/**
 * MCP Tool Shadowing Detector (sentori-scanner-002)
 *
 * Detects tool names that mimic legitimate MCP server tool names to intercept
 * calls via lookalike naming (e.g. `filesystem_tool` vs `filesystem-tool`,
 * `read__file` vs `read_file`, `Bash` vs `bash`).
 *
 * Detection rules:
 *  SHADOW-001 — Lookalike tool name: high similarity to a known canonical tool
 *               (Levenshtein distance <= threshold, or normalized match)
 *  SHADOW-002 — Separator substitution: identical name with - / _ / __ swap
 *  SHADOW-003 — Case-only difference: tool names that differ only in casing
 */
import { ScannerModule } from '../types';
export declare const CANONICAL_SERVER_NAMES: string[];
export declare const CANONICAL_TOOL_NAMES: string[];
export declare function levenshtein(a: string, b: string): number;
/**
 * Normalize a tool name for comparison:
 * lowercase, collapse separator variants (-, _, __, space) to single underscore.
 */
export declare function normalizeName(name: string): string;
/**
 * Returns true if `name` is a separator-only variant of `canonical`
 * (identical after normalization but different before).
 */
export declare function isSeparatorVariant(name: string, canonical: string): boolean;
/**
 * Returns true if `name` is a case-only variant of `canonical`
 * (identical after lowercasing but different before, and same separators).
 */
export declare function isCaseVariant(name: string, canonical: string): boolean;
export interface ShadowMatch {
    canonical: string;
    rule: 'SHADOW-001' | 'SHADOW-002' | 'SHADOW-003';
    distance: number;
    reason: string;
}
/**
 * Check if `toolName` shadows any canonical tool.
 * Returns the first (most specific) match, or null.
 */
export declare function detectShadowing(toolName: string): ShadowMatch | null;
/**
 * Check if `serverName` shadows any canonical MCP server name.
 * Uses the same SHADOW-001/002/003 rules as tool shadowing.
 * Returns the first (most specific) match, or null.
 */
export declare function detectServerShadowing(serverName: string): ShadowMatch | null;
export declare const mcpToolShadowingDetector: ScannerModule;
//# sourceMappingURL=mcp-tool-shadowing-detector.d.ts.map