@blekline/[nhim](/docs/definitions/nhim)-audit scans Kubernetes clusters for agent candidate workloads that may bypass MCP/runtime enforcement hops.
Default profile is vendor-neutral (generic). Blekline-specific checks run under --profile blekline.
npx @blekline/nhim-audit audit --profile generic
No Blekline account required for static audit.
Quick start
# Namespaced RBAC (recommended)
kubectl apply -f https://raw.githubusercontent.com/Blekline/blekline-oss/main/packages/nhim-audit/deploy/rbac/nhim-audit-reader-namespaced.yaml -n nhim-eval
kubectl apply -f https://raw.githubusercontent.com/Blekline/blekline-oss/main/packages/nhim-audit/deploy/rbac/nhim-audit-reader-cluster.yaml
npx @blekline/nhim-audit audit --profile generic --plain --json -o nhim-audit.json
Demo (fixture cluster, no kubeconfig):
npx @blekline/nhim-audit demo broken
npx @blekline/nhim-audit audit --fixture hostnetwork-broken --only-critical --plain
Profiles
| Profile | Use |
|---|---|
generic (default) | Vendor-neutral NHIM-001..019 — Istio/Linkerd/generic sidecar patterns |
blekline | Adds BLEK-001..005 (Helm, Blekline webhook, Auto-Route) |
Org overrides: --config [nhim-audit](/docs/definitions/nhim-audit).example.json in the OSS package.
Rule reference (generic)
| ID | Severity | ASI | Summary |
|---|---|---|---|
| NHIM-001 | CRITICAL | ASI02, ASI10 | No enforcement sidecar or inject annotation |
| NHIM-002 | CRITICAL | ASI10 | No mandatory-hop NetworkPolicy |
| NHIM-003 | HIGH | ASI08 | Mutating admission for injection not detected |
| NHIM-004 | HIGH | ASI08 | Enforcement webhook fail-open |
| NHIM-005 | HIGH | ASI03 | Enforcement plane externally exposed |
| NHIM-006 | MEDIUM | ASI02 | LLM credentials without enforcement hop |
| NHIM-007 | MEDIUM | ASI03 | Enforcement auth secret missing |
| NHIM-008 | MEDIUM | ASI10 | Policy engine not detected |
| NHIM-011 | MEDIUM | ASI10 | Shared default-allow egress |
| NHIM-013 | MEDIUM | ASI10 | No agent candidates discovered |
| NHIM-014 | CRITICAL | ASI10 | Wide HTTPS egress (0.0.0.0/0:443 bypass) |
| NHIM-015 | MEDIUM | ASI02 | Inject enabled but auto-route disabled |
| NHIM-016 | MEDIUM | ASI02 | LLM config via envFrom only |
| NHIM-017 | MEDIUM | ASI02 | Sidecar present but LLM upstream env missing |
| NHIM-018 | HIGH | ASI10 | iptables auto-route without sidecar |
| NHIM-019 | CRITICAL | ASI10 | Agent candidate uses hostNetwork |
Blekline-only: BLEK-001..005 under --profile blekline.
CRITICAL and HIGH static findings include (STATIC — run --probe to verify).
JSON schema 2.0
Reports include:
{
"schemaVersion": "2.0",
"profile": "generic",
"assurance": {
"notCertification": true,
"staticOnly": true,
"probeExecuted": false,
"limitations": ["..."]
},
"score": {
"staticGateStatus": "unknown"
}
}
score.staticGateStatus: pass | fail | unknown — generic profile stays unknown until --probe runs. Legacy score.redTeamPhase0 mirrors this field for 0.1.x readers.
