{"_id":"@blekline/nhim-audit","_rev":"7-91fdea77678af70b30b1284342e3d2c3","name":"@blekline/nhim-audit","dist-tags":{"latest":"0.2.2"},"versions":{"0.1.0":{"name":"@blekline/nhim-audit","version":"0.1.0","license":"AGPL-3.0-or-later","_id":"@blekline/nhim-audit@0.1.0","maintainers":[{"name":"tinemaher","email":"dev@blekline.com"}],"homepage":"https://github.com/Blekline/blekline-oss#readme","bugs":{"url":"https://github.com/Blekline/blekline-oss/issues"},"bin":{"nhim-audit":"dist/cli.js"},"dist":{"shasum":"f81eb87b256a149986e96de20e1397725fded0ef","tarball":"https://registry.npmjs.org/@blekline/nhim-audit/-/nhim-audit-0.1.0.tgz","fileCount":53,"integrity":"sha512-cbf3ZvNBen4Ddy0ATl1tivqdDygKpCBzSlAre9m8ArWaaIdAbkPSlp9aNSOiEu0I7yWt9ESWG/HN+k1wDyEotw==","signatures":[{"sig":"MEUCIQDN/X7MYsta2rkFHQZGpDn5Nd7dwHNuMvdDUmw3J3Z8yQIgPAj91KIMEQpVPtSQQBKZb9P7bEfGHXCtOelKVCkt3jY=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@blekline%2fnhim-audit@0.1.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":92578},"main":"./dist/index.js","type":"module","_from":"file:blekline-nhim-audit-0.1.0.tgz","types":"./dist/index.d.ts","engines":{"node":">=20"},"private":false,"scripts":{"test":"node --test dist/**/*.test.js","build":"tsc","typecheck":"tsc --noEmit"},"_npmUser":{"name":"tinemaher","email":"dev@blekline.com"},"_resolved":"/tmp/5ac8e26c2d31f2b21e761b22b72279a9/blekline-nhim-audit-0.1.0.tgz","_integrity":"sha512-cbf3ZvNBen4Ddy0ATl1tivqdDygKpCBzSlAre9m8ArWaaIdAbkPSlp9aNSOiEu0I7yWt9ESWG/HN+k1wDyEotw==","repository":{"url":"git+https://github.com/Blekline/blekline-oss.git","type":"git","directory":"packages/nhim-audit"},"_npmVersion":"10.9.8","description":"Static Kubernetes audit for agent candidate workloads that may bypass MCP/runtime enforcement hops","directories":{},"_nodeVersion":"22.23.1","dependencies":{"ora":"^8.2.0","chalk":"^5.4.1","commander":"^13.1.0","@kubernetes/client-node":"^1.0.0"},"publishConfig":{"access":"public","provenance":true},"_hasShrinkwrap":false,"devDependencies":{"typescript":"^5.7.3","@types/node":"^20"},"_npmOperationalInternal":{"tmp":"tmp/nhim-audit_0.1.0_1785248435025_0.970157081134509","host":"s3://npm-registry-packages-npm-production"}},"0.1.1":{"name":"@blekline/nhim-audit","version":"0.1.1","license":"AGPL-3.0-or-later","_id":"@blekline/nhim-audit@0.1.1","maintainers":[{"name":"tinemaher","email":"dev@blekline.com"}],"homepage":"https://github.com/Blekline/blekline-oss#readme","bugs":{"url":"https://github.com/Blekline/blekline-oss/issues"},"bin":{"nhim-audit":"dist/cli.js"},"dist":{"shasum":"a05eb069acdfcb1a135a57df332ae197008ab99f","tarball":"https://registry.npmjs.org/@blekline/nhim-audit/-/nhim-audit-0.1.1.tgz","fileCount":57,"integrity":"sha512-yVPDi0ox2zfkm0PuUzDFFqJDyMiAwJTvO/p1IkesAvH3ZvzeIGlIXIWgE7twLT+kHtdJcxCVRZEaN7tX3IR7YQ==","signatures":[{"sig":"MEUCIA3LZB2jD6KQO5rWrKuvoNz1JOt9LVU0f5oEcJXcv0SAAiEAm8eyVhjSexn29ArzbxlQ1QBvsBJbw5o5NMbYBR8ihNU=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@blekline%2fnhim-audit@0.1.1","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":97908},"main":"./dist/index.js","type":"module","_from":"file:blekline-nhim-audit-0.1.1.tgz","types":"./dist/index.d.ts","engines":{"node":">=20"},"private":false,"scripts":{"test":"node --test dist/nhim-audit.test.js","build":"tsc","typecheck":"tsc --noEmit"},"_npmUser":{"name":"tinemaher","email":"dev@blekline.com"},"_resolved":"/tmp/6a2f964ddcfaec825015dea9075dce9d/blekline-nhim-audit-0.1.1.tgz","_integrity":"sha512-yVPDi0ox2zfkm0PuUzDFFqJDyMiAwJTvO/p1IkesAvH3ZvzeIGlIXIWgE7twLT+kHtdJcxCVRZEaN7tX3IR7YQ==","repository":{"url":"git+https://github.com/Blekline/blekline-oss.git","type":"git","directory":"packages/nhim-audit"},"_npmVersion":"10.9.8","description":"Static Kubernetes audit for agent candidate workloads that may bypass MCP/runtime enforcement hops","directories":{},"_nodeVersion":"22.23.1","dependencies":{"ora":"^8.2.0","chalk":"^5.4.1","commander":"^13.1.0","@kubernetes/client-node":"^1.0.0"},"publishConfig":{"access":"public","provenance":true},"_hasShrinkwrap":false,"devDependencies":{"typescript":"^5.7.3","@types/node":"^20"},"_npmOperationalInternal":{"tmp":"tmp/nhim-audit_0.1.1_1785339731509_0.03733371624728776","host":"s3://npm-registry-packages-npm-production"}},"0.1.2":{"name":"@blekline/nhim-audit","version":"0.1.2","license":"AGPL-3.0-or-later","_id":"@blekline/nhim-audit@0.1.2","maintainers":[{"name":"tinemaher","email":"dev@blekline.com"}],"homepage":"https://github.com/Blekline/blekline-oss#readme","bugs":{"url":"https://github.com/Blekline/blekline-oss/issues"},"bin":{"nhim-audit":"dist/cli.js"},"dist":{"shasum":"cd17ee4303a23ff43e6bbbf0c0ed72fdfcc45198","tarball":"https://registry.npmjs.org/@blekline/nhim-audit/-/nhim-audit-0.1.2.tgz","fileCount":60,"integrity":"sha512-G6RPQrvhSRTEK37Pl5vFy5N9MyAjGysEUsuTHwh5KOY6fKAPvksJ6eOiNzrXOP1i7UAClLjEweBeave7naLrmw==","signatures":[{"sig":"MEYCIQC7ZW5sPhYt3uLRf9r0VH79yC5I4UQV23H5ebUgibnIOwIhAOEkjSZVryUU88HCX5U06lLvFQcuBb+iAZt3Lm9qCXot","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@blekline%2fnhim-audit@0.1.2","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":103742},"main":"./dist/index.js","type":"module","_from":"file:blekline-nhim-audit-0.1.2.tgz","types":"./dist/index.d.ts","engines":{"node":">=20"},"private":false,"scripts":{"test":"node --test dist/nhim-audit.test.js","build":"tsc","typecheck":"tsc --noEmit"},"_npmUser":{"name":"tinemaher","email":"dev@blekline.com"},"_resolved":"/tmp/ca226791eb5d71b61c249f531e2ba8c0/blekline-nhim-audit-0.1.2.tgz","_integrity":"sha512-G6RPQrvhSRTEK37Pl5vFy5N9MyAjGysEUsuTHwh5KOY6fKAPvksJ6eOiNzrXOP1i7UAClLjEweBeave7naLrmw==","repository":{"url":"git+https://github.com/Blekline/blekline-oss.git","type":"git","directory":"packages/nhim-audit"},"_npmVersion":"10.9.8","description":"Static