What is IBM Bob, and is it the same thing as watsonx Code Assistant?

IBM Bob is IBM's agentic software-development platform, which IBM markets as an 'AI SDLC partner' covering planning, coding, testing, deployment and modernization. It began as an internal pilot called Project Bob (about 100 IBM developers, June 2025), was unveiled at TechXchange on October 7, 2025, and reached global general availability as SaaS on April 28, 2026. IBM positions Bob as the successor to watsonx Code Assistant (WCA): IBM said existing WCA clients would stay fully supported with an adoption path to Bob, but it has not published a WCA end-of-support date. So they are related products on one lineage, not the same product, and Part 1 walks through the timeline and the V2 architecture.

Is IBM's '69% time savings' Maximo number something I can plan a budget around?

No. IBM's GA announcement says the IBM Maximo development team used Bob for code generation, refactoring and updates that 'normally take days' and finished them in hours, for an 'estimated 69% time savings.' That is one sentence about IBM's own product team, with no published task mix, baseline, sample size, measurement method, or statement on whether review and test time were counted. Customer Maximo shops do configuration, integration, data and upgrade work, which is a different mix from a product engineering team's. This series repeats the figure only with its 'IBM-reported, internal estimate' label and shows you how to generate your own numbers in Part 5.

Can Bob talk to Maximo directly, or does it need special connectors?

Bob is an MCP client, so it can call any Model Context Protocol server you configure in .bob/mcp.json. MAS 9.2 ships a native Maximo MCP server (an instance_ID-mcp deployment on OpenShift) that exposes Manage capabilities as tools under Manage's own security layer, and the same server is reachable by external agents using an API key or JWT. Shops on earlier versions can use an agent-neutral server such as TheMaximoGuys' Max_mcp, which works across Maximo versions. Be aware that, as of this writing, no IBM or community write-up shows Bob calling the native 9.2 server end to end in production, so Part 4 treats that path as something to verify in your own sandbox rather than a proven recipe.

Should my Maximo team choose SaaS Bob or self-hosted Bob?

Start from your data and sovereignty constraints, not from preference. SaaS Bob routes each task across a mix of models (Anthropic Claude, Mistral, IBM Granite and fine-tuned IBM models) and users cannot pin or restrict the model; IBM states that payloads are effectively zero-retention and not used for training. Self-hosted Bob, which IBM says is generally available as of September 24, 2026, runs on Red Hat OpenShift and supports air-gapped operation, but it uses one core model at a time, has no Bobalytics at GA, and does not support in-place upgrades. Utilities, defense and public-sector estates with hard residency rules are the natural self-hosted candidates; Part 2 gives the sizing and the known limitations so you can decide with the trade-offs in front of you.

Does this series assume I will buy Bob?

No. The series is deliberately agent-neutral wherever it can be: the governance, MCP least-privilege and pilot-measurement guidance applies equally to Claude Code, Copilot, Cursor or Kiro, and our companion Enterprise Vibe Coding series covers the tool-independent concepts. Bob gets the focus here because it is the IBM-native option, it has IBM-authored Maximo skills, and Maximo shops are already asking about it. Every vendor claim is labeled IBM-reported or independent, and Part 5 ends with the open-questions list as a checklist for your own evaluation rather than a purchase recommendation.

IBM Bob for Maximo Teams: A Field Guide

🎯 Who this is for: Maximo and EAM architects and development leads deciding whether an AI coding agent belongs in their customization and integration work, platform and security teams who will be asked to approve it, consultancies who would put it on client code, and IT decision-makers who have just heard "IBM has an AI coding partner, and the Maximo team says it saved 69%." If you want to know what is real, what is IBM-reported, and what nobody has verified yet, start here.

Series: Series Index — IBM Bob for Maximo Teams | 5 parts | Total read time: ~1.5 hours

📖 Why This Series Exists

You have been through this before. A new tool shows up with a slide that says "days to hours," your director forwards it with a one-line question, and you are the person who has to answer it. You know what a Maximo customization actually involves: an automation script that touches three objects and a crossover domain, a Java MBO nobody has opened since 7.5, an application XML change that looks harmless until it breaks a signature option in production. You also know that "it generated the code" and "it is safe to promote" are two very different sentences.

