/**
 * ToolResultGuard
 *
 * Validates tool return values before they flow back into LLM context.
 * Addresses the #1 attack vector in 2025-2026: tool output poisoning.
 *
 * Real-world incidents this guard prevents:
 * - Microsoft Copilot "Copirate" (2025): tool output contained hidden prompt injection
 * - Supabase Cursor SQL exfiltration (2025): tool returned attacker-controlled data
 * - WhatsApp MCP exfiltration (2025): tool output used for cross-service data theft
 */
export interface ToolResultGuardConfig {
    /** Expected return schemas per tool name */
    expectedSchemas?: Record<string, ToolResultSchema>;
    /** Scan all string values in results for prompt injection (default: true) */
    scanForInjection?: boolean;
    /** Max result size in characters (default: 50000) */
    maxResultSize?: number;
    /** Additional patterns to block in results */
    sensitivePatterns?: RegExp[];
    /** Block results claiming state changes (default: true) */
    detectStateChangeClaims?: boolean;
}
export interface ToolResultSchema {
    type: "string" | "number" | "boolean" | "object" | "array";
    properties?: Record<string, {
        type: string;
        required?: boolean;
    }>;
    maxLength?: number;
}
export interface ToolResultGuardResult {
    allowed: boolean;
    reason?: string;
    violations: string[];
    injection_detected: boolean;
    schema_valid: boolean;
    threats: ToolResultThreat[];
}
export interface ToolResultThreat {
    type: string;
    severity: "low" | "medium" | "high" | "critical";
    location: string;
    detail: string;
}
export declare class ToolResultGuard {
    private config;
    constructor(config?: ToolResultGuardConfig);
    /**
     * Validate a tool's return value before feeding it back to the LLM
     */
    validateResult(toolName: string, result: any, requestId?: string): ToolResultGuardResult;
    private buildScanVariants;
    /**
     * Scan any value (string, object, array) for injection patterns
     */
    scanForInjection(value: any, path?: string): {
        detected: boolean;
        threats: ToolResultThreat[];
    };
    /**
     * Register expected schema for a tool
     */
    registerSchema(toolName: string, schema: ToolResultSchema): void;
    private detectStateChangeClaims;
    private validateSchema;
    private safeStringify;
}