/**
 * Security utilities for MCP tool responses.
 * Wraps untrusted external content with safety markers to defend against
 * Indirect Prompt Injection (XPIA) attacks.
 */
/**
 * Tools that return content from external sources (untrusted). Single source
 * of truth for both the text-block XML wrap (wrapToolResult) and the
 * structuredContent envelope marker (markStructuredContent) — export so
 * callers (registry, tests) can enumerate it instead of duplicating the list.
 */
export declare const EXTERNAL_CONTENT_TOOLS: Set<string>;
/**
 * Validates a URL to ensure it uses a safe protocol.
 * Prevents XSS attacks via javascript:, data:, vbscript:, etc.
 */
export declare function isSafeUrl(url: string): boolean;
/** Validate tool name for help documentation requests */
export declare function isValidToolName(name: string): boolean;
/** Wrap tool result with safety markers if it contains external content */
export declare function wrapToolResult(toolName: string, jsonText: string): string;
/**
 * Mark structuredContent from external-content tools with an envelope-level
 * untrusted-source marker. structuredContent is machine-parsed (not rendered
 * as text), so — unlike wrapToolResult's XML-tag wrapping of the text block —
 * the marker is added as sibling keys on the envelope rather than wrapping
 * individual values, preserving machine-parseability of the payload.
 *
 * Payload is spread FIRST, marker keys SECOND: if external mail data happens
 * to contain a colliding `_untrusted_source`/`_untrusted_warning` key, the
 * marker must win, never be silently overwritten by attacker-controlled data.
 */
export declare function markStructuredContent(toolName: string, result: Record<string, unknown>): Record<string, unknown>;
//# sourceMappingURL=security.d.ts.map