), 9.0, 9.1, 9.2.
```

### `get_record`

- The name "get_record" says "get": a word for reading.
- Tag untrusted-input: The description's first sentence says "fetch" and "url": it reads web pages, which anyone can write.

Description, as the server wrote it:

```untrusted-server-text
Fetch one published record by slug: the established fact, claims, version scope, and every cited source URL.
```

### `list_gotchas`

- The name "list_gotchas" says "list": a word for reading.
- Tag untrusted-input: The description's first sentence says "issue": it reads issues, which other people can write.

Description, as the server wrote it:

```untrusted-server-text
Known traps, upgrade landmines, installation issues, security and troubleshooting records — optionally scoped to a version. Same data as assetize.com.au/gotchas.
```

### `search_records`

- The name "search_records" says "search": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Fast keyword search over published Assetize knowledge records. Returns slugs, titles and short answers with record URLs.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `maximo`:

```json
{
  "permissions": {
    "allow": [
      "mcp__maximo__search_records",
      "mcp__maximo__get_record",
      "mcp__maximo__compare_maximo_versions",
      "mcp__maximo__list_gotchas"
    ],
    "ask": [
      "mcp__maximo__ask_maximo",
      "mcp__maximo__lookup_error_code",
      "mcp__maximo__maximo_changelog",
      "mcp__maximo__change_watch",
      "mcp__maximo__records_by_version",
      "mcp__maximo__behaviour_history",
      "mcp__maximo__support_lifecycle",
      "mcp__maximo__corpus_stats",
      "mcp__maximo__test_automation_script_evidence",
      "mcp__maximo__upgrade_plan",
      "mcp__maximo__upgrade_checklist",
      "mcp__maximo__fixes_gained",
      "mcp__maximo__deprecation_register",
      "mcp__maximo__lifecycle_dates",
      "mcp__maximo__maximo_mobile"
    ],
    "deny": []
  }
}
```

Capability tags behind the rules (a read tagged outbound is asked about):

- `mcp__maximo__get_record`: untrusted-input
- `mcp__maximo__list_gotchas`: untrusted-input
- `mcp__maximo__upgrade_plan`: outbound
- `mcp__maximo__upgrade_checklist`: outbound
- `mcp__maximo__fixes_gained`: outbound

## Remote posture

What an anonymous client saw at the remote endpoint, last 2026-10-22T14:24:17.011Z, unchanged since 2026-10-22T14:24:17.011Z. No credentials were sent and no tool was called. Values are shown as the endpoint returned them. Method: https://anlyon.dev/methodology#remote-posture

| Fact | Observed |
| --- | --- |
| Reachable | `yes` |
| HTTP status of an anonymous initialize | `200` |
| tools/list served without credentials | `yes` |
| Tools that change things, listed without credentials | `15` |
| Protocol version | `2025-06-18` |
| WWW-Authenticate on 401 | `not observed` |
| resource_metadata in WWW-Authenticate | `none` |
| RFC 9728 protected resource metadata | `none` |
| Authorization servers | `none` |
| Legacy HTTP+SSE transport | `no` |
| Dynamic client registration | `not observed` |
| Client ID metadata documents | `not observed` |

- **high** Tools that change things, listed to anyone ([unauth-remote-writes](https://anlyon.dev/methodology#unauth-remote-writes))

```untrusted-server-text
The endpoint served tools/list without credentials, and the list has 15 tools that change things (3 irreversible, 12 write). Whether a call also works without credentials was not tested: tools are never called.

https://assetize.com.au/mcp: tools/list returned 19 tools to an anonymous client, including upgrade_plan (irreversible), upgrade_checklist (irreversible), fixes_gained (irreversible), ask_maximo (write), lookup_error_code (write) and 10 more
```