# NHIM Audit CLI

`@blekline/nhim-audit` scans Kubernetes clusters for **agent candidate workloads** that may bypass MCP/runtime enforcement hops.

```bash
npx @blekline/nhim-audit audit
```

No Blekline account required for static audit.

## Quick start

```bash
kubectl apply -f https://raw.githubusercontent.com/Blekline/blekline-oss/main/packages/nhim-audit/deploy/rbac/nhim-audit-reader.yaml
npx @blekline/nhim-audit audit --plain --json -o nhim-audit.json
```

Demo (fixture cluster, no kubeconfig):

```bash
npx @blekline/nhim-audit demo broken
```

## Rule reference

| ID | Severity | ASI | Summary |
|----|----------|-----|---------|
| NHIM-001 | CRITICAL | ASI02, ASI10 | No sidecar on agent candidate |
| NHIM-002 | CRITICAL | ASI10 | No mandatory-hop NetworkPolicy |
| NHIM-003 | HIGH | ASI08 | Admission webhook missing |
| NHIM-004 | HIGH | ASI08 | Webhook fail-open |
| NHIM-005 | HIGH | ASI03 | Sidecar externally exposed |
| NHIM-006 | MEDIUM | ASI02 | LLM env without sidecar |
| NHIM-007 | MEDIUM | ASI03 | Sidecar auth secret missing |
| NHIM-008 | MEDIUM | ASI10 | Policy gap on agent namespace |
| NHIM-009 | LOW | — | Helm release absent |
| NHIM-010 | INFO | ASI08 | Sidecar health unreachable (static) |
| NHIM-011 | MEDIUM | ASI10 | Shared default-allow egress |
| NHIM-012 | INFO | — | Shared responsibility reminder |

CRITICAL and HIGH static findings include *(STATIC — run `--probe` to verify)*.

## OWASP ASI alignment

**Evidence enablement only — not OWASP, AIUC-1, or EU AI Act certification.**

nhim-audit maps primarily to **OWASP ASI Top 10** (agentic applications), not OWASP LLM Top 10 (model-centric risks). See [Compliance evidence](/docs/enterprise/compliance-evidence).

## AIUC-1 and EU AI Act (context)

- **AIUC-1** — audit JSON supports security/accountability evidence collection in customer audits; nhim-audit is not AIUC-1 certified.
- **EU AI Act** — exported JSON may document controls for high-risk agent deployments; legal classification remains customer and counsel.
- **OWASP LLM Top 10** — out of scope (prompt injection into foundation models, training data risks).

## Score bands

| Score | Band | Meaning |
|-------|------|---------|
| 0–39 | CRITICAL | Mandatory hop not enforced |
| 40–69 | AT RISK | Partial enforcement |
| 70–89 | PARTIAL | Static clean — probe recommended |
| 90–100 | HARDENED | Static aligned |

JSON includes `score.redTeamPhase0`: `pass` | `fail` | `unknown`.

## CI integration (merge-blocking)

Copy [`ci/github-actions/nhim-audit`](https://github.com/Blekline/blekline-oss/tree/main/ci/github-actions/nhim-audit) or use inline:

```yaml
- uses: blekline/nhim-audit-action@v1
  with:
    kubeconfig: ${{ secrets.KUBECONFIG }}
    fail-on: high
    min-score: "75"
    output: nhim-audit.json
- uses: actions/upload-artifact@v4
  with:
    name: nhim-audit-report
    path: nhim-audit.json
```

**Flags:** `--fail-on critical|high|any` · `--min-score <n>` · `--baseline <path>` (fail only on new findings) · `-o` artifact path

**SARIF 2.1:**

```bash
npx @blekline/nhim-audit audit --format sarif -o nhim-audit.sarif
```

**Exit codes:** `0` pass · `1` fail / baseline regression · `2` RBAC or config · `3` cluster unreachable

Store kubeconfig in GitHub Secrets only — never commit reports with real cluster names if policy requires redaction.

## Probe access {#probe-access}

`--probe` runs active bypass checks (PROBE-001..003) and requires `BLEKLINE_EVAL_TOKEN`:

1. Run static audit and save JSON
2. Email `enterprise@blekline.com` with `nhim-audit.json` attached, or request via Track 03 sandbox grant
3. Receive `blw_eval_…` token (30-day eval scope, probe only — not a workspace token)

```bash
BLEKLINE_EVAL_TOKEN=blw_eval_… npx @blekline/nhim-audit audit --probe --json -o nhim-audit-probed.json
```

Online validation (optional): set `BLEKLINE_EVAL_ONLINE=1` to verify against the app validate endpoint.

## Enterprise / Track 03

Use nhim-audit as **Step 0** before sandbox eval. Design partners who attach `nhim-audit.json` receive a probe eval token in the Track 03 welcome pack. See [Kubernetes deployment](/docs/enterprise/k8s-deployment).

## FAQ

**False positives?** Heuristics flag *agent candidates* via labels, env keys, and images. Tune with `--label-selector`.

**Static vs probe?** Static infers architectural risk from RBAC-visible config. Probe verifies egress from inside candidate pods.

**RBAC denied?** Apply `nhim-audit-reader` ClusterRole from the OSS package. For `--probe`, also apply `nhim-audit-probe` (grants `pods/exec`).

**JSON redaction?** Reports include env key **names** in `discovery.signals[]` only — never secret values or eval tokens.

## Related

- [NHIM overview](/docs/introduction/nhim)
- [Compliance evidence](/docs/enterprise/compliance-evidence)
- [K8s deployment](/docs/enterprise/k8s-deployment)

**Disclaimer:** Evidence enablement only — not certification.