NHI Scanner — Non-Human Identity Risk

Inventory and risk-tier your non-human & agent identities (service accounts, API keys, OAuth apps, service principals, workload identities, CI/CD tokens, PATs, webhooks, secrets, AI agents) against the OWASP NHI Top 10. Deterministic floor-tier rules engine — the same inventory always produces the same tiers and findings, with a least-privilege remediation for every finding. No LLM is in the verdict path. Port of nhi-scan (MIT).

NHI Inventory (JSON)

[
  {
    "id": "svc-payments-prod",
    "name": "payments-batch-runner",
    "type": "service_account",
    "owner": "payments-platform@bank.example",
    "environment": "prod",
    "privilege": "admin",
    "credential": "static_secret",
    "secret_storage": "vault",
    "last_rotated_days": 410,
    "last_used_days": 1,
    "exposure": "internal",
    "scopes": [
      "payments:*"
    ]
  },
  {
    "id": "key-legacy-etl",
    "name": "legacy-etl-api-key",
    "type": "api_key",
    "owner": null,
    "environment": "prod",
    "privilege": "privileged",
    "credential": "api_key",
    "secret_storage": "plaintext",
    "last_rotated_days": null,
    "last_used_days": 220,
    "exposure": "internet",
    "scopes": [
      "data:read",
      "data:write"
    ]
  },
  {
    "id": "agent-collections",
    "name": "collections-ai-agent",
    "type": "ai_agent",
    "owner": "cx-automation@bank.example",
    "environment": "prod",
    "privilege": "privileged",
    "credential": "static_secret",
    "secret_storage": "env",
    "last_rotated_days": 30,
    "last_used_days": 0,
    "exposure": "internal",
    "scopes": [
      "accounts:read",
      "accounts:update",
      "ledger:*"
    ],
    "autonomous": true
  },
  {
    "id": "sp-analytics-vendor",
    "name": "analytics-vendor-connector",
    "type": "service_principal",
    "owner": "data-eng@bank.example",
    "environment": "prod",
    "privilege": "scoped",
    "credential": "static_secret",
    "secret_storage": "vault",
    "last_rotated_days": 45,
    "last_used_days": 3,
    "exposure": "external_partner",
    "scopes": [
      "reports:read"
    ],
    "third_party": true
  },
  {
    "id": "ci-deploy-token",
    "name": "github-actions-deployer",
    "type": "ci_cd_token",
    "owner": "devsecops@bank.example",
    "environment": "prod",
    "privilege": "privileged",
    "credential": "static_secret",
    "secret_storage": "vault",
    "last_rotated_days": 15,
    "last_used_days": 0,
    "exposure": "internal",
    "scopes": [
      "deploy:prod",
      "deploy:nonprod"
    ],
    "shared_across_env": true,
    "used_by": [
      "web-app",
      "batch",
      "mobile-bff"
    ]
  },
  {
    "id": "wl-fraud-scoring",
    "name": "fraud-scoring-workload",
    "type": "workload_identity",
    "owner": "fraud-ml@bank.example",
    "environment": "prod",
    "privilege": "scoped",
    "credential": "federated",
    "secret_storage": "none",
    "last_rotated_days": null,
    "last_used_days": 0,
    "exposure": "internal",
    "scopes": [
      "features:read"
    ]
  },
  {
    "id": "pat-oncall-shared",
    "name": "oncall-shared-pat",
    "type": "pat",
    "owner": "sre@bank.example",
    "environment": "prod",
    "privilege": "privileged",
    "credential": "static_secret",
    "secret_storage": "env",
    "last_rotated_days": 200,
    "last_used_days": 2,
    "exposure": "internal",
    "scopes": [
      "repo",
      "admin:org"
    ],
    "human_used": true
  },
  {
    "id": "hook-sandbox-test",
    "name": "sandbox-webhook",
    "type": "webhook",
    "owner": "qa@bank.example",
    "environment": "sandbox",
    "privilege": "read_only",
    "credential": "short_lived_token",
    "secret_storage": "none",
    "last_rotated_days": 5,
    "last_used_days": 400,
    "exposure": "internal",
    "scopes": [
      "events:read"
    ]
  }
]

Runs entirely locally & deterministically — your inventory is never stored.

Port of nhi-scan (MIT) — mapped to the OWASP NHI Top 10. Deterministic, local, explainable — no LLM in the verdict path.

NHI Scanner — Non-Human Identity Risk