/**
 * Execution Artifact Detector
 * Detects evidence of actual code/command execution in tool responses
 *
 * Extracted from SecurityResponseAnalyzer.ts (Issue #53)
 * Handles: execution evidence detection, artifact detection, injection payload echoing
 */
import { CompatibilityCallToolResult } from "@modelcontextprotocol/sdk/types.js";
/**
 * Result of response analysis
 */
export interface AnalysisResult {
    isVulnerable: boolean;
    evidence?: string;
}
/**
 * Detects execution artifacts in tool responses
 */
export declare class ExecutionArtifactDetector {
    /**
     * Check if response contains evidence of actual execution
     * Used to distinguish between safe reflection and actual command/code execution
     */
    hasExecutionEvidence(responseText: string): boolean;
    /**
     * Detect execution artifacts in response
     * Two-tier detection: unambiguous artifacts + context-sensitive patterns
     */
    detectExecutionArtifacts(responseText: string): boolean;
    /**
     * Check if response contains echoed injection payload patterns
     * These indicate the payload was stored/reflected, not executed
     */
    containsEchoedInjectionPayload(responseText: string): boolean;
    /**
     * Analyze injection response (fallback logic)
     * Used when primary detection methods are inconclusive
     *
     * @param responseText The response text to analyze
     * @param isReflectionCheck Function to check if response is reflection
     * @returns Analysis result with vulnerability status
     */
    analyzeInjectionResponse(responseText: string, isReflectionCheck: (text: string) => boolean): AnalysisResult;
    /**
     * Extract response content from MCP response
     */
    extractResponseContent(response: CompatibilityCallToolResult): string;
}
//# sourceMappingURL=ExecutionArtifactDetector.d.ts.map