New v0.2.2-beta now available

DevTools for Mendix.

Dockable Chrome extension that drops onto any running Mendix app and surfaces the object graph, live data sources, performance, security, and accessibility — reading directly from the React Fiber tree.

Data Containers
Widgets that bind to data
2
Dataview
0
Listview
?
0
Templategrid
?
0
Datagrid2
?
0
Gallery
?
0
Treenode
?
Nested Data Views
0
Normal
?
0
Deeply Nested
?
Data Sources
📄 Current page only · resets on navigation
Runtime Operations 22 unique · 31 calls
qzY2pg2fS1uDfXnF8xaUVgcall191ms×5
3/xPZss1TVaCK1pgy78X4gcall97ms×2
b6c4Of4wqlC5x4X0Hnw0RAcall237ms×2
P2V1ANZZWVO0lnwE9NZw6Acall100ms×2
EitEFWGLslaox2Dhc2t6Ygcall42ms×2
hRDbB0B5u1aDKJXKdRINgAcall113ms×2
bBBLEKixm1SQEg4n1xjZ4Acall271ms×1
iV5d7drWDVSFb+3T6mZ56glist ×50189ms×1
reading fiber tree
0 server calls
Built for Mendix developers who ship
0server calls
10 + 11Mendix versions
9CVEs tracked
MITfree & open source
Data Inspector

Every object.
Every attribute.

Walks the page's object graph — Page Parameters, Context Objects, On-Page entities, Cached. Search attribute values, copy GUIDs, trace associations, see dirty-state flags.

  • Hover a row to pulse the matching container on the page with a coloured outline and label.
  • Click to pin the highlight. Works with virtualized lists.
  • Click an attribute to copy its value with a check-flash.
  • Associations show presence — click to highlight the associated object when it's on the page.
+ Create Order
Order #CustomerStatus
23000017Berry KouwenhovenInProgress
23000042Glazen Huis B.V.New
23000099Smit & ZonenCompleted
Data Inspector
MRPRun.Order
CustomerName"Glazen…"
OrderNumber"23000042"
Status"New"
live · 32 widgets
MRPRun.Order
Performance

Real timings.
First-load accurate.

The perf tracker installs at document_start and wraps XHR + fetch before your app boots — so the numbers you see are what actually happened, not what React could measure after the fact.

  • Page load metrics — load time, DOM nodes, request count, memory.
  • Core Web Vitals — FCP, LCP, TTFB, CLS, benchmarked against industry thresholds.
  • Per-navigation buckets — metrics don't reset on title/query/hash drift.
  • Live data sources — every /xas/ call captured, deduped by operationId.
149
DOM nodes
544ms
LCP
all targets green
LCP within budget
Security

Scan before
you ship.

9 Mendix runtime CVEs tracked per version. Secret-pattern and entropy scan over Mendix Constants — catches JWTs, AWS keys, GitHub tokens, Stripe keys, OpenAI and Anthropic credentials.

  • Environment-aware — demo users flagged critical in prod, expected in dev.
  • Opt-in endpoint probe for /rest-doc/, /odata-doc/, /ws-doc/, /debugger/.
  • Full scan in under a second — synchronous, client-side only.
Security findings 3
High
Constant looks like a JWT token MasterdataAPI.JWTSecret — length 184, Shannon 4.92
Med
Demo users in production app demo_administrator, demo_user — remove before go-live
Low
Writable entity with sensitive name Account.PasswordHash exposed to user role
9 CVEs tracked
scan < 1s
How it works

Reads the client,
never the backend.

Runs entirely in the browser. Walks the React Fiber tree for Mendix 10+ and the dijit registry for Dojo — no mx.data calls.

01 · INJECT
Install at document-start
The perf tracker wraps XHR & fetch before your app boots. Auto-unhooks on non-Mendix pages after 3s.
world: 'MAIN', run_at: 'document_start'
02 · EXTRACT
Walk the Fiber tree
Reads memoizedProps directly to surface MxObjects via Symbol(mxObject). No polling, no races.
fiber.memoizedProps.datasource.items
03 · RENDER
Paint in page context
Panel lives alongside window.mx and mx.session. Dockable, draggable, double-click to minimize.
chrome.scripting.executeScript({…})
Installation

Four steps.

Not on the Chrome Web Store yet — grab the latest release and load it unpacked.

mxinspector-install.sh
01 $ download mendix-inspector-v0.2.2-beta.zip from Releases
02 $ unzip to a local folder
03 $ open chrome://extensions → enable Developer mode
04 $ click Load unpacked → select the src folder