@blekline/[nhim](/docs/definitions/nhim)-audit maps agent candidate workloads that may reach models, sandboxes, or MCP tools without a mandatory enforcement hop. Security teams get a scored posture report; platform teams get a prioritized fix list before any sidecar rollout.
No Blekline account required for the static scan. Default profile is vendor-neutral (generic).
Run the audit
kubectl apply -f https://raw.githubusercontent.com/Blekline/blekline-oss/main/packages/nhim-audit/deploy/rbac/nhim-audit-reader-namespaced.yaml -n nhim-eval
kubectl apply -f https://raw.githubusercontent.com/Blekline/blekline-oss/main/packages/nhim-audit/deploy/rbac/nhim-audit-reader-cluster.yaml
npx @blekline/nhim-audit audit --profile generic --plain --json -o nhim-audit.json
Try fixtures locally (no kubeconfig):
npx @blekline/nhim-audit demo broken
npx @blekline/nhim-audit audit --fixture hostnetwork-broken --only-critical --plain
Upload [nhim](/docs/definitions/nhim)-audit.json to Operations → Posture. Reports include schemaVersion: "2.0", score.staticGateStatus, and assurance.notCertification.
Top rules (generic)
| ID | Severity | Summary |
|---|---|---|
| NHIM-001 | CRITICAL | No enforcement sidecar or inject annotation |
| NHIM-002 | CRITICAL | No mandatory-hop NetworkPolicy |
| NHIM-014 | CRITICAL | Wide HTTPS egress (0.0.0.0/0:443 bypass) |
| NHIM-019 | CRITICAL | Agent candidate uses hostNetwork |
| NHIM-003 | HIGH | Mutating admission for injection not detected |
Full rule reference: [NHIM Audit CLI](/docs/tools/nhim-audit).
CI merge gate
- uses: Blekline/blekline-oss/ci/github-actions/nhim-audit@main
with:
kubeconfig: ${{ secrets.KUBECONFIG }}
profile: generic
fail-on: high
min-score: "75"
output: nhim-audit.json
→ [CI NHIM gate](/docs/deploy/ci-nhim-gate) — SARIF export, exit codes, GitHub Actions integration
Probe verification
Active bypass checks require NHIM_PROBE_TOKEN (or BLEKLINE_EVAL_TOKEN) and --probe-allow-namespaces:
NHIM_PROBE_TOKEN=blw_eval_… npx @blekline/nhim-audit audit \
--probe \
--probe-allow-namespaces nhim-eval \
--profile generic \
--json -o nhim-audit-probed.json
Request token via Track 01 sandbox welcome pack.
Next steps
- Kubernetes fleet — Track 01 platform eval
- Docker sidecar — Track 02 VPC eval
- MCP self-serve — Track 03 IDE eval
- Compliance evidence — OWASP ASI artifacts
OSS package: [@blekline/nhim-audit@0.2.1 on npm](https://www.npmjs.com/package/@blekline/[nhim-audit](/docs/definitions/nhim-audit))