/**
 * pop mcp serve — a stdio MCP server generated from the command manifest.
 *
 * Zero dependencies: MCP's stdio transport is newline-delimited JSON-RPC 2.0,
 * small enough to speak directly. Every tool is one CLI command, executed as
 * a child process of THIS binary with --json — so the server inherits every
 * safety property the CLI already has (confirmWrite consent, POP_READONLY,
 * the tiered subgraph transport) instead of re-implementing them.
 *
 * Exposure policy (safety-map derived, least privilege by default):
 *   default                       read-only commands only; --pin stripped, and
 *                                 always-pinning reads (org publish) excluded
 *   --allow-writes /              adds non-destructive writes; --yes is
 *   POP_MCP_ALLOW_WRITES=1        appended (the operator consented by opting in)
 *   --allow-destructive /         adds destructive writes too (vote execute,
 *   POP_MCP_ALLOW_DESTRUCTIVE=1   token approve, …); implies allow-writes
 *
 * POP_READONLY=1 in the environment remains the structural backstop: children
 * inherit it, so even a misconfigured server cannot sign or pin.
 *
 * Protocol notes: stdout carries ONLY JSON-RPC frames (the CLI's own output
 * lib is never used here); diagnostics go to stderr. Handles initialize,
 * ping, tools/list, tools/call; notifications are consumed silently.
 */
import type { Argv, ArgumentsCamelCase } from 'yargs';
interface ServeArgs {
    'allow-writes'?: boolean;
    'allow-destructive'?: boolean;
}
export declare const serveHandler: {
    builder: (yargs: Argv) => Argv<{
        "allow-writes": boolean;
    } & {
        "allow-destructive": boolean;
    }>;
    handler: (argv: ArgumentsCamelCase<ServeArgs>) => Promise<void>;
};
export declare function registerMcpCommands(yargs: Argv): Argv<{}>;
export {};