# NHIM audit quickstart

`@blekline/nhim-audit` scans Kubernetes clusters for **agent candidate workloads** that may bypass MCP/runtime enforcement hops. Use this as **Step 0** before Track 03 sandbox eval.

No Blekline account required for static audit.

## Run the audit

```bash
kubectl apply -f https://raw.githubusercontent.com/Blekline/blekline-oss/main/packages/nhim-audit/deploy/rbac/nhim-audit-reader.yaml
npx @blekline/nhim-audit audit --plain --json -o nhim-audit.json
```

Try a broken fixture (no kubeconfig):

```bash
npx @blekline/nhim-audit demo broken
```

## Read the score

| Score | Band | Meaning |
|-------|------|---------|
| 0–39 | CRITICAL | Mandatory hop not enforced |
| 40–69 | AT RISK | Partial enforcement |
| 70–89 | PARTIAL | Static clean — probe recommended |
| 90–100 | HARDENED | Static aligned |

Upload `nhim-audit.json` to **Operations → Posture** or attach it to your enterprise sandbox request.

## Top rules (static)

| ID | Severity | Summary |
|----|----------|---------|
| NHIM-001 | CRITICAL | No sidecar on agent candidate |
| NHIM-002 | CRITICAL | No mandatory-hop NetworkPolicy |
| NHIM-003 | HIGH | Admission webhook missing |
| NHIM-004 | HIGH | Webhook fail-open |
| NHIM-005 | HIGH | Sidecar externally exposed |

Full rule reference: [NHIM Audit CLI](/docs/tools/nhim-audit).

## CI merge gate

Fail PRs when posture regresses:

```yaml
- uses: blekline/nhim-audit-action@v1
  with:
    kubeconfig: ${{ secrets.KUBECONFIG }}
    fail-on: high
    min-score: "75"
    output: nhim-audit.json
```

See [CI NHIM gate](/docs/deploy/ci-nhim-gate) for flags, SARIF export, and exit codes.

## Probe verification (optional)

Active bypass checks require a probe eval token (`blw_eval_…`):

1. Run static audit and save JSON
2. Email `enterprise@blekline.com` with `nhim-audit.json`, or request via Track 03 sandbox grant
3. Run with `--probe`:

```bash
BLEKLINE_EVAL_TOKEN=blw_eval_… npx @blekline/nhim-audit audit --probe --json -o nhim-audit-probed.json
```

## Next steps

- [Eval journey](/docs/get-started/eval-journey) — pick Track 02 or Track 03
- [Kubernetes fleet](/docs/deploy/k8s-fleet) — Helm sidecar + mandatory hop
- [Compliance evidence](/docs/enterprise/compliance-evidence) — OWASP ASI and audit artifacts

**Disclaimer:** Evidence enablement only — not certification.