/**
 * MCP (Model Context Protocol) integration — connect to MCP servers,
 * discover their tools, and proxy them as native OpenKai AgentTools.
 *
 * Config: ~/.openkai/mcp.json — array of server descriptors:
 *   [{ "name": "filesystem", "command": "npx", "args": ["-y", "@modelcontextprotocol/server-filesystem", "."] }]
 *
 * Protocol: JSON-RPC 2.0 over stdio (MCP spec 2024-11-05).
 * Operations: initialize → tools/list → tools/call per invocation.
 *
 * Hardening (ren's adversarial review):
 *  - Spawned servers get a SCRUBBED environment ({@link scrubbedChildEnv}) —
 *    credential-named/valued variables are dropped; the operator's explicit
 *    `config.env` entries are applied last (explicit beats scrub).
 *  - Every proxied `tools/call` is wrapped in the session {@link PermissionGate}
 *    when one is threaded through {@link discoverMcpTools} — an MCP tool is a
 *    remote-controlled capability and must not bypass consent.
 *  - The per-connection read buffer is capped at 1 MiB; on overflow the
 *    connection is killed and its pending requests rejected (a runaway server
 *    must not balloon memory).
 */
import type { AgentTool } from "@earendil-works/pi-agent-core";
import type { PermissionGate } from "./permission-gate.js";
/**
 * Discover and connect to all configured MCP servers.
 * Returns an array of proxy AgentTools — one per discovered tool.
 * When `gate` is supplied, every proxied `tools/call` is wrapped in a
 * permission request (consent preview shows the invocation as a command).
 */
export declare function discoverMcpTools(gate?: PermissionGate): Promise<AgentTool<Record<string, unknown>, unknown>[]>;
/**
 * MCP status tool — reports connected servers and their tools.
 * Registered as a built-in so the model can inspect the MCP surface.
 */
export declare function mcpStatusTool(): AgentTool<Record<string, unknown>, unknown>;
/** Shut down all MCP connections, rejecting any in-flight requests. */
export declare function shutdownMcp(): void;
//# sourceMappingURL=mcp.d.ts.map