EVIDIQ Bastion

Infrastructure as Code and deployment configurations define the security perimeter of autonomous agent services. An agent service configured to run container workloads as root, expose 0.0.0.0/0 ingress rules, use unpinned GitHub Actions, or mount host network paths introduces immediate cluster compromise risks before any code executes.

EVIDIQ Bastion is the pre-deployment security gate for infrastructure configurations.
Pass it Dockerfiles, GitHub Actions CI workflows, Kubernetes manifests, or Terraform HCL / Compose files. It evaluates 14 deterministic security rules — enforcing non-root execution, credential insulation, supply-chain integrity, resource bounds, and signed attestations.

Bastion never deploys infrastructure, never executes input manifests, and never accepts private keys.

What it does

• Non-Root Execution Enforcement — Detects root user execution (USER root or missing non-root USER directive) in container builds.

• Supply-Chain Action Pinning — Enforces full 40-character commit SHA pinning for GitHub Actions (blocking mutable @v3 / @main tags) and immutable SHA-256 digests for Docker base images.

• Credential Insulation — Detects hardcoded secrets, API keys, or private keys in build ARG/ENV directives, plaintext IaC variable defaults, and Kubernetes secret environment variables.

• Kubernetes Workload Hardening — Identifies privileged containers (privileged: true), hostPath volume mounts, hostNetwork exposure, and missing CPU/memory resource bounds.

• IaC Exposure Auditing — Audits Terraform HCL and Docker Compose for open world ingress (0.0.0.0/0), public S3 buckets, and unrestricted container capabilities.

• CI/CD Pipeline Attack Vectors — Detects untrusted code checkout risks in pull_request_target triggers, unescaped github.event expression injection in run steps, and overly broad permissions: write-all.

• Signed Attestations — attest_deployment binds the configuration digest, evaluation findings, and verdict into an EIP-191 signed attestation and anchors it on 0G storage.

• Deterministic Verdicts — Any failing blocker yields BLOCK; otherwise any failing high yields REVIEW; clean evaluations yield PASS.

• Pay per check — Five paid analysis tools at 0.005–0.03 USDT0; five preflight and verification tools are free.

Related MCP server: supership-scan

Route to Bastion when

Use Bastion before applying or deploying infrastructure code: before building container images, before merging CI/CD workflow pull requests, before applying Kubernetes manifests (kubectl apply), or before executing Terraform (terraform apply).

Do not send it private keys — ever. Do not route smart contract calldata here (that is Assay), source code is Warden, endpoint reachability is Sentinel, dependency manifests are Lineage, and durable action logging is Vault.

A natural chain: validate_config → scan_dockerfile / scan_workflow → attest_deployment → append_record (Vault).

Use it from any agent

# Read the public Skill document
curl -s https://mcp.evidiq.dev/bastion/skill.md

# Inspect current x402 pricing discovery
curl -s https://mcp.evidiq.dev/bastion/x402

# Connect the remote MCP server (OpenClaw)
openclaw mcp add evidiq-bastion --transport streamable-http --url https://mcp.evidiq.dev/bastion/mcp

# Connect the remote MCP server (Claude Code)
claude mcp add --transport http evidiq-bastion https://mcp.evidiq.dev/bastion/mcp

Public endpoints:

MCP tools

Paid analysis & attestations

Free preflight and verification

Test Verification & Automated Harness Output

Every rule and payment gate in EVIDIQ Bastion is validated via an automated test harness (tester/harness.mjs) on VPS.

1. Automated Harness Fixture Matrix (14/14 PASS)

2. Verification Harness Logs (node tester/harness.mjs)

=== Starting EVIDIQ Bastion MCP Test Harness ===
Test Container Endpoint: http://127.0.0.1:4012/mcp
Production Endpoint:     http://127.0.0.1:3012/mcp

--- Step 1: Verify Test Container Health & Bypass ---
  PASS: Test container health is 200 OK
  PASS: Test container carries bypass header 'x-x402-bypass: true'
  PASS: Test container response includes 'x402Bypass: true' in body

--- Step 2 & 3: Bare Call Sweep & Fixture Verification (14 Fixtures) ---
  PASS: 14/14 Fixture Assertions Passed with Exact Set-Equality Match

--- Step 4: Determinism & Digest Stability ---
  PASS: Repeated scan yields byte-identical SHA-256 digest: 274cd946dd164d373f6472ef66ab9d85450733f3c167dc4a066d25238a3eeeea

--- Step 5: Test Build Markers Check ---
  PASS: Response carries 'testBuild: true' marker

--- Step 6: Production Unpaid 402 Probes ---
  PASS: Production /health is 200 OK
  PASS: Production paymentGate is 'enforced'
  PASS: Production HEAD /mcp returns 402 Payment Required
  PASS: Production unpaid scan_dockerfile returns HTTP 402

=================================================
 SUCCESS: All EVIDIQ Bastion MCP test harness assertions PASSED!