Kubernetes audit for agent candidate workloads that may bypass MCP/runtime enforcement hops","directories":{},"_nodeVersion":"22.23.1","dependencies":{"ora":"^8.2.0","chalk":"^5.4.1","commander":"^13.1.0","@kubernetes/client-node":"^1.0.0"},"publishConfig":{"access":"public","provenance":true},"_hasShrinkwrap":false,"devDependencies":{"typescript":"^5.7.3","@types/node":"^20"},"_npmOperationalInternal":{"tmp":"tmp/nhim-audit_0.1.2_1785495243064_0.5352243459022341","host":"s3://npm-registry-packages-npm-production"}},"0.1.3":{"name":"@blekline/nhim-audit","version":"0.1.3","license":"AGPL-3.0-or-later","_id":"@blekline/nhim-audit@0.1.3","maintainers":[{"name":"tinemaher","email":"dev@blekline.com"}],"homepage":"https://github.com/Blekline/blekline-oss#readme","bugs":{"url":"https://github.com/Blekline/blekline-oss/issues"},"bin":{"nhim-audit":"dist/cli.js"},"dist":{"shasum":"09bd1eb7f0c0abcb7c0839d868f6f1ed6fca6c21","tarball":"https://registry.npmjs.org/@blekline/nhim-audit/-/nhim-audit-0.1.3.tgz","fileCount":61,"integrity":"sha512-N3XgBN+QR7mPfkbf+bYJx9WNVezT677UdkZJLb/V9fP9yEdLNGAqMvuEEeP4OzXxxFtamqabrSEtXUGZTVHHLg==","signatures":[{"sig":"MEUCIQDK3XKXlSuM91B1nijhk5smg+GOlFfFv12xdH+vEWcUtgIgU6O/kMn2WQGWEpnDt974Ppv0LWp4gRk9B1DCzF3N/3s=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@blekline%2fnhim-audit@0.1.3","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":114450},"main":"./dist/index.js","type":"module","_from":"file:blekline-nhim-audit-0.1.3.tgz","types":"./dist/index.d.ts","engines":{"node":">=20"},"private":false,"scripts":{"test":"node --test dist/nhim-audit.test.js","build":"tsc","typecheck":"tsc --noEmit"},"_npmUser":{"name":"tinemaher","email":"dev@blekline.com"},"_resolved":"/tmp/94459e372c68fbaa95bb2f7521dc44da/blekline-nhim-audit-0.1.3.tgz","_integrity":"sha512-N3XgBN+QR7mPfkbf+bYJx9WNVezT677UdkZJLb/V9fP9yEdLNGAqMvuEEeP4OzXxxFtamqabrSEtXUGZTVHHLg==","repository":{"url":"git+https://github.com/Blekline/blekline-oss.git","type":"git","directory":"packages/nhim-audit"},"_npmVersion":"10.9.8","description":"Static Kubernetes audit for agent candidate workloads that may bypass MCP/runtime enforcement hops","directories":{},"_nodeVersion":"22.23.1","dependencies":{"ora":"^8.2.0","chalk":"^5.4.1","commander":"^13.1.0","@kubernetes/client-node":"^1.0.0"},"publishConfig":{"access":"public","provenance":true},"_hasShrinkwrap":false,"devDependencies":{"typescript":"^5.7.3","@types/node":"^20"},"_npmOperationalInternal":{"tmp":"tmp/nhim-audit_0.1.3_1785935549263_0.5729769674990557","host":"s3://npm-registry-packages-npm-production"}},"0.2.0":{"name":"@blekline/nhim-audit","version":"0.2.0","license":"AGPL-3.0-or-later","_id":"@blekline/nhim-audit@0.2.0","maintainers":[{"name":"tinemaher","email":"dev@blekline.com"}],"homepage":