/**
 * Capability classification for the "lethal trifecta" analysis (Simon
 * Willison's framing): an agent is exploitable when one trust boundary
 * combines access to private data, exposure to untrusted content, and the
 * ability to exfiltrate externally. An MCP server aggregates many tools
 * behind one boundary, so we classify each tool and roll them up.
 *
 * The classification is capability-shaped rather than keyword-matched. A
 * local file write is not exfiltration, and a local file read is not an
 * injection carrier. That distinction is what stops a plain filesystem
 * server from tripping the trifecta while a web-plus-data-plus-send server
 * does.
 */
import type { ToolInfo } from "../types.js";
export interface ToolCapabilities {
    readonly readsPrivate: boolean;
    readonly ingestsUntrusted: boolean;
    readonly exfiltrates: boolean;
}
declare function classify(tool: ToolInfo): ToolCapabilities;
export interface ServerCapabilityRollup {
    readonly readsPrivate: string[];
    readonly ingestsUntrusted: string[];
    readonly exfiltrates: string[];
}
/** Roll per-tool capabilities up to the server, tracking which tools contribute each. */
export declare function rollupCapabilities(tools: readonly ToolInfo[]): ServerCapabilityRollup;
export { classify as classifyTool };