export interface McpJsonEntry {
    /** stdio servers: the executable. Remote (http/sse) servers omit this and set `url`. */
    command?: string;
    args?: string[];
    env?: Record<string, string>;
    /** Remote MCP transport. Present for HTTP/SSE servers (e.g. the pixel-office A2A server). */
    type?: 'stdio' | 'http' | 'sse';
    /** Remote MCP endpoint URL (when type is http/sse). */
    url?: string;
    /** Headers sent to the remote MCP endpoint (e.g. Authorization: Bearer <token>). */
    headers?: Record<string, string>;
    /** false = entry is kept in .mcp.json to preserve credentials but not synced to providers */
    enabled?: boolean;
    alwaysLoad?: boolean;
    _meta?: {
        managedBy?: string;
        name?: string;
        kind?: 'user' | 'builtin';
        [k: string]: unknown;
    };
}
/** True for remote (http/sse) MCP entries — identified by a url instead of a command. */
export declare function isRemoteMcp(e: McpJsonEntry): boolean;
/**
 * Guard for stdio MCP `command` values that arrive from an untrusted channel
 * (e.g. a WS `mcp_update` frame). Rejects shells/interpreters, absolute or
 * relative paths, and anything carrying shell metacharacters. This does NOT
 * make mcp_update safe on its own — that path must also be gated behind an
 * explicit opt-in (mcpUpdateEnabled) — it just removes the most direct
 * command-execution primitives. Remote (url) entries are validated separately.
 */
export declare function isSafeStdioMcpCommand(command: unknown): command is string;
/** Reject an stdio MCP `args` array that carries an interpreter code-exec flag. */
export declare function isSafeStdioMcpArgs(args: unknown): boolean;
/** Reject an stdio MCP `env` block that sets a code-injection / preload var. */
export declare function isSafeStdioMcpEnv(env: unknown): boolean;
/**
 * Filter an untrusted `mcpServers` map down to entries that are safe to write
 * and (re)spawn. Remote entries must have an http/https url; stdio entries must
 * pass isSafeStdioMcpCommand. Returns the accepted subset plus the names that
 * were rejected (for logging). Callers should still gate the whole path behind
 * an opt-in flag.
 */
export declare function sanitizeRemoteMcpEntries(entries: Record<string, unknown>): {
    safe: McpJsonEntries;
    rejected: string[];
};
export type McpJsonEntries = Record<string, McpJsonEntry>;
/** Return only USER entries from .mcp.json (built-ins filtered out). */
export declare function loadProjectUserMcp(root: string): McpJsonEntries;
/** Read every entry from .mcp.json (user + builtin). */
export declare function loadProjectAllMcp(root: string): McpJsonEntries;
/** Write the full set of user entries (full replace), preserving any built-ins. */
export declare function saveProjectUserMcp(root: string, userEntries: McpJsonEntries): void;
/** Remove a single user entry by name. Built-ins are not touched. */
export declare function removeProjectUserMcp(root: string, name: string): boolean;
/** Replace every built-in entry with the supplied set, leaving user entries alone. */
export declare function replaceProjectBuiltinMcp(root: string, builtins: McpJsonEntries): void;