/**
 * MCP Composition Inspector (#2783 dream-cycle, arXiv 2606.27027 ShareLock).
 *
 * The attack: an adversary registers N seemingly-benign MCP tools whose
 * INDIVIDUAL descriptions look fine, but whose CONCATENATION forms an
 * injection payload targeting a specific downstream agent. Per-tool
 * inspection misses this (each fragment is under the detection threshold).
 * The inspector composes them and looks for cross-tool signal.
 *
 * SCOPE: heuristic detector, not a security boundary. Reports SUSPECTS —
 * the operator decides. No blocking, no rewriting. This is the "MCP
 * Composition Inspector" surface from dream-cycle #2783's ADR-320
 * recommendation, delivered as a bounded engineering fix rather than
 * an ADR-scope subsystem.
 *
 * Detection method (v1 — deterministic, no LLM):
 *   1. Common-substring scan: for every pair of tools, find shared
 *      substrings of length ≥ minFragment (default 20). Attacker
 *      fragments would repeat identically or near-identically across
 *      the split tools; benign tools rarely share 20+ char sequences
 *      that aren't proper nouns or well-known phrases.
 *   2. Suspicious-phrase catalog: strings that appear in known
 *      prompt-injection templates ("ignore previous instructions",
 *      "you are now", "system prompt", "delete all", etc.) — even
 *      inside one tool, flagged.
 *   3. Tool-name lookalikes: names that differ by ≤ 2 chars from a
 *      known-trusted ruflo tool (typosquatting mitigation).
 *
 * Future v2: SimHash + LSH for scale (arXiv 2606.27027's proposal),
 * OWASP LLM07 alignment.
 */
export interface ToolDescriptor {
    name: string;
    description: string;
}
export interface CompositionSuspect {
    /** Suspect category — `shared-fragment`, `injection-phrase`, `name-lookalike`. */
    kind: 'shared-fragment' | 'injection-phrase' | 'name-lookalike';
    /** Tool name that carries the suspicious content. */
    tool: string;
    /** Peer tool (for shared-fragment / name-lookalike) or empty. */
    peer?: string;
    /** The offending substring or phrase (truncated for display). */
    fragment: string;
    /** Heuristic score, 0..1. Higher = more suspicious. */
    score: number;
    /** Human-readable explanation. */
    reason: string;
}
export interface CompositionScanResult {
    suspects: CompositionSuspect[];
    stats: {
        toolsScanned: number;
        pairsCompared: number;
        fragmentsCompared: number;
    };
}
export declare function scanToolDescriptions(tools: ToolDescriptor[], options?: {
    minFragment?: number;
    trustedPrefixes?: readonly string[];
    injectionPhrases?: readonly string[];
    /**
     * Maximum number of tools a fragment may appear in before we treat it
     * as "template language" and stop flagging it. Attack fragments live
     * in small conspiracies (2–3 tools); template language shows up in
     * dozens. Default 3 catches Shamir-split attacks without flooding on
     * legitimate ruflo tools that share the same MCP-tool-description
     * template.
     */
    maxFragmentPopulation?: number;
}): CompositionScanResult;
//# sourceMappingURL=mcp-composition-inspector.d.ts.map