IBM Bob lands in exactly that gap. IBM calls it an "AI SDLC partner," and the release notes since April 2026 read like a platform maturing in public: a V2 rebuild in June, premium packages and analytics in July, a shell rewrite and group policies in August, self-hosted deployment on OpenShift in September. Maximo shops are asking about it for three specific reasons, and each one deserves a straight answer rather than a brochure:

IBM itself pointed at Maximo. The Bob GA announcement includes a claim from the IBM Maximo development team. We will show you the sentence and the reasons you should not plan a budget around it.
MAS 9.2 made Maximo agent-addressable. The suite now ships a native Maximo MCP server, and Bob is an MCP client. The pieces fit, but the end-to-end story is younger than the marketing suggests.
Your Java estate is a modernization target. IBM publishes Bob skills that convert legacy Java MBO classes into automation scripts and review existing scripts for security and performance. That is real, testable work, and exactly where an agent can help or hurt.

This series is not IBM sales copy dressed up as Maximo content, and it is not a takedown either. It draws one consistent line: vendor numbers are labeled IBM-reported, independent views are labeled independent, and anything that could not be verified goes onto a checklist you can take to IBM. Our source base is IBM's own documentation, IBM newsroom releases, the Bob blog, and independent press and analyst coverage, and where those disagree we show both readings instead of picking the flattering one.

💡 Key insight: The organizing question of this series is not "is Bob good?" It is "which Maximo tasks can an agent safely do under your controls, how will you know it worked, and what does it cost per completed task?" A tool that is excellent at a task you never do is worthless; a tool that is mediocre but governable on a task you do weekly can pay back. Everything in the five parts serves that question.

🧭 Where This Series Fits

Bob sits inside a bigger conversation about AI-assisted development, and we have already written the tool-neutral half of it. To avoid making you read the same material twice, here is how the pieces divide:

If you want…	Read…
The tool-independent concepts: prompts as specs, autocomplete vs. agents, plan mode, human-in-the-loop, audit trails	Enterprise Vibe Coding series (start at the index)
How to read productivity claims such as 45%, 69%, 70% and 10x	Enterprise Vibe Coding, Part 10
What agentic coding means for Maximo and EAM shops in general, plus a hands-on first agent	Enterprise Vibe Coding, Parts 12 and 13
The Java customization world (PLUS prefixes, MBO inheritance, Java 17) that Bob's conversion skill targets	MAS Java Extensions series
Bob specifically: product facts, models, security, governance, pricing, Maximo integration points, and a pilot design	This series

Think of Enterprise Vibe Coding as the textbook and this series as the lab manual for one specific instrument. When a Bob concept has a general version (plan mode, approval gates, house rules), we link to the general post and spend our words on what is distinctive about Bob and on the Maximo consequences.

📊 The Series at a Glance

Part	Title	Focus Area	Read Time
1	What IBM Bob Is: Project Bob to Self-Hosted	Timeline and WCA succession; V2 three-tier design (clients, agent, harness); IDE, Bob Shell and ACP; Agent/Plan/Ask modes; skills, rules, MCP, hooks	17 min
2	Bob Models, Security, and Self-Hosted on OpenShift	SaaS auto-routing and why you cannot pin a model; self-hosted single core model; zero-retention claims; Enterprise-only IP indemnity; regions; the PromptArmor finding; sizing and GA limitations	19 min
3	Governing Bob	Bobalytics, CADF activity logs and SIEM, SSO, group policies (DisabledAutoApprovalGroups), plans, Bobcoins, premium packages; mapping to CAB-style change control	17 min
4	Bob Meets Maximo	The 69% claim with its caveat; the MAS 9.2 MCP server; maximo-code-optimization and maximo-java-conversion skills; MAF Local Dev Mode; community evaluation; task-fit table; TMG tooling	20 min
5	Piloting Bob on Maximo	IBM-reported customer metrics vs. independent views; competitors; eight-point guidance; pilot metric design; open questions as a verification checklist (series finale)	18 min

🔑 What Makes This Series Different

Three ideas run through every part. Hold onto them and the series reads as one argument instead of five product tours.

