@blekline/[nhim](/docs/definitions/nhim)-audit scans Kubernetes clusters for agent candidate workloads that may bypass MCP/runtime enforcement hops. Use this as Step 0 before Track 03 sandbox eval.
No Blekline account required for static audit.
Run the audit
kubectl apply -f https://raw.githubusercontent.com/Blekline/blekline-oss/main/packages/nhim-audit/deploy/rbac/nhim-audit-reader.yaml
npx @blekline/nhim-audit audit --plain --json -o nhim-audit.json
Try a broken fixture (no kubeconfig):
npx @blekline/nhim-audit demo broken
Read the score
| Score | Band | Meaning |
|---|---|---|
| 0–39 | CRITICAL | Mandatory hop not enforced |
| 40–69 | AT RISK | Partial enforcement |
| 70–89 | PARTIAL | Static clean — probe recommended |
| 90–100 | HARDENED | Static aligned |
Upload [nhim](/docs/definitions/nhim)-audit.json to Operations → Posture or attach it to your enterprise sandbox request.
Top rules (static)
| ID | Severity | Summary |
|---|---|---|
| NHIM-001 | CRITICAL | No sidecar on agent candidate |
| NHIM-002 | CRITICAL | No mandatory-hop NetworkPolicy |
| NHIM-003 | HIGH | Admission webhook missing |
| NHIM-004 | HIGH | Webhook fail-open |
| NHIM-005 | HIGH | Sidecar externally exposed |
Full rule reference: [NHIM Audit CLI](/docs/tools/nhim-audit).
CI merge gate
Fail PRs when posture regresses:
- uses: blekline/nhim-audit-action@v1
with:
kubeconfig: ${{ secrets.KUBECONFIG }}
fail-on: high
min-score: "75"
output: nhim-audit.json
See [CI NHIM gate](/docs/deploy/ci-nhim-gate) for flags, SARIF export, and exit codes.
Probe verification (optional)
Active bypass checks require a probe eval token (blw_eval_…):
- Run static audit and save JSON
- Email
enterprise@blekline.comwith[nhim-audit](/docs/definitions/nhim-audit).json, or request via Track 03 sandbox grant - Run with
--probe:
BLEKLINE_EVAL_TOKEN=blw_eval_… npx @blekline/nhim-audit audit --probe --json -o nhim-audit-probed.json
Next steps
- [Eval journey](/docs/get-started/eval-journey) — pick Track 02 or Track 03
- Kubernetes fleet — Helm sidecar + mandatory hop
- Compliance evidence — OWASP ASI and audit artifacts
Disclaimer: Evidence enablement only — not certification.