"https://github.com/Blekline/blekline-oss#readme","bugs":{"url":"https://github.com/Blekline/blekline-oss/issues"},"bin":{"nhim-audit":"dist/cli.js"},"dist":{"shasum":"07d4a88e56cd62f82e286f68d437a993dd51f355","tarball":"https://registry.npmjs.org/@blekline/nhim-audit/-/nhim-audit-0.2.0.tgz","fileCount":92,"integrity":"sha512-PDgpZ/mpYYUXEcLvgp31ACyietXxJ7nIStQN2j7UVj8+x7l+1ZV1JivYlijR7W2PB7eGzXp64LQZpi50yGbVUw==","signatures":[{"sig":"MEYCIQCTYWyGrAKccWEkuUtuG2CduPEJqBZaXUJElYzIP1Cs9QIhAP61QftfOtvZYDZqqoEYXPuN9v9Pdi4tLR48OAiJfuOo","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@blekline%2fnhim-audit@0.2.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":176516},"main":"./dist/index.js","type":"module","_from":"file:blekline-nhim-audit-0.2.0.tgz","types":"./dist/index.d.ts","engines":{"node":">=20"},"private":false,"scripts":{"test":"node --test dist/nhim-audit.test.js","build":"tsc","typecheck":"tsc --noEmit"},"_npmUser":{"name":"tinemaher","email":"dev@blekline.com"},"_resolved":"/tmp/efdb3621929f86f80e62ca2234f3cb80/blekline-nhim-audit-0.2.0.tgz","_integrity":"sha512-PDgpZ/mpYYUXEcLvgp31ACyietXxJ7nIStQN2j7UVj8+x7l+1ZV1JivYlijR7W2PB7eGzXp64LQZpi50yGbVUw==","repository":{"url":"git+https://github.com/Blekline/blekline-oss.git","type":"git","directory":"packages/nhim-audit"},"_npmVersion":"10.9.8","description":"Static Kubernetes audit for agent candidate workloads that may bypass MCP/runtime enforcement hops","directories":{},"_nodeVersion":"22.23.1","dependencies":{"ora":"^8.2.0","chalk":"^5.4.1","commander":"^13.1.0","@kubernetes/client-node":"^1.0.0"},"publishConfig":{"access":"public","provenance":true},"_hasShrinkwrap":false,"devDependencies":{"typescript":"^5.7.3","@types/node":"^20"},"_npmOperationalInternal":{"tmp":"tmp/nhim-audit_0.2.0_1785940926131_0.026958797846395655","host":"s3://npm-registry-packages-npm-production"}},"0.2.1":{"name":"@blekline/nhim-audit","version":"0.2.1","license":"AGPL-3.0-or-later","_id":"@blekline/nhim-audit@0.2.1","maintainers":[{"name":"tinemaher","email":"dev@blekline.com"}],"homepage":"https://github.com/Blekline/blekline-oss#readme","bugs":{"url":"https://github.com/Blekline/blekline-oss/issues"},"bin":{"nhim-audit":"dist/cli.js"},"dist":{"shasum":"fd073b4a6e038cfaa8f38e944f578e0752943485","tarball":"https://registry.npmjs.org/@blekline/nhim-audit/-/nhim-audit-0.2.1.tgz","fileCount":92,"integrity":"sha512-zPpO8VVgYX9tHSuisqE45T1Yd+iRBVQtSLRvhO2Hv0Q7bmifUANjvOgBcr1xL5aVFXRNLgFOUEjgGLUmd4h+VQ==","signatures":[{"sig":"MEYCIQDwwt61HOa/b0Rw/ZF/IUIEgxc3w1A7xFot2x7RtBeJ2wIhAITXUdDvfX9pYxKI4PlOSGFZid/yvk1N1U8KLVYSSzKH","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@blekline%2fnhim-audit@0.2.1","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":176775},"main":"./dist/index.js","type":"module","_from":"file:blekline-nhim-audit-0.2.1.tgz","types":"./dist/index.d.ts","engines":{"node":">=20"},"private":false,"scripts":{"test":"node --test dist/nhim-audit.test.js","build":"tsc","typecheck":"tsc --noEmit"},"_npmUser":{"name":"tinemaher","email":"dev@blekline.com"},"_resolved":"/tmp/2a3651a712a8198f44ec5d2a71ba24e6/blekline-nhim-audit-0.2.1.tgz","_integrity":"sha512-zPpO8VVgYX9tHSuisqE45T1Yd+iRBVQtSLRvhO2Hv0Q7bmifUANjvOgBcr1xL5aVFXRNLgFOUEjgGLUmd4h+VQ==","repository":{"url":"git+https://github.com/Blekline/blekline-oss.git","type":"git","directory":"packages/nhim-audit"},"_npmVersion":"10.9.8","description":"Static Kubernetes audit for agent candidate workloads that may bypass MCP/runtime enforcement hops","directories":{},"_nodeVersion":"22.23.1","dependencies":{"ora":"^8.2.0","chalk":"^5.4.1","commander":"^13.1.0","@kubernetes/client-node":"^1.0.0"},"publishConfig":{"access":"public","provenance":true},"_hasShrinkwrap":false,"devDependencies":{"typescript":"^5.7.3","@types/node":"^20"},"_npmOperationalInternal":{"tmp":"tmp/nhim-audit_0.2.1_1785942337452_0.666778920243208","host":"s3://npm-registry-packages-npm-production"}},"0.2.2":{"name":"@blekline/nhim-audit","version":"0.2.2","description":"Static Kubernetes audit for agent candidate workloads that may bypass MCP/runtime enforcement hops","license":"AGPL-3.0-or-later","private":false,"type":"module","repository":{"type":"git","url":"git+https://github.com/Blekline/blekline-oss.git","directory":"packages/nhim-audit"},"publishConfig":{"access":"public","provenance":true},"engines":{"node":">=20"},"bin":{"nhim-audit":"dist/cli.js"},"main":"./dist/index.js","types":"./dist/index.d.ts","dependencies":{"@kubernetes/client-node":"^1.0.0","chalk":"^5.4.1","commander":"^13.1.0","ora":"^8.2.0"},"devDependencies":{"@types/node":"^20","typescript":"^5.7.3"},"scripts":{"build":"tsc","typecheck":"tsc --noEmit","test":"node --test dist/nhim-audit.test.js"},"_id":"@blekline/nhim-audit@0.2.2","bugs":{"url":"https://github.com/Blekline/blekline-oss/issues"},"homepage":"https://github.com/Blekline/blekline-oss#readme","_integrity":"sha512-0USHRV6jJ5nrqhqWMPz639TV1u+rVB1GrgjtPE/8ixHY9E67h1UFwreqW2fcuwrqrl1IP/a+PgV4wqJvCSNVAw==","_resolved":"/tmp/76b6e01c5b6234133c6e0b9cb1698c58/blekline-nhim-audit-0.2.2.tgz","_from":"file:blekline-nhim-audit-0.2.2.tgz","_nodeVersion":"22.23.2","_npmVersion":"10.9.8","dist":{"integrity":"sha512-0USHRV6jJ5nrqhqWMPz639TV1u+rVB1GrgjtPE/8ixHY9E67h1UFwreqW2fcuwrqrl1IP/a+PgV4wqJvCSNVAw==","shasum":"e1e1429847ff8cb93b4943d9ce6eaddf31e97462","tarball":"https://registry.npmjs.org/@blekline/nhim-audit/-/nhim-audit-0.2.2.tgz","fileCount":92,"unpackedSize":179201,"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@blekline%2fnhim-audit@0.2.2","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQCm6/WrzN/hUI8590mBS28YYf0yWeWTlHZfnIudCC3pOAIgP0CEj4xGN9KY8WihnGWy5qeYxtB2rjnMvygS7StZO9k="}]},"_npmUser":{"name":"tinemaher","email":"dev@blekline.com"},"directories":{},"maintainers":[{"name":"tinemaher","email":"dev@blekline.