Blekline | Non-Human Identity & Runtime Enforcement

Blekline is Non-Human Identity & Runtime Enforcement (NHIM) infrastructure: a control plane for what autonomous agents send, execute, and expose at the agent boundary — prompts, model APIs, MCP tool calls, and sidecar hops.

Security teams get enforceable policy and reproducible evidence. Engineering teams get npm packages, MCP tools, and sidecar deploy paths that ship in days.

Three boundaries, one control plane

Boundary	What Blekline governs	Primary surfaces
Ingress (Trust Vault)	Secrets and PII in prompts and tool arguments before models reason	MCP proxy, SDK `/api/mask`, ingress sidecar
Execution (Lineage Firewall)	Multi-turn session lineage; block destructive tools after prompt injection	Sidecar enforce, `/api/mcp/enforce-tool-call`
Egress & audit	Response redaction and metadata-only trails for SIEM	Activity log, CSV export, Splunk/Datadog webhooks

Each interaction returns an allow · mask · block decision with counts and tool names — not just a post-hoc alert.

Capabilities at a glance

Stateful tokenization — replace PII and secrets with placeholders; hydrate in your VPC on approved calls
Tool-call enforcement — evaluate every downstream MCP call against workspace policy before execution
Lineage block — halt hijacked sessions when prompt injection contaminates multi-turn context
Open-core wedge — @blekline/mcp-server, @blekline/mcp-proxy, SDK, and NHIM audit CLI on GitHub
Production sidecar — Trust Vault + Lineage on ghcr.io/blekline/sidecar for Kubernetes and Docker eval tracks
Fleet policy — push policy updates over SSE without redeploying every agent pod

Where to start

You are…	Go here
Evaluating Blekline	[Eval journey](/docs/get-started/eval-journey)
Developer / integrator	MCP server · TypeScript SDK · Runtime simulator
Security architect	Trust boundaries · Threat model
Compliance	EU AI Act mapping · Compliance evidence
Glossary	Definitions

Deep dive: NHIM overview · Architecture

Next: Eval journey · NHIM audit quickstart · Quick start