Every vendor number wears a label. You will see "[IBM-reported]" and "[independent]" attached to figures throughout, and the labels are not decoration. IBM says 45% average productivity gain from a survey of its own users, 69% time savings for its own Maximo team, 70% for its own Instana team. Those are internal, self-reported results, and the press noticed: The Register described IBM as the latest vendor to lean on its own staff to "prove" AI efficacy, and IDC's analyst paper (which IBM published) states that "the external evidence base remains limited at GA." We carry IBM's numbers because they are the numbers your executives will quote. We attach their provenance because you are the person who has to defend the budget.

Control is the product, not the model. The most useful independent framing we found, from VentureBeat, is that the difference between Bob and its rivals "is not about capabilities but about control." Approval gates on edits, commands, MCP calls and skills; rollback; workspace trust; .bobignore; group policies pushed by MDM or GPO; enforced hooks; activity logs in CADF format. For a Maximo shop, those are the features that decide whether an AI-authored change to a production customization can survive your change advisory board. The model underneath will keep changing (on SaaS you cannot even choose it); the control surface is what you can design around.

Agents go through the API layer, never the database. This is the Maximo-specific rule that survives every product comparison. The MAS 9.2 MCP server turns Manage objects, scripts and API routes into tools that run under Manage's own authorization and validation. A TheMaximoGuys MCP server does the same for earlier versions. Either way, the safe posture is a dedicated least-privilege API key, read-only first, and no agent with direct database credentials. Parts 3 and 4 show how to enforce that centrally.

💡 Key insight: If you remember one sentence from the index, make it this: label the number, scope the key, measure your own task. Skip the first and you quote marketing as fact; skip the second and an agent holds more access than a junior admin; skip the third and you never learn whether the tool paid for itself.

🗺️ Bob at a Glance, Through a Maximo Lens

Before the part-by-part guide, this table gives you the whole product on one screen and attaches the Maximo consequence to each row. All product facts are from IBM documentation and announcements as of early October 2026 and are explored properly in the parts indicated.

Dimension	What IBM ships (IBM-reported)	Maximo relevance	Part
Clients	Bob IDE (a VS Code fork), Bob Shell CLI (bob chat, bob run, bob mcp, bob acp), ACP support for IntelliJ, Zed and Neovim	Works on autoscripts, Java MBOs, application XML, BIRT and integration code like any repository	1
Agent model	One agent and one harness for all clients; Agent, Plan and Ask modes; subagents; workflows	Plan mode produces a reviewable artifact before a Manage customization is touched	1
Extensibility	Skills in .bob/skills/, rules in .bob/rules/, AGENTS.md, custom modes, MCP, hooks, plugins	IBM's Maximo skills; the MAS 9.2 MCP server; your own house standards as rules	1, 4
Models (SaaS)	Automatic routing across Claude, Mistral, Granite and fine-tuned IBM models; no user model choice	Behavior can shift under you; you cannot pin a version for reproducibility	2
Models (self-hosted)	One core model at a time plus a recommended guardrail model; Bob does not host the model	Fits air-gapped utility, defense and public-sector estates; a different quality tier from SaaS	2
Governance	Approvals, rollback, .bobignore, workspace trust, group policies, enforced hooks, CADF logs, Splunk SIEM forwarding	Supports CAB-style controls for AI-authored Maximo changes	3
Price	Pro $20, Pro+ $60, Ultra $200 per month, Enterprise custom, metered in Bobcoins	IP indemnity is Enterprise-only, which matters for consultancies	3
Maximo ties	IBM skills for script optimization and Java conversion; MAS 9.2 MCP server; MAF Local Dev Mode supports the Bob IDE	The concrete reasons to run a pilot at all	4

🧪 One Concrete Example: What "Governed" Looks Like

The series stays grounded in real configuration rather than slideware. Here is the kind of control the governance and security parts build on: a Linux group policy file that stops anyone on a workstation from auto-approving the riskiest action classes in the Bob IDE. IBM documents group policies for macOS (com.ibm.bob), Windows (Software\Policies\IBM\Bob) and Linux (/etc/bob/policy.json, root-owned), and lists DisabledAutoApprovalGroups among the notable policy keys; check the live group-policies page for exact syntax before you deploy, because key names and value formats are the sort of detail that changes between releases.