Auto-Route alignment
Auto-Route mode (three enforcement tiers)
When the mutating admission webhook injects blekline-sidecar, it also rewrites SDK env vars on agent containers so OpenAI / Anthropic clients route through http://127.0.0.1:8787 automatically.
| Tier | Mechanism | Code change? |
|---|---|---|
| 1 — Auto-Route | Webhook env inject → sidecar masks LLM ingress/egress | No (OpenAI/Anthropic SDK) |
| 1b — iptables Auto-Route | Init container redirects HTTPS without env vars | No (Phase 2 — annotate blekline.com/auto-route: iptables) |
| 2 — Mandatory hop | NetworkPolicy → agent egress only via sidecar | No (network) |
| 3 — Tool enforce | POST /v1/enforce-tool-call or @blekline/mcp-proxy | Yes* (MCP tool argument policy) |
* Tier 3 is required for MCP tool argument policy (ASI02). Auto-Route covers model API paths only.
Injected env vars (Tier 1)
| Env var | Value |
|---|---|
BLEKLINE_AUTO_ROUTE | true |
BLEKLINE_SIDECAR_URL | http://127.0.0.1:8787 |
OPENAI_BASE_URL | http://127.0.0.1:8787/v1 |
OPENAI_API_BASE | http://127.0.0.1:8787/v1 |
ANTHROPIC_BASE_URL | http://127.0.0.1:8787 |
Opt-out per pod: blekline.com/auto-route: disabled
Roadmap dataplane (not default shipped)
- iptables init redirect — transparent HTTPS redirect without env vars (Tier 1b, Phase 2)
- eBPF / Cilium — optional dataplane integration for platform teams (Phase 3)
See enterprise sandbox AUTO_ROUTE.md for operator install paths.
OWASP ASI alignment
Evidence enablement only — not OWASP, AIUC-1, or EU AI Act certification.
nhim-audit maps primarily to OWASP ASI Top 10 (agentic applications), not OWASP LLM Top 10 (model-centric risks). See Compliance evidence.
Score bands
| Score | Band | Meaning |
|---|---|---|
| 0–39 | CRITICAL | Mandatory hop not enforced |
| 40–69 | AT RISK | Partial enforcement |
| 70–89 | PARTIAL | Static clean — probe recommended |
| 90–100 | HARDENED | Static aligned |
CI integration (merge-blocking)
- uses: Blekline/blekline-oss/ci/github-actions/nhim-audit@main
with:
kubeconfig: ${{ secrets.KUBECONFIG }}
profile: generic
fail-on: high
min-score: "75"
output: nhim-audit.json
Flags: --profile generic|blekline · --fail-on critical|high|any · --min-score <n> · --baseline <path> · --probe-allow-namespaces (required with --probe)
SARIF 2.1:
npx @blekline/nhim-audit audit --format sarif -o nhim-audit.sarif
Exit codes: 0 pass · 1 fail / baseline regression · 2 RBAC or config · 3 cluster unreachable
Probe access {#probe-access}
--probe runs active bypass checks and requires NHIM_PROBE_TOKEN (or BLEKLINE_EVAL_TOKEN):
BLEKLINE_EVAL_ONLINE=1 \
NHIM_PROBE_TOKEN=blw_eval_… npx @blekline/nhim-audit audit \
--probe \
--probe-allow-namespaces nhim-eval \
--profile generic \
--json -o nhim-audit-probed.json
Self-serve eval: upload nhim-audit JSON to Deployment hub, then click Issue probe token (workspace owner or admin). The token is shown once — store it in a secret manager or GitHub Actions secret.
Enterprise sandbox: paid Track 01 partners may receive a pre-issued token via the welcome pack (distinct from self-serve eval tokens).
Online validation: set BLEKLINE_EVAL_ONLINE=1 so nhim-audit confirms the token against Blekline before probing. Reports include assurance.probeTokenValidatedOnline: true when online validation succeeds.
Enterprise / Track 01
Use nhim-audit as Step 0 before sandbox eval. Upload JSON to Posture — the app reads schemaVersion, staticGateStatus, and assurance.limitations.
FAQ
False positives? Heuristics flag agent candidates. Tune with --label-selector or --config.
Static vs probe? Static infers architectural risk. Probe verifies egress from inside candidate pods.
RBAC denied? Apply namespaced reader + minimal cluster reader from OSS. For --probe, apply nhim-audit-probe-namespaced.yaml.
Related
Disclaimer: Evidence enablement only — not certification.