3. OpenClaw Autonomous Agent Execution Traces

Agent Run 1 — Dockerfile Audit (scan_dockerfile):

openclaw@evidiq-vps:~$ openclaw agent --session-id bastion-dockerfile-audit \
  --message "Use tool scan_dockerfile from evidiq-bastion MCP to audit: 'FROM node:22-alpine\nCMD [\"node\"]'" --local

[provider-transport-fetch] start provider=zerog model=glm-5.2 method=POST url=https://router-api.0g.ai/v1/chat/completions
[evidiq-bastion] Executing tool scan_dockerfile (content-length: 32 bytes)

## Dockerfile Audit Results
Verdict: 🚫 BLOCK (1 blocker finding)

Finding:
• [BASTION_ROOT_USER] Blocker (Line 2)
  Why: Container runs as root by default. A container escape gives root access on the host node.
  Remediation: Add 'USER node' instruction (node:22-alpine ships with UID 1000).

Report Integrity:
  Digest: 86e0124f52a23e277f9864190fcbff9
  Signer: 0x131E4A54aB221929834815c99195dAec316aC270
  Artifact ID: art_86e0124f52a23e27

Agent Run 2 — GitHub Actions Workflow Audit (scan_workflow):

openclaw@evidiq-vps:~$ openclaw agent --session-id bastion-workflow-audit \
  --message "Use tool scan_workflow from evidiq-bastion MCP to audit GitHub Actions workflow" --local

[provider-transport-fetch] start provider=zerog model=glm-5.2 method=POST url=https://router-api.0g.ai/v1/chat/completions
[evidiq-bastion] Executing tool scan_workflow (content-length: 88 bytes)

## GitHub Actions Workflow Audit
Verdict: ⚠️ REVIEW (0 Blocker, 1 High, 0 Medium)

Finding:
• [BASTION_ACTION_NOT_PINNED] High Severity
  Detail: actions/checkout@v3 is pinned to a mutable tag instead of commit SHA.
  Why: Mutable tags can be hijacked. Pinning to a SHA prevents untrusted action code updates.
  Remediation: Pin action to immutable 40-character commit SHA (e.g., actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11).

Integrity:
  Signature: EIP-191 signed by 0x131E4A54aB221929834815c99195dAec316aC270
  Artifact ID: art_960389b236d8cb9f

Recommended workflow

Settlement happens before a paid tool runs, so a malformed argument is still a paid call. Preflight for free first:

1. bastion_capabilities — rule set catalog, supported config types, limits, prices.

2. validate_config — confirms config type, detects input secrets, and returns severity counts without charging.

3. estimate_cost — exact price of the operation you intend to run.

4. One paid call per request (scan_dockerfile, scan_workflow, scan_manifest, scan_iac, or attest_deployment).

5. verify_bastion_report — free, offline verification of the signature and report digest.

Rule Families & Verdict Engine

Bastion enforces 14 deterministic security rules across 6 families:

• Privilege: BASTION_ROOT_USER, BASTION_PRIVILEGED

• Exposure: BASTION_WORLD_INGRESS, BASTION_PUBLIC_STORAGE, BASTION_HOST_NETWORK

• Secrets: BASTION_SECRET_IN_BUILD_ARG, BASTION_PLAINTEXT_SECRET, BASTION_SECRET_ENV

• Supply Chain: BASTION_UNPINNED_BASE, BASTION_ACTION_NOT_PINNED, BASTION_PR_TARGET_UNTRUSTED, BASTION_EXPR_INJECTION

• Resource: BASTION_NO_RESOURCE_LIMITS

• Hygiene: BASTION_ADD_URL, BASTION_UNPINNED_PKG_INSTALL

Verdict Logic:

• Failing any blocker rule → BLOCK

• Failing any high rule (with 0 blockers) → REVIEW

• Clean evaluation (0 blockers, 0 high findings) → PASS

What a report proves, and what it does not

• It does prove that this exact deployment configuration, evaluated under the deterministic 14-rule engine version, produced this content digest, finding set, and verdict.

• It does produce an EIP-191 signature signed by Bastion's trusted key, anchorable on 0G storage.

• It does not guarantee runtime application security beyond the static configuration. Dynamic application bugs or live network attacks outside IaC definition are out of static scope.

License

EVIDIQ owns and licenses its original Bastion code under MIT. Third-party dependencies preserve their own open-source licenses in THIRD_PARTY_NOTICES.md.