Assess Quality

Assess Mendix Project Quality

This skill guides a comprehensive quality assessment of a Mendix project, evaluating it against established best practices across naming, security, performance, maintainability, architecture, and more.

When to Use This Skill

Use this skill when:

• A user asks to evaluate the quality of a Mendix project
• Reviewing a project against best practices before go-live
• Performing a health check or audit on an existing application
• Onboarding onto a project and wanting to understand its quality posture

Assessment Workflow

Step 1: Run Automated Analysis

Run the automated linter and report to get a baseline score:

# connect to the project and build a full catalog (needed for deep analysis)
mxcli -p app.mpr -c "refresh catalog full"

# run the linter (41 rules: MDL, SEC, QUAL, ARCH, design, CONV series)
mxcli lint -p app.mpr

# generate the scored best practices report
mxcli report -p app.mpr --format markdown

# score only the app's own modules (not Marketplace / platform modules)
mxcli report -p app.mpr --modules MyModule,OtherModule --format markdown

The report covers 6 categories with scores: Naming, Security, Quality, Architecture, Performance, Design.

Step 2: Explore Project Structure

Use catalog queries to understand the project's shape:

-- Overview of project size and structure
describe structure depth 2;

-- Key metrics
select module_name, count(*) from CATALOG.entities GROUP by module_name;
select module_name, count(*) from CATALOG.microflows GROUP by module_name;
select module_name, count(*) from CATALOG.pages GROUP by module_name;

-- Complexity metrics (McCabe/Sigrid-style)
select qualified_name, cyclomatic_complexity
from CATALOG.microflows
where cyclomatic_complexity > 10
ORDER by cyclomatic_complexity desc;

-- Large microflows
select qualified_name, activity_count
from CATALOG.microflows
where activity_count > 15
ORDER by activity_count desc;

Step 2b: Architecture & Dependency-Graph Analysis

mxcli models the project as a dependency graph and exposes topological analyses on top of it — god nodes, coupling, cohesion, communities, centrality, cycles, and layering. These answer questions catalog metrics can't: what's central, what's tangled, what belongs together.

Read graph-analysis before running graph analysis. It covers setup (two-step refresh required), all eight use cases (impact assessment, dead code, cohesion, communities, bridges, hotspots, cycles, monolith splits), column schemas, false-positive caveats for dead assets, and a quick-reference table mapping questions to tables.

Step 3: Manual Review Against Guidelines

After reviewing automated results, assess the following areas manually. The guidelines below are organized by category.

Quality Guidelines Reference

A. Naming Conventions

Enforced by rules: MPR001, CONV001, CONV003, CONV004, CONV005

Microflow prefix reference (21 recognized prefixes):

Manual check: Verify that microflow names are descriptive beyond just the prefix. For example, ACT_Customer_Save is better than ACT_Save.

B. Folder Structure

Not automatically enforced (folder hierarchy not fully captured in catalog)

C. Security

Enforced by rules: SEC001-SEC009, CONV006, CONV007, CONV008, MPR007

C.1 Entity Access

C.2 Role Management

C.3 DIVD Findings (Common Misconfigurations)

The Dutch Institute for Vulnerability Disclosure (DIVD) found widespread authorization misconfigurations in Mendix apps. Key checks:

C.4 Additional Security Practices

• Do not store sensitive information (passwords, API keys) in constants (values are visible in version control)
• Sanitize user input to prevent XSS (use HTMLSanitize() from Community Commons)
• Be cautious with nanoflow security — nanoflows execute client-side and can be inspected
• Use HTTPS for all external integrations
• Validate and urlEncode() all values used in REST URLs

D. Maintainability

Enforced by rules: QUAL001-QUAL004, CONV009, CONV012, CONV014, MPR002, MPR004, MPR006

Manual checks:

• Don't change activity captions (they should match the default for readability)
• Don't modify imported/marketplace modules (fork or extend instead)
• Generalize repeated snippets — if the same layout appears 3+ times, extract to a snippet
• Remove all Studio Pro warnings (yellow markers)
• Limit use of non-Mendix languages (Java, JavaScript) to what's necessary

E. Performance

Enforced by rules: CONV011, CONV016, CONV017

XPath performance tips:

• Avoid negation in XPath (not(), !=) — these cannot use indexes efficiently
• Use indexed attributes in XPath constraints
• Prefer [Assoc/entity/attribute = value] over retrieving + filtering in microflow
• For large datasets, consider using a data source microflow with pagination

Microflow performance tips:

• Use batching for operations on 100+ objects (retrieve in batches of 1000, process, commit batch)
• Avoid deep nesting of microflow calls (call stack overhead)
• Use list operations (find, filter, head) instead of loops when possible