---
title: "After ACR: How to Keep Control of Mendix Quality"
description: SIG supports ACR, ATS and APD until the end of 2026. Five questions to ask before you choose a Mendix ACR alternative, and how Omnext checks Mendix quality.
---

[Omnext | Blog](https://www.omnext.com/blog)

# [After ACR: How to Keep Control of Mendix Quality](https://www.omnext.com/blog/mendix-acr-alternative)

 Written by [Bryan de Vries](https://www.omnext.com/blog/author/bryan-de-vries) | Nov 2, 2026, 9:44:05 AM

SIG, which took over CLEVR's Mendix quality tooling, supports ACR, ATS and APD until the end of 2026. We have not seen an announcement about the period after that. If ACR is part of your workflow, choose your Mendix ACR alternative now: a check that is independent of the builder, repeatable and works across your landscape.

## What is happening to ACR, ATS and APD?

CLEVR transferred its Mendix quality tooling to Software Improvement Group (SIG). SIG supports all versions of these tools until the end of 2026.

The transfer covers three tools:

- Application Code Reviewer (ACR)
- Application Test Suite (ATS)
- Application Performance Diagnostics (APD)

In CLEVR's words: "SIG will maintain and support all versions of ATS, APD, and ACR until the end of 2026." CLEVR also writes: "There will be no disruption to current services."

The press release says nothing about what happens after 2026. But if ACR runs in your pipeline, or a client expects its reports, you need a plan for 2027. Plans and budgets for next year are made now.

## What does SIG offer for Mendix today?

SIG offers Mendix Quality & Security Management (QSM), based on its Sigrid platform.

On its QSM page, SIG lists Sigrid Axis, Guardrails, Auto-Fix Agents and Sigrid Core. The QSM page does not mention ACR. If you want to know what applies to your current ACR setup, ask SIG directly.

Whichever way you go, the choice is yours to make. The questions below help you compare options on what matters for control.

## Five questions to ask before you choose a Mendix ACR alternative

Before you switch Mendix quality tooling, ask these five questions. They work for any tool, including ours.

| Question | Why it matters | What to ask the vendor |
| --- | --- | --- |
| 1. Is the check independent from the builder? | The party that builds an app should not be the only one that checks it. | Do you build Mendix apps yourself? |
| 2. Does the same model always get the same result? | A result that changes without a change in the model is no evidence and breaks a pipeline. | Is there AI inside the analysis? |
| 3. Can you check one application or your whole landscape? | A team needs findings per app. A CoE needs one view of all apps. | Can I see one app and all apps in the same way? |
| 4. Are the results available to your AI agents? | Agents now help build Mendix apps. They should be able to read the check. | Is there an MCP server, and is it read-only? |
| 5. Do you get insight, not just a score? | A score tells you where you stand. Findings tell you what to fix and why. | Can I trace each finding to a rule and a place in the model? |

### 1. Is the check independent from the builder?

A referee does not play in the match. A check carries more weight with an auditor or a client when it comes from a party that does not build the app. Ask who builds and who checks.

### 2. Does the same model always get the same result?

You want a deterministic check: the same model gets the same answer, every time. That is what makes a result usable as evidence for an auditor or a client. It also makes it usable in CI/CD, where a check that changes its mind blocks the wrong releases.

### 3. Can you check one application or your whole landscape?

Developers need findings for the app they work on. A CoE lead or IT manager needs to see all apps side by side, with the trend over time. Make sure one tool gives both views, from the same rules.

### 4. Are the results available to your AI agents?

Since Studio Pro 11.8, Maia can connect to external MCP servers. AI now helps build Mendix apps, so it helps when your agents can read the quality and security findings too. Ask whether the vendor offers an MCP server, whether it is read-only and whether it applies your own access rights.

### 5. Do you get insight, not just a score?

A single number is easy to report but hard to act on. Look for findings that name the rule, the place in the model and the reason. Then a developer can fix it and a manager can see progress.

## What does Omnext do, and what does it not do?

Omnext checks the quality and security of Mendix applications. It does not build them.

Omnext has worked in software analysis for almost 20 years and has built zero Mendix applications. We are the referee, not the player. Today Omnext has scanned 1,000+ Mendix applications, runs 1,500+ scans per day and works for 100+ clients.

Omnext is the only SAST tailored to Mendix.

