/**
 * MCP Server - Model Context Protocol integration (v2 SDK)
 *
 * Exposes tools for AI agents:
 * 1. scan_tenant_isolation - Run scan and return findings (read-only)
 * 2. list_tenant_isolation_rules - List all available rules (read-only)
 * 3. explain_tenant_isolation_rule - Get detailed explanation of a rule (read-only)
 * 4. suppress_tenant_isolation_finding - Add a suppression (WRITE; gated)
 *
 * SECURITY BOUNDARY (Part 3):
 * The server establishes ONE explicit allowed project root at startup.
 * All filesystem operations are constrained to that root via PathBoundary.
 * Any path that escapes the root returns TARGET_OUTSIDE_ALLOWED_ROOT.
 *
 * WRITE-TOOL GOVERNANCE (Part 4):
 * Default MCP mode is READ-ONLY. The suppression tool is only exposed when
 * the server is started with allowWriteTools: true (--allow-write-tools).
 *
 * TRANSPORT (Part 5):
 * v2.0 supports stdio only. Legacy SSE transport has been removed.
 * Remote transport (Streamable HTTP) is deferred unless a real business
 * requirement exists.
 *
 * MCP SDK v2 (Part 6):
 * Uses @modelcontextprotocol/server with registerTool() and zod schemas.
 *
 * PRODUCER_LOCAL_V2_CONFORMANCE.
 */
export interface McpServerOptions {
    /**
     * When true, the suppression write tool is exposed. Default: false (read-only).
     * Set via --allow-write-tools on the CLI.
     */
    allowWriteTools?: boolean;
}
export declare const READ_ONLY_TOOL_NAMES: readonly ["scan_tenant_isolation", "list_tenant_isolation_rules", "explain_tenant_isolation_rule"];
export declare const WRITE_TOOL_NAME: "suppress_tenant_isolation_finding";
export declare const TOOL_ANNOTATIONS: {
    readonly scan: {
        readonly readOnlyHint: true;
    };
    readonly list: {
        readonly readOnlyHint: true;
    };
    readonly explain: {
        readonly readOnlyHint: true;
    };
    readonly suppress: {
        readonly readOnlyHint: false;
        readonly destructiveHint: true;
    };
};
export declare function startMcpServer(projectRoot: string, options?: McpServerOptions): Promise<void>;
//# sourceMappingURL=server.d.ts.map