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/nhim-audit_0.2.2_1787133438447_0.274943828263142"},"_hasShrinkwrap":false}},"time":{"created":"2026-07-28T14:20:34.870Z","modified":"2026-08-19T09:57:18.958Z","0.1.0":"2026-07-28T14:20:35.170Z","0.1.1":"2026-07-29T15:42:11.654Z","0.1.2":"2026-07-31T10:54:03.182Z","0.1.3":"2026-08-05T13:12:29.401Z","0.2.0":"2026-08-05T14:42:06.331Z","0.2.1":"2026-08-05T15:05:37.621Z","0.2.2":"2026-08-19T09:57:18.593Z"},"bugs":{"url":"https://github.com/Blekline/blekline-oss/issues"},"license":"AGPL-3.0-or-later","homepage":"https://github.com/Blekline/blekline-oss#readme","repository":{"type":"git","url":"git+https://github.com/Blekline/blekline-oss.git","directory":"packages/nhim-audit"},"description":"Static Kubernetes audit for agent candidate workloads that may bypass MCP/runtime enforcement hops","maintainers":[{"name":"tinemaher","email":"dev@blekline.com"}],"readme":"# @blekline/nhim-audit\n\n**Kubernetes agent execution path audit** — does this cluster enforce a mandatory hop for agent candidate workloads?\n\nAgents moved from IDE plugins to cluster workloads. NetworkPolicy and CASB do not answer: *can this pod reach tools or LLMs without an enforcement sidecar or mesh hop?*\n\nDefault profile is **vendor-neutral** (`--profile generic`). Blekline is a reference implementation (`--profile blekline`).\n\n```bash\n# Namespaced RBAC first (recommended for F500 eval namespaces)\nkubectl apply -f deploy/rbac/nhim-audit-reader-namespaced.yaml -n nhim-eval\nkubectl apply -f deploy/rbac/nhim-audit-reader-cluster.yaml\n\nnpx @blekline/nhim-audit audit --profile generic\n```\n\n## Quick start\n\n```bash\nnpx @blekline/nhim-audit demo broken          # terminal demo\nnpx @blekline/nhim-audit audit --fixture broken --json\nnpx @blekline/nhim-audit audit --profile blekline --fixture fixed-blekline --brand\n```\n\n## Profiles\n\n| Profile | Use |\n|---------|-----|\n| `generic` (default) | Vendor-neutral NHIM-001..019 — Istio/Linkerd/generic sidecar patterns |\n| `blekline` | Adds BLEK-001..005 (Helm, Blekline webhook, Auto-Route, image pin) |\n\nOrg overrides: `--config nhim-audit.example.json` (sidecar names, NP patterns, allowlists).\n\n## Rule catalog (generic)\n\n| ID | Severity | Check |\n|----|----------|-------|\n| NHIM-001 | CRITICAL | No enforcement sidecar or inject annotation |\n| NHIM-002 | CRITICAL | No mandatory-hop egress NetworkPolicy |\n| NHIM-003 | HIGH | Mutating admission for injection not detected |\n| NHIM-004 | HIGH | Enforcement webhook fail-open (`failurePolicy: Ignore`) |\n| NHIM-005 | HIGH | Enforcement plane externally exposed |\n| NHIM-006 | MEDIUM | LLM credentials without enforcement hop path |\n| NHIM-007 | MEDIUM | Enforcement auth secret missing |\n| NHIM-008 | MEDIUM | Policy engine not detected (Gatekeeper/Kyverno/VAP) |\n| NHIM-011 | MEDIUM | Default-allow egress across agent namespaces |\n| NHIM-013 | MEDIUM | No agent candidates discovered |\n| NHIM-014 | CRITICAL | Wide HTTPS egress (0.0.0.0/0:443 bypass) |\n| NHIM-015 | MEDIUM | Inject enabled but auto-route disabled |\n| NHIM-016 | MEDIUM | LLM config via envFrom only |\n| NHIM-017 | MEDIUM | Sidecar present but LLM upstream path env missing |\n| NHIM-018 | HIGH | iptables auto-route without injected sidecar |\n| NHIM-019 | CRITICAL | Agent candidate uses `hostNetwork` (NP bypass) |\n| NHIM-023 | INFO | Istio/mesh detected — K8s NP hop not verified |\n\nBlekline-only: **BLEK-001..005** under `--profile blekline`.\n\nFull reference: [app.blekline.com/docs/tools/nhim-audit](https://app.blekline.com/docs/tools/nhim-audit)\n\n## JSON schema 2.0\n\n```json\n{\n  \"schemaVersion\": \"2.0\",\n  \"profile\": \"generic\",\n  \"assurance\": {\n    \"notCertification\": true,\n    \"staticOnly\": true,\n    \"probeExecuted\": false,\n    \"limitations\": [\"...\"]\n  },\n  \"score\": {\n    \"value\": 82,\n    \"band\": \"PARTIAL\",\n    \"staticGateStatus\": \"unknown\"\n  }\n}\n```\n\n**Evidence enablement only — not OWASP, AIUC-1, EU AI Act, or pentest certification.**\n\nGeneric profile never emits `staticGateStatus: \"pass\"` without `--probe`.\n\n## RBAC\n\n| Manifest | Scope |\n|----------|-------|\n| `deploy/rbac/nhim-audit-reader-namespaced.yaml` | Role in eval namespace(s) |\n| `deploy/rbac/nhim-audit-reader-cluster.yaml` | ClusterRole: namespaces + webhooks only |\n| `deploy/rbac/nhim-audit-probe-namespaced.yaml` | Role: `pods/exec` in eval namespace |\n\nSee [docs/RBAC.md](./docs/RBAC.md).\n\n## Probe mode\n\nIssue token in [Deployment hub](https://app.blekline.com/operations/posture) after uploading nhim-audit JSON (self-serve eval), or use a welcome-pack token for paid sandbox partners.\n\n```bash\nBLEKLINE_EVAL_ONLINE=1 \\\nNHIM_PROBE_TOKEN=blw_eval_… nhim-audit audit \\\n  --probe \\\n  --probe-allow-namespaces nhim-eval \\\n  --profile generic\n```\n\nWhen online validation succeeds, reports include `assurance.probeTokenValidatedOnline: true`.\n\n`BLEKLINE_EVAL_TOKEN` accepted for compatibility. `--probe-allow-namespaces` is **required** with `--probe`.\n\n## CI\n\n```yaml\n- uses: Blekline/blekline-oss/ci/github-actions/nhim-audit@main\n  with:\n    kubeconfig: ${{ secrets.KUBECONFIG }}\n    profile: generic\n    fail-on: high\n    min-score: \"75\"\n```\n\n## Docs\n\n- [ENTERPRISE.md](./docs/ENTERPRISE.md) — F500 runbook, baseline CI, SARIF import\n- [LIMITATIONS.md](./docs/LIMITATIONS.md) — static vs probe, mesh/SG blind spots\n- [COMPETITIVE.md](./docs/COMPETITIVE.md) — vs Kubescape / Polaris\n- [CHANGELOG.md](./CHANGELOG.md) — 0.1.3 → 0.2.0 migration\n\n## License\n\nAGPL-3.0-or-later\n","readmeFilename":"README.md"}