{
  "DisabledAutoApprovalGroups": ["edit", "execute", "mcp"],
  "UpdateMode": "manual"
}

Why these three groups? In January 2026, PromptArmor researchers showed that the beta Bob Shell could be tricked, through a malicious README and an "always allow" setting on echo, into chaining commands that ran without approval and downloaded malware (reported by The Register; IBM said it was unaware of the issue and pledged fixes before GA). The lesson that outlives the specific bug is that auto-approve is the attack surface. Locking edit, execute and mcp pushes every file change, shell command and MCP tool call back through a human, which on a workstation that can reach a client's Maximo repository or an MCP endpoint is the right default.

And here is the matching .bobignore idea for a Maximo working copy. IBM is explicit that .bobignore "does not create a system-level sandbox," so treat it as a convenience that keeps secrets out of context, not as a security boundary:

# .bobignore: keep credentials and environment config out of agent context
.env
*.jks
*.p12
maximo.properties
**/secrets/**

Part 3 explains where each of these controls stops, because "we have a policy file" and "we have an audit trail" are different claims. Part 2 documents the open question about what the SaaS activity log does and does not capture.

🧩 Part-by-Part Guide

Part 1: What IBM Bob Is — Project Bob to Self-Hosted

[Read Part 1 — What IBM Bob Is](/blog/mas-bob-01-what-is-ibm-bob) · 17 minutes

The product explained without the pitch. Bob started as an internal pilot, was unveiled at TechXchange on October 7, 2025, reached global GA on April 28, 2026, was rebuilt as V2 on June 24, 2026, and added self-hosted deployment in September. This part lays out the timeline with its date conflicts intact, the three-tier V2 design, the clients, the three modes, and the extensibility surface.

You learn: how Bob relates to watsonx Code Assistant and what IBM has (and has not) committed to for WCA customers; why V2 collapsed five modes into Agent, Plan and Ask; what skills, rules, AGENTS.md, hooks and plugins each do and where they live on disk; how bob run fits headless and CI use; and why IBM's own advice, "the plan is the review artifact," is the single best habit to carry into Maximo work. It also records the date discrepancy for self-hosted availability (release notes say September 24; the newsroom announcement is dated October 1) so you quote it correctly.

Part 2: Bob Models, Security, and Self-Hosted on OpenShift

[Read Part 2 — Models, Security, and Self-Hosted](/blog/mas-bob-02-models-security-self-hosted) · 19 minutes

What your security and platform teams will ask before anyone installs anything. SaaS Bob routes automatically and does not let users choose models; self-hosted Bob runs one core model behind a gateway. IBM states a zero-retention default for payloads and no training on customer data, while the product has no OS-level sandbox and no license filtering, and IP indemnity applies only to Enterprise.

You learn: how routing works on SaaS and what IBM does not disclose; the self-hosted model gateway, its reserved model slots and the recommended guardrail model; the three SaaS regions and the metadata that still lives in US East; the PromptArmor finding and the controls it argues for; the OpenShift versions, node topology and Bob Core footprint IBM publishes (and the GPU sizing it does not); and the documented GA limitations, including the unresolved conflict over audit logging on self-hosted deployments.

Part 3: Governing Bob — Admin Controls, Bobalytics, Audit, Pricing, and Bobcoins

[Read Part 3 — Governing Bob](/blog/mas-bob-03-governance-pricing-bobcoins) · 17 minutes

The administrator's view. Bobalytics reports adoption rate, "Bob factor" (the share of committed lines Bob authored) and Bobcoin spend. Activity logs cover authentication and admin events in CADF format, with Splunk forwarding arranged through an IBM support case. Plans run from a 30-day trial through Pro, Pro+, Ultra and Enterprise, all metered in Bobcoins.

