import { Server } from "@modelcontextprotocol/sdk/server/index.js";
/**
 * Loopback detection — used to gate the unauthenticated PAT-mode default.
 * A non-loopback bind in PAT mode is treated as fatal misconfiguration
 * because the transport carries no auth check on /sse or /messages.
 *
 * Covers the full IPv4 loopback range (127.0.0.0/8 — `127.1.2.3` is just
 * as loopback as `127.0.0.1` on Linux/macOS), the IPv6 loopback `::1`,
 * IPv4-mapped IPv6 loopback (`::ffff:127.x.y.z`), and the case-insensitive
 * hostname `localhost`. A naive equality check on `127.0.0.1` alone would
 * have missed an operator binding to `127.5.6.7` for port-conflict reasons.
 *
 * Note on `localhost`: this is a NAME match, not a DNS/hosts-file
 * resolution. An operator with `/etc/hosts` mapping `localhost` to a
 * non-loopback address would pass this check by name while Node's
 * `httpServer.listen("localhost", …)` resolves to the public IP. That
 * scenario is operator-induced and not defended against here — for
 * hardening configs, prefer IP literals (`127.0.0.1`) over names.
 */
export declare function isLoopbackHost(host: string): boolean;
/**
 * Validates the transport configuration before any HTTP server starts.
 * Returns a non-null error message when the combination is unsafe.
 *
 * Rule: HTTP transports (SSE / Streamable HTTP) bound to a non-loopback
 * interface must run with AUTH_MODE=oauth. A PAT-mode HTTP server on
 * 0.0.0.0 (or any LAN-reachable address) is unauthenticated and exposes
 * the operator's GitLab PAT to anyone who can reach the port.
 */
export declare function requireSafeTransportConfig(opts: {
    useSSE: boolean;
    useStreamableHttp: boolean;
    host: string;
    authMode: string;
}): string | null;
/**
 * Transport configuration options
 */
export interface TransportOptions {
    /**
     * Port to use for HTTP transport (default: 3000)
     */
    port?: number;
    /**
     * Bind address for HTTP transport.
     * Default: "127.0.0.1" (loopback only). Use "0.0.0.0" or a specific
     * interface address to expose to the network — but only with
     * AUTH_MODE=oauth, otherwise the server refuses to start.
     */
    host?: string;
    /**
     * Whether to use SSE transport (default: false, uses stdio)
     */
    useSSE?: boolean;
    /**
     * Whether to enable Streamable HTTP transport on /mcp (default: false).
     * Can be enabled together with legacy SSE transport.
     */
    useStreamableHttp?: boolean;
    /**
     * Optional factory function used in OAuth mode.
     * When provided, a new MCP Server is created per SSE connection
     * using the Bearer token extracted from the Authorization header.
     * If absent, the `server` argument is used directly (PAT mode).
     */
    serverFactory?: (token: string) => Server;
}
/**
 * Sets up the appropriate transport for the server based on the options
 *
 * @param server - The MCP server instance (PAT mode). Pass null when using serverFactory.
 * @param options - Transport configuration options
 * @returns A promise that resolves when the transport is set up
 */
export declare function setupTransport(server: Server | null, options?: TransportOptions): Promise<void>;