### What Omnext does

- **The Omnext Platform** reads the Mendix model: microflows, pages, modules, access rules and open source components.
- **The [Omnext Compliancy Rating](https://www.omnext.com/mendix-quality-analysis)** scores each app on four dimensions: Maintainability, Security, Performance and Reliability, plus an Overall score. The rating is formula-based and reproducible.
- **The Security dimension** is based on the [S-Unit Top 10 for Mendix](https://www.omnext.com/s-unit-top-10), a framework by The S-Unit that Omnext applies. It covers ten categories, from insecure user roles to insecure cloud deployments.
- **Per application or the whole landscape**: the same rules for one app and for all apps, with progress over time in the Omnext Portal.
- **DevAssist**, the Studio Pro extension, runs the same analysis inside Studio Pro, locally and on save. Developers see findings while they are still in the model.
- **The [Omnext MCP](https://www.omnext.com/omnext-mcp)** makes the findings available to any AI agent that supports MCP. It is read-only and applies the user's own Omnext permissions.

### What Omnext does not do

- No AI inside the analysis. The same model gets the same answer, so there are no hallucinated findings.
- No comparison of your apps with those of other organisations. The rating is absolute: it measures your app against the rules.
- No replacement for a pentest. [Static security analysis](https://www.omnext.com/mendix-security-analysis) makes every sprint more secure and makes the pentest more effective.
- No changes to your model. The Omnext MCP never changes a model and never starts a scan.

## How do you start without a big project?

Start small: map where ACR runs today, then check where you stand.

1. **Map your current use.** Which apps does ACR check? Which pipelines use it? Who reads the reports, inside your team and at your clients?
2. **Check your security profile.** The Mendix security self-assessment takes ten questions and five minutes.
3. **For CoE leads:** the [CoE Maturity Scan](https://www.omnext.com/coe-maturity-scan) shows where your Center of Excellence stands, in 20 questions across 5 dimensions.
4. **Decide in time**, so you know what checks your apps in 2027.

Build Fast. Stay in Control.

**[Take the Mendix security self-assessment](https://www.omnext.com/mendix-security-self-assessment)**

## Frequently asked questions

### Is ACR still supported?

Yes. According to CLEVR, SIG supports all versions of ACR, ATS and APD until the end of 2026. We have not seen an announcement about the period after that.

### What is a good Mendix ACR alternative?

Any tool that reads the Mendix model and checks quality and security can replace ACR in your workflow. Ask whether it is independent, deterministic, works per app and across your landscape, and is available to AI agents. Omnext is built on these principles.

### Does Omnext use AI in its analysis?

No. The analysis is deterministic: the same model always gets the same result. AI agents can read the results through the read-only Omnext MCP.

### Can Omnext check all Mendix apps in my organisation?

Yes. Omnext analyses per application and across the whole landscape, with the same rules, and shows progress over time.

### Does a static analysis replace a pentest?

No. Static analysis checks the model on a fixed rhythm, for example with every release or at the end of every sprint. A pentest tests the running app. Omnext makes the pentest more effective, it does not replace it.

### What is the S-Unit Top 10 for Mendix?

It is a framework by The S-Unit that names ten categories of security risk specific to Mendix. Omnext applies it in the Security dimension of the Omnext Compliancy Rating.

## Sources

- CLEVR, Transfer of CLEVR Mendix quality tooling to Software Improvement Group: [https://www.clevr.com/news/transfer-of-clevr-mendix-quality-tooling-to-software-improvement-group](https://www.clevr.com/news/transfer-of-clevr-mendix-quality-tooling-to-software-improvement-group)
- Software Improvement Group, Mendix QSM: [https://www.softwareimprovementgroup.com/mendix-qsm/](https://www.softwareimprovementgroup.com/mendix-qsm/)
- Mendix documentation, Maia MCP Client: [https://docs.mendix.com/refguide/maia-mcp/](https://docs.mendix.com/refguide/maia-mcp/)
- The S-Unit Top 10 for Mendix: [https://www.omnext.com/s-unit-top-10](https://www.omnext.com/s-unit-top-10)
- Omnext quality analysis for Mendix: [https://www.omnext.com/mendix-quality-analysis](https://www.omnext.com/mendix-quality-analysis)
- Omnext, security analysis for Mendix (viewed 20 October 2026): [https://www.omnext.com/mendix-security-analysis](https://www.omnext.com/mendix-security-analysis)
- The Omnext MCP: [https://www.omnext.com/omnext-mcp](https://www.omnext.com/omnext-mcp)

[View full post](https://www.omnext.com/blog/mendix-acr-alternative)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Bryan de Vries"
  },
  "dateModified" : "2026-11-02T09:44:05.213Z",
  "datePublished" : "2026-11-02T09:44:05Z",
  "headline" : "After ACR: How to Keep Control of Mendix Quality",
  "image" : {
    "@type" : "ImageObject",
    "height" : 2160,
    "url" : "https://www.omnext.com/hubfs/20261102-visual-blog-after-acr-header.png",
    "width" : 3840
  },
  "mainEntityOfPage" : "https://www.omnext.com/blog/mendix-acr-alternative",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Omnext | Blog"
  }
}
```