You learn: how to read Bob factor without mistaking lines authored for value delivered; what the activity log does not tell you about agent actions, and how enforced hooks fill the gap; SSO and group-policy mechanics across macOS, Windows and Linux; the Bobcoin allowances and why IBM does not publish tokens per coin; what premium packages add; and a mapping of Bob's controls onto a CAB-style change process for AI-authored Maximo changes, including separation of duties between the person who prompts and the person who approves.

Part 4: Bob Meets Maximo — MAS 9.2 MCP, IBM Skills, Local Dev Mode, and TMG Tooling

[Read Part 4 — Bob Meets Maximo](/blog/mas-bob-04-bob-and-maximo) · 20 minutes

The part most readers came for. It opens with IBM's 69% claim and its missing method, then walks the MAS 9.2 native MCP server: tools generated from Manage, a polling refresh (default ten minutes), API key or JWT access through an OpenShift route, and actions that inherit Manage's authorization. It covers IBM's two Maximo skills, the MAF Local Dev Mode extension, and an independent consultant's hands-on evaluation.

You learn: which Maximo tasks are a high, medium or poor fit for an agent, in a table you can use in a planning meeting; how the maximo-java-conversion skill approaches Java MBO to automation-script conversion and why that work is testable; how to feed your autoscript standards to Bob through rules; why the community evaluation concluded that output quality tracks context quality; where TheMaximoGuys' agent-neutral tools (Max_Interfaces, Max_mcp, Max_autoscripts) fit next to IBM's native server; and the honest gap that no one has published a Bob-to-9.2-MCP production walkthrough yet.

Part 5: Piloting Bob on Maximo — Metrics, Competitors, and the Open Questions

[Read Part 5 — The Pilot Playbook](/blog/mas-bob-05-pilot-playbook) · 18 minutes (Series Finale)

The decision and measurement part. It sets IBM-reported customer results beside independent and practitioner views, places Bob among Copilot, Cursor, Claude Code and Kiro, and then turns everything into a pilot you can run.

You learn: why the same Blue Pearl result appears with two different baselines in IBM materials and what that teaches about reading case studies; the recurring independent criticisms (self-reported numbers, black-box model choice, no sandbox, dated legacy-language output, a weaker air-gapped model tier); an eight-point guide for Maximo teams; a pilot design that tracks defect escape rate, review hours and Bobcoins per completed task; and the open-questions list rewritten as a verification checklist to take to IBM before you sign anything.

🧭 Recommended Reading Paths

Maximo Developer / Technical Lead

"I would be the one using it on scripts and Java."
Read Part 1 → Part 4 → Part 5. Get the product model, then the Maximo-specific skills and MCP material, then the pilot design so your first experiment produces data instead of anecdotes.

Security / Platform Owner

"I have to approve it, and I will be the one explaining an incident."
Read Part 2 → Part 3 → Part 4. Start with data handling, models and the self-hosted trade-offs, then the controls, then the least-privilege MCP guidance.

IT Director / Decision Maker

"I own the budget and the vendor relationship."
Read Part 5 → Part 3 → Part 2. Start with what the evidence does and does not show, then the cost model and indemnity position, then the sovereignty options.

Consultancy / Partner Lead

"My people would use it on client code."
Read Part 3 → Part 2 → Part 5. The indemnity line (Enterprise only), client data residency, and an auditable change trail decide whether this is permissible at all.

💡 Key Themes Across the Series

IBM's numbers are directional marketing signals, not benchmarks. Across the product material you will meet 45%, 69%, 70%, "10x," "100% accuracy" and "30 days to 3 days." Each is IBM-reported or appears in an IBM-published customer story, and none has been independently audited. The series quotes them accurately, labels them, and then shows you how to produce comparable figures for your own work mix.

Plan, then act. IBM's own guidance says to start unfamiliar or high-surface-area work in Ask or Plan mode and switch to Agent only once the work is clear, and its blog states that "the code is the cheap part." For Maximo, a plan attached to a change record is the cheapest control you can add. The general version of this argument lives in the Enterprise Vibe Coding series; here it is applied to Manage customizations.

Review capacity is the real bottleneck. IBM's own Think content says that "review capacity becomes the limiting factor," and it cites a third-party report in which 85% of DevSecOps professionals say AI moved the bottleneck from writing code to reviewing it. A Maximo shop that generates ten times the scripts but reviews them at the same speed has not gained ten times anything. Part 5's pilot measures review hours for exactly this reason.

SaaS and self-hosted are different quality and control tiers. Self-hosted Bob gives you sovereignty and air-gapped operation. It also means one core model, no Bobalytics at GA, and no in-place upgrades, and IBM's own guidance says frontier models deliver the highest reasoning quality on complex legacy work. If your constraint forces self-hosted, plan for a pilot that measures the model you will actually run, not the one in the demo.

Context quality decides output quality. The one independent Maximo evaluation we found (a Sopra Steria consultant's tests on SQL, BIRT, application XML, log analysis and Java to Jython conversion) concluded that results depend heavily on the context you provide. That is why this series keeps returning to rules, AGENTS.md, standards files and accurate API catalogs: they are the cheapest quality lever you own.

🧰 How to Use This Series

Asked "should we adopt Bob?" and need an answer by Friday? Read the Bob-at-a-glance table above, then Part 5's eight-point guidance. Your honest answer is probably "run a scoped, measured pilot," and Part 5 tells you how.
Security review incoming? Part 2 for data handling, regions and the PromptArmor lessons; Part 3 for policy enforcement and audit scope. Bring the open-questions checklist.
Want a first technical experiment this week? Part 4's task-fit table points at Java MBO to automation-script conversion and autoscript review, the two cases with an IBM-authored skill and a testable outcome. Run them in a sandbox with a read-only API key.
Already using another agent? Skim Part 1 for Bob's distinctive mechanics, then use Parts 3 to 5 as a comparison frame. The governance and measurement guidance transfers.
Writing the business case? Do not cite the 69% figure without its label. Use Part 5's metrics design to collect your own number, and cite that.

🔮 What We Do Not Know Yet

An honest index lists its own gaps. These are the items our source base could not settle, and each is revisited in the parts noted:

Self-hosted availability date. IBM's September release notes say it was generally available as of September 24, 2026; the newsroom announcement is dated October 1 and does not use the phrase "GA." We use "GA per release notes September 24; announced October 1." (Part 1)
Audit logging on self-hosted deployments. IBM's September blog says the self-hosted offering includes audit logging and usage metering, while the solution-architecture documentation says those services are not included in the initial release. Resolve this with IBM before you promise anyone an audit trail. (Parts 2 and 3)
SaaS model versions and routing policy. IBM names model families, not versions, and does not show which model handled a task. (Part 2)
Tokens per Bobcoin and self-hosted pricing. Neither is published. (Part 3)
How the 69% was measured. One sentence, no method. (Part 4)
Bob calling the MAS 9.2 MCP server in production. No published end-to-end walkthrough exists that we could find, so treat it as a sandbox experiment. (Part 4)

We will update these as IBM documentation and community evidence change. If you find a primary-source answer to any of them, tell us and we will correct the series.

References

Start the Series

Begin with [Part 1 — What IBM Bob Is](/blog/mas-bob-01-what-is-ibm-bob), or jump to the part your role needs using the reading paths above. Want the tool-neutral concepts first? Start the companion [Enterprise Vibe Coding series](/blog/evc-00-series-index). Working on the Java estate Bob's conversion skill targets? Pair this with the [MAS Java Extensions series](/blog/mas-java-extensions-series-index).

About TheMaximoGuys: We help Maximo developers and teams navigate the move to MAS 9 with practical, no-hype guidance grounded in how the platform actually behaves.

Published by TheMaximoGuys | October 2026

IBM Bob for Maximo Teams: A Field Guide (Series Index)

TL;DR

Key Takeaways

